# data[].attributes.attachment_link.readable_text
Join Our Community

Team up with more than 60,000 privacy supporters who receive weekly insights from The Privacy Whisperer newsletter & podcast and follow our daily discussions on social media

Luiza Jarovsky

# data[].attributes.attachment_link.title
Implement Privacy: Specialized Privacy Training for Professionals & Teams

# data[].attributes.attachment_link.description
Join Our Community Team up with more than 60,000 privacy supporters who receive weekly insights from The Privacy Whisperer newsletter & podcast and follow our daily discussions on social media Luiza Jarovsky

# data[].attributes.attachment_link.readable_text
Privacy insights & tips every week in your inbox. Join our community of 60,000+ privacy supporters on various platforms

No thanks

This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts

# data[].attributes.attachment_link.title
The Privacy Whisperer | Luiza Jarovsky | Substack

# data[].attributes.attachment_link.description
Privacy insights & tips every week in your inbox. Join our community of 60,000+ privacy supporters on various platforms. Click to read The Privacy Whisperer, by Luiza Jarovsky, a Substack publication with thousands of readers.

# data[].attributes.headline
EDPB: Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them

# data[].attributes.subject
EDPB: Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them

# data[].attributes.attachment_link.title
Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them

# data[].attributes.attachment_link.description
The European Data Protection Board welcomes comments on the "Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them". Such comments should be sentMay 2nd 2022 at the latest using the provided form.

# data[].attributes.headline
EDPB: Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

# data[].attributes.subject
EDPB: Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

# data[].attributes.attachment_link.title
Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

# data[].attributes.attachment_link.description
Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

# data[].attributes.headline
ICO: Privacy in the product design lifecycle

# data[].attributes.subject
ICO: Privacy in the product design lifecycle

# data[].attributes.attachment_link.readable_text
Summary

If you're making a product or service that involves processing personal information, it is important to consider data protection law throughout the design and development process. This includes kick-off, research, design, development, launch, and post-launch phases.

The case for privacy - Your organisation must comply with relevant laws. But there are also pressing reasons beyond legal compliance to prioritise privacy. For example, the risk of harming people and society itself, as well as the business risks to organisations.

Privacy in the kick-off stage - including kick-starting collaboration, mapping your product's personal information needs, and ideas on weaving privacy into your business case.

Privacy in the research stage - including gathering up-front perspectives on privacy, testing of work in progress, and ways to protect the personal information of research participants.

Privacy in the design stage - including choosing the right moments, obtaining valid consent, and communicating privacy information in ways people understand.

Privacy in the development stage - including defining the appropriate amount of personal information required, exploring technical solutions that enhance privacy, and protecting personal information in development environments.

Privacy in the launch phase - including conducting pre-release checks, factoring privacy into rollout plans, and deciding how best to communicate changes.

Privacy in the post-launch phase - including monitoring and triaging fixes, reappraising expectations and norms, and celebrating privacy successes.

About this guidance

This guidance is written for technology professionals such as product and UX designers, software engineers, QA testers, and product managers. It assumes your organisation acts as a data controller. Companies whose software, products, apps, or websites collect, manage, or share people's personal information are likely to meet this definition. If your organisation acts as data controller, the organisation is responsible for complying with data protection law. Data protection obligations vary for organisations that fall outside this category, such as those that act as processors for personal information.

This guidance will help you, as technology professionals, understand how to incorporate data protection by default and design in your development of a technology product or service. It is not a substitute for detailed ICO guidance, but is intended to help you understand how to navigate and apply our more detailed guidance throughout the product design lifecycle.

To help you to understand the law and good practice as clearly as possible, this guidance says what organisations must, should, and could do to comply.

Legislative requirements

Must refers to legislative requirements.

Good practice

Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. You should do this unless there is a good reason not to. If you choose to take a different approach, you must be able to demonstrate that this approach also complies with the law.

