Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may even have fallen foul of them. These deceptive techniques that are applied to user interfaces are designed to trick or mislead us into doing something that benefits the business behind them and very often this means giving up your personal data.

One of the most common places to find them is in cookie banners but they could show up anywhere that a website or app owner wants to try to convince (read ‘manipulate’) you into doing something you might not have done if it weren’t for their deceptive design pattern. Think ambiguous wording, ‘guiding’ font, asymmetrical colour placement, “accept our terms or leave” walls… is it starting to sound familiar?

The term ‘Dark Pattern’ was first coined by Dr. Harry Brignull, UX expert and founder of the Deceptive Patterns Initiative. On its website, Deceptive Designs, it lists sixteen types of these dark (deceptive) patterns that range from Comparison Prevention to Nagging to Visual Interference. Much has been written on the topic since Dr. Brignull’s paper in 2010 and regulators around the world are beginning to address the issue directly.

Earlier this year, the European Data Protection Board (EDPB) issued a guidance document on how to recognise dark patterns on social media platforms and how to avoid them. They define the practice as:

[using] interfaces and user experiences implemented on social media platforms [to] lead users into making unintended, unwilling, and potentially harmful decisions in regard to their personal data, [all] with the aim of influencing users’ behaviours.

In their guidance, the EDPB describes dark patterns in six categories:

  1. Overloading

Essentially, this means having information come at you at such a rate that you are bamboozled into accepting or divulging more than you intended.

  1. Skipping:

These dark patterns try to trick you into forgetting all you’ve ever learned about protecting your personal data.

  1. Stirring:

If you’ve ever felt ‘guilted’ into giving away your personal information, this is probably why.

  1. Obstructing:

At one time or another, we’ve all been stuck in one of those seemingly endless loops when trying to find information or unsubscribe from a service. Now we have a name for it.

  1. Fickle:

“This doesn’t mean what it meant on the previous page!” Next time you mutter this to yourself while browsing a website, you’ll know why.

  1. Left in the Dark:

You’ve searched all over the website for the privacy notice or for information on how to change your user settings and all you can seem to find is another spurious link or the dreaded ‘Error 404’… can someone turn the lights back on, please.

Dark patterns may be unintentional or deliberate – either way, they are unlawful, and the regulators are on the case. And not just the Data Protection authorities. The German Federal Financial Supervisory Authority (BaFin) issued a guidance last November in which they advised that investment firms must not use dark patterns on their trading apps or portals.

If your website or app uses dark patterns, you could be in breach of several laws. Maybe your sales team is using them “innocently” to drive lead generation, or your marketing team to drive website engagement.

Let’s play a game of hide and seek – go take a look at your cookies banner right now and if the ‘Accept All’ button is bigger than, brighter than, more prominently placed than the ‘Reject All’ button… tag, you’re it.


Originally posted to LinkedIn on 25-05-2023

Author is Fiona Kiely, Senior Research Analyst and CDPO, CalQRisk

Recent News

6 things you need to know about the Individual Accountability Framework (IAF)

The Central Bank of Ireland has recently released regulations and guidance on the Individual Accountability Framework (IAF). Here ...
Read More

Paysend chooses CalQRisk as their Risk Management Solution

Paysend, a next generation integrated global payment ecosystem, has recently implemented the CalQRisk solution in order to enhance ...
Read More

ESG and Sustainability Reporting

The practice of businesses promoting sustainability and social responsibility in their operations can be traced back to the ...
Read More

CalQRisk Wins Best RegTech Solution at National Fintech Awards

CalQRisk, a leading provider of Governance, Risk & Compliance solutions has won the ‘Best Regtech Solution Award’ at ...
Read More

CalQRisk shortlisted in National Fintech Awards

The CalQRisk solution is shortlisted for ‘Best Regtech Solution Award’ at the inaugural National Fintech Awards. The National ...
Read More

CalQRisk shortlisted in 2023 CIR Risk Awards

Having won ‘Risk Management Product of the Year’ at the 2022 CIR Risk Management Awards, CalQRisk is now ...
Read More

From Risk Capacity to Risk Appetite

Risk Capacity is the maximum amount of risk that an organisation is technically able to assume before breaching ...
Read More

SMT automates their approach to Risk Management with CalQRisk

SuMi TRUST Global Asset Services (“SMT”), a subsidiary of Sumitomo Mitsui Trust Bank Limited, one of the largest ...
Read More

Digital Operational Resilience for the Financial Sector Act (DORA)

The Digital Operational Resilience Act (DORA) entered into force on 16th  January 2023. It outlines EU regulations for information ...
Read More

8 Things to Consider in a Data Breach Response

A data breach can lead to reputational damage, financial losses and much more. By effectively preventing and investigating ...
Read More