Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may even have fallen foul of them. These deceptive techniques that are applied to user interfaces are designed to trick or mislead us into doing something that benefits the business behind them and very often this means giving up your personal data.

One of the most common places to find them is in cookie banners but they could show up anywhere that a website or app owner wants to try to convince (read ‘manipulate’) you into doing something you might not have done if it weren’t for their deceptive design pattern. Think ambiguous wording, ‘guiding’ font, asymmetrical colour placement, “accept our terms or leave” walls… is it starting to sound familiar?

The term ‘Dark Pattern’ was first coined by Dr. Harry Brignull, UX expert and founder of the Deceptive Patterns Initiative. On its website, Deceptive Designs, it lists sixteen types of these dark (deceptive) patterns that range from Comparison Prevention to Nagging to Visual Interference. Much has been written on the topic since Dr. Brignull’s paper in 2010 and regulators around the world are beginning to address the issue directly.

Earlier this year, the European Data Protection Board (EDPB) issued a guidance document on how to recognise dark patterns on social media platforms and how to avoid them. They define the practice as:

[using] interfaces and user experiences implemented on social media platforms [to] lead users into making unintended, unwilling, and potentially harmful decisions in regard to their personal data, [all] with the aim of influencing users’ behaviours.

In their guidance, the EDPB describes dark patterns in six categories:

  1. Overloading

Essentially, this means having information come at you at such a rate that you are bamboozled into accepting or divulging more than you intended.

  1. Skipping:

These dark patterns try to trick you into forgetting all you’ve ever learned about protecting your personal data.

  1. Stirring:

If you’ve ever felt ‘guilted’ into giving away your personal information, this is probably why.

  1. Obstructing:

At one time or another, we’ve all been stuck in one of those seemingly endless loops when trying to find information or unsubscribe from a service. Now we have a name for it.

  1. Fickle:

“This doesn’t mean what it meant on the previous page!” Next time you mutter this to yourself while browsing a website, you’ll know why.

  1. Left in the Dark:

You’ve searched all over the website for the privacy notice or for information on how to change your user settings and all you can seem to find is another spurious link or the dreaded ‘Error 404’… can someone turn the lights back on, please.

Dark patterns may be unintentional or deliberate – either way, they are unlawful, and the regulators are on the case. And not just the Data Protection authorities. The German Federal Financial Supervisory Authority (BaFin) issued a guidance last November in which they advised that investment firms must not use dark patterns on their trading apps or portals.

If your website or app uses dark patterns, you could be in breach of several laws. Maybe your sales team is using them “innocently” to drive lead generation, or your marketing team to drive website engagement.

Let’s play a game of hide and seek – go take a look at your cookies banner right now and if the ‘Accept All’ button is bigger than, brighter than, more prominently placed than the ‘Reject All’ button… tag, you’re it.


Originally posted to LinkedIn on 25-05-2023

Author is Fiona Kiely, Senior Research Analyst and CDPO, CalQRisk

Recent News

The Golden Thread – Governance, Risk & Compliance

A joined-up approach to governance, risk and compliance (GRC) is something all GRC practitioners aspire to – but, ...
Read More

Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may ...
Read More

Over 100 Credit Unions Now Using CalQRisk

CalQRisk now has over 100 credit unions actively using their Governance, Risk Management and Compliance solution across the ...
Read More
risk management words

Governance, Risk and Compliance – An Integrated Process

Three-letter acronyms. Love them or hate them, we can appreciate that they are convenient shortcuts. Many of us ...
Read More

Paralympics Ireland choose CalQRisk to streamline their Governance, Risk & Compliance efforts 

Paralympics Ireland has recently implemented the CalQRisk solution to streamline their Governance, Risk Management and Compliance efforts.  Paralympics ...
Read More

Changes to ISO 27001

ISO 27001 is an international standard that outlines the requirements for an information security management system (ISMS). It ...
Read More

DORA – What you need to know

The purpose of the EU’s new Digital Operational Resilience Act (DORA) is to ensure the safety and security ...
Read More

ILCU and CalQRisk form Alliance

The Irish League of Credit Unions (ILCU) has collaborated with CalQRisk to offer a best-in-class governance, risk management ...
Read More

Top Cyber Risks in 2023

In 2023, there are several cyber risks of which organisations and individuals should be aware. These risks can ...
Read More
office meeting at sunrise

10 Things to Ask When Outsourcing / Choosing a Supplier

Many organisations choose to outsource critical functions or services to third parties/contractors. However, outsourcing the work does not ...
Read More