Could refers to an option or example that you could consider to help you to comply effectively. There are likely to be various other ways you could comply.

This approach only applies where indicated in our guidance. We will update other guidance in due course.

# data[].attributes.attachment_link.description
If you're making a product or service that involves processing personal information, it is important to consider data protection law throughout the design and development process. This includes kick-off, research, design, development, launch, and post-launch phases. The case for privacy - Your organisation must comply with relevant laws.

# data[].attributes.headline
ISO/DIS 31700 Consumer protection — Privacy by design for consumer goods and services

# data[].attributes.subject
ISO/DIS 31700 Consumer protection — Privacy by design for consumer goods and services

# data[].attributes.headline
Luiza Jarovsky: Dark Patterns in Code: Ignoring User Choice

# data[].attributes.subject
Luiza Jarovsky: Dark Patterns in Code: Ignoring User Choice

# data[].attributes.attachment_link.readable_text
Hi everyone, today's topic is dark patterns in code. Following the main discussion, you will find privacy-related resources that might be helpful to you or to people you know. I respect your time and will be as brief as possible. In this edition of The Privacy Whisperer, you will find:

🔥 Announcements

💡 Dark Patterns in Code: Ignoring User Choice

📅 Upcoming privacy event

🔁 Trending on social media

📌 Privacy & data protection careers

Let's get started.

--
🔥 Announcements

The Privacy Whisperer is growing! There are now 60,000+ privacy supporters following us on various platforms. Visit our newsletter homepage for previous editions. For inquiries, get in touch.

Only two weeks left to register for our live course 'Privacy-Enhancing Design: The Anti-Dark Patterns Framework. Use the coupon TPW-10-OFF and get 10% off.

Upcoming courses: Privacy & AI (in May) and Privacy-Aware Parenting (in June). Join the waitlist to get early bird discounts.

--
💡 Dark Patterns in Code: Ignoring User Choice
I have discussed privacy UX and dark patterns in privacy extensively in this newsletter and in my paper. When approaching the topic, we are usually referring to deceptive design practices in the context of privacy that happen in the interface of websites and apps.

Prof. Cristiana Santos, who was involved in and analyzed several studies on the topic, presents a few possibilities:

When a user rejects all cookies through a cookie banner and the website continues storing cookies;

When a user did not yet provide his or her choice through the cookie banner and cookies are already being stored;

When the cookie banner declares that only necessary cookies will be stored, however, cookies for additional purposes are also stored;

When the consent management platform (CMP) is in a position to restrict the ability of the publisher to (de)select vendors.

"Our results indicate that in many cases user data is unfortunately still being collected, processed, and shared even when users opt-out. Our findings suggest that several prominent advertisers might be in potential violation of GDPR and CCPA. Overall, our work casts a doubt if regulations are effective at protecting users' online privacy."

One of the problematic aspects here is that, differently from UX-only dark patterns, the code-based dark patterns cannot be perceived by the user; they need to be audited to be discovered.

1. Improper consent management platform (CMP) integration with the publisher's website;

2. The site is using methods that aren't universally adopted throughout the digital ad ecosystem, so signals are dropped during the ad request;

3. Code patches and other updates by vendors accidentally break or cause downstream issues.

In terms of the legal consequences of dark patterns in code, the first one is that, at least according to the GDPR, data processing will be unlawful due to the absence of valid consent. If consent was the legal ground to collect and process data and what happened in practice was that user choice was not respected, then there was no consent, and the data processing was unlawful.

Another legal issue that arises is how to allocate responsibility. Who will be responsible if the user choice is not being honored?

"Data exchanged throughout this complex process contains user consent information that allows advertisers and publishers to determine whether they have the appropriate user consent needed to run IBA. This information is passed in the form of cookies or signals (in the case of the GPC) that help inform all CMPs and servers involved in the supply chain. This effectively creates hundreds of opportunities for signal failure, where data can be mishandled or leaked during any stage of the chain."

