Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may even have fallen foul of them. These deceptive techniques that are applied to user interfaces are designed to trick or mislead us into doing something that benefits the business behind them and very often this means giving up your personal data.

One of the most common places to find them is in cookie banners but they could show up anywhere that a website or app owner wants to try to convince (read ‘manipulate’) you into doing something you might not have done if it weren’t for their deceptive design pattern. Think ambiguous wording, ‘guiding’ font, asymmetrical colour placement, “accept our terms or leave” walls… is it starting to sound familiar?

The term ‘Dark Pattern’ was first coined by Dr. Harry Brignull, UX expert and founder of the Deceptive Patterns Initiative. On its website, Deceptive Designs, it lists sixteen types of these dark (deceptive) patterns that range from Comparison Prevention to Nagging to Visual Interference. Much has been written on the topic since Dr. Brignull’s paper in 2010 and regulators around the world are beginning to address the issue directly.

Earlier this year, the European Data Protection Board (EDPB) issued a guidance document on how to recognise dark patterns on social media platforms and how to avoid them. They define the practice as:

[using] interfaces and user experiences implemented on social media platforms [to] lead users into making unintended, unwilling, and potentially harmful decisions in regard to their personal data, [all] with the aim of influencing users’ behaviours.

In their guidance, the EDPB describes dark patterns in six categories:

  1. Overloading

Essentially, this means having information come at you at such a rate that you are bamboozled into accepting or divulging more than you intended.

  1. Skipping:

These dark patterns try to trick you into forgetting all you’ve ever learned about protecting your personal data.

  1. Stirring:

If you’ve ever felt ‘guilted’ into giving away your personal information, this is probably why.

  1. Obstructing:

At one time or another, we’ve all been stuck in one of those seemingly endless loops when trying to find information or unsubscribe from a service. Now we have a name for it.

  1. Fickle:

“This doesn’t mean what it meant on the previous page!” Next time you mutter this to yourself while browsing a website, you’ll know why.

  1. Left in the Dark:

You’ve searched all over the website for the privacy notice or for information on how to change your user settings and all you can seem to find is another spurious link or the dreaded ‘Error 404’… can someone turn the lights back on, please.

Dark patterns may be unintentional or deliberate – either way, they are unlawful, and the regulators are on the case. And not just the Data Protection authorities. The German Federal Financial Supervisory Authority (BaFin) issued a guidance last November in which they advised that investment firms must not use dark patterns on their trading apps or portals.

If your website or app uses dark patterns, you could be in breach of several laws. Maybe your sales team is using them “innocently” to drive lead generation, or your marketing team to drive website engagement.

Let’s play a game of hide and seek – go take a look at your cookies banner right now and if the ‘Accept All’ button is bigger than, brighter than, more prominently placed than the ‘Reject All’ button… tag, you’re it.


Originally posted to LinkedIn on 25-05-2023

Author is Fiona Kiely, Senior Research Analyst and CDPO, CalQRisk

Recent News

Regulatory & Supervisory Outlook Report – 5 Key Risk Topics for Credit Unions

The Central Bank of Ireland has published its Regulatory & Supervisory Outlook Report 2024 which includes the Central ...
Read More

CalQRisk shortlisted in RegTech Insight Awards

The CalQRisk solution has been shortlisted for two awards at the upcoming RegTech Insight Awards – Best Solution ...
Read More

Footprint Underwriting onboards CalQRisk for risk management and compliance

Footprint Underwriting, a leading underwriting agency in Ireland, has recently implemented the CalQRisk solution in order to enhance ...
Read More

Climate-Related & Environmental Risk Assessment Guide

A Climate & Environmental Risk Assessment Guide was issued to Risk Advisory Service subscribers in Dec 2023 following ...
Read More

Loan Product Risk Assessment Guide

The Risk Advisory Service Loan Product Risk Assessment Guide circulated recently provides a framework for conducting risk assessments ...
Read More

Risk Today – Strategic Planning

Last quarter’s Risk Today e-zine for CalQRisk’s Risk Advisory Service subscribers, focusses on how Risk Management Officers can ...
Read More

Learning Lessons from Incidents

All organisations experience “Incidents”. Some call them by other names: “Near Misses”, “Mistakes”, “Errors & Omissions”, “Operational Errors”.  ...
Read More

CalQRisk included on RegTech100 list for 2024

CalQRisk was named as part of the RegTech100 list for 2024. The RegTech100 is an annual list of ...
Read More

6 things you need to know about the Individual Accountability Framework (IAF)

The Central Bank of Ireland has recently released regulations and guidance on the Individual Accountability Framework (IAF). Here ...
Read More

Paysend chooses CalQRisk as their Risk Management Solution

Paysend, a next generation integrated global payment ecosystem, has recently implemented the CalQRisk solution in order to enhance ...
Read More