Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence

Abstract

New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its stronger requirements for consent when companies collect and process users personal data. This work analyses the most prevalent CMP designs and measures their effect on people's consent choices. First, we scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.7% meet the minimal requirements we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent rates. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22-23 percentage points; and providing more granular controls on the first page decreases consent by 8-20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an efficient way to increase compliance.

How behavioural sciences can promote truth, autonomy and democratic discourse online

“…The first problem is that online platforms can leverage their proprietary knowledge of user behaviour to defang regulations. An example comes from most of the current consent forms under the European Union (EU) General Data Protection Regulation: instead of obtaining genuinely informed consent, the dialogue boxes influence people's decision-making through self-serving forms of choice architecture (for example, consent is assumed from pre-ticked boxes or inactivity) 41,42 . This example highlights the need for industry-independent behavioural research to ensure transparency for the user and to avoid opportunistic responses by those who are regulated.…”

Citizens Versus the Internet: Confronting Digital Challenges With Cognitive Tools

“…However, attempts to game the rules of informed consent and privacy by default have found to be a major challenge to GDPR implementation. Nouwens et al (2020) reported that dark patterns and hidden defaults in the form of implied consent are ubiquitous on new consent-management platforms (in the United Kingdom) and that only 11.8% meet minimal requirements of GDPR for valid consent (e.g., no prechecked boxes, explicit consent, rejecting as easy as accepting). According to a report by the Norwegian Consumer Council (2018), tech companies such as Google, Facebook, and-to a lesser extent-Microsoft use design choices in "arguably an unethical attempt to push consumers toward choices that benefit the service provider" (p. 4).…”

Purposes in IAB Europe’s TCF: Which Legal Basis and How Are They Used by Advertisers?

“…Matte et al found several plausible violations of both the GDPR and the ePD in the implementations of cookie banners by actors using this framework [38]. Nouwens et al [39] studied dark patterns in 5 popular CMPs of the TCF and estimated that only 11.8% of banners met minimum legal requirements. Other works on cookie banners briefly mentioned the framework [17,44].…”

“…This framework introduces Consent Management Providers (CMPs), new actors collecting consent through the use of so-called "cookie banners", and transmitting this consent to advertisers by implementing an API defined in the framework. The TCF became popular and is actively used on 1,426 out of top 22,000 EU websites [38], and in 680 UK websites [39].…”