In this complex chain of events inaccessible to the end user, we must understand what entities are in control and are capable of making sure that the user choice is transmitted accordingly.

1. When including additional processing activities in their tool;

2. When they perform scanning and pre-sorting of tracking technologies;

3. When they include third-party vendors by default; and

4. When they deploy interface manipulative design strategies.

Most authors seem to agree that, in any case, constant auditing will be necessary, and additional parameters to make sure that the user choice is being honored throughout the chain of transmission.

💡 If you want to bring a competitive advantage to your company and dive deeper into privacy-enhancing design and avoiding dark patterns, join our live course about the topic in April (4 weeks, 1 live session per week + additional material). Check out the program and register now using the coupon TPW-10-OFF to get 10% off. To learn more about our courses, visit: implementprivacy.com/courses

--
📅 Upcoming privacy event
On 16/Mar, in the 2nd edition of Women Advancing Privacy, I will discuss with Dr. Ann Cavoukian, the inventor of Privacy by Design:

The origins of Privacy by Design

How it is essential for businesses, especially today

Her new Privacy by Design ISO certification

How we should think of Privacy by Design in the Age of AI

This will be a fascinating conversation. Join 1280+ confirmed attendees here. To watch our previous events, check out my YouTube channel.

--
🔁 Trending on social media
--
📌 Privacy & data protection careers
--
✅ Before you go:
See you next week. All the best, Luiza Jarovsky

# data[].attributes.attachment_link.title
Dark Patterns in Code: Ignoring User Choice

# data[].attributes.attachment_link.description
Hi everyone, today's topic is dark patterns in code. Following the main discussion, you will find privacy-related resources that might be helpful to you or to people you know. I respect your time and will be as brief as possible. In this edition of The Privacy Whisperer, you will find:

# data[].attributes.headline
Dark Patterns in Personal Data Collection: Definition, Taxonomy and Lawfulness

# data[].attributes.subject
Dark Patterns in Personal Data Collection: Definition, Taxonomy and Lawfulness

# data[].attributes.attachment_link.readable_text
51 Pages Posted: 31 Mar 2022 Last revised: 31 Oct 2022

Date Written: March 1, 2022

Abstract

Dark patterns in data protection (DP), as I define them in this work, consist of user interface design choices that manipulate the data subject's decision-making process in a way detrimental to his or her privacy and beneficial to the service provider. An important part of the study of DP is understanding the cognitive biases they exploit. A cognitive bias is a 'systematic (that is, non-random and, thus, predictable) deviation from rationality in judgment or decision-making'. DP exploit them, negatively affecting the data subject's decision-making process. In the present article, I propose a taxonomy for DP. The overall goal of the proposed taxonomy is to help us to understand better and address the legal challenges behind DP, especially how designers affect the data subject's decision-making process. The GDPR is silent about exploiting cognitive biases, manipulative interface designs, and negative interferences in the decision-making process. It also misses the opportunity to unpack the fairness principle and to present occasions in which unfair practices could spread within the data protection realm, for example, through design. To curb DP, fairness is a central concept, as it reflects the need to balance the asymmetries between controllers and data subjects. The GDPR refers to fairness multiple times, yet, it has no definition thereof, either specificity or enforceability for the concept. Dark patterns are an unfair data collection practice. The way to advance data protection law is by unpacking the idea of fairness so that it can encompass the right of fair data collection, fair data processing, and fair data use. Lastly, when dealing with consent by the data subject, acknowledging cognitive biases and the preventive and corrective measures necessary to mitigate them is indispensable. Human choice will never be perfect, however, in the online environment, any asymmetry is aggravated by the immense processing and analytical powers owned by technology companies. Cognitive biases must be acknowledged, and any choice or interaction framework must overcome them.

Keywords: dark patterns, behavioural biases, data protection, General Data Protection Regulation (GDPR), online manipulation, online privacy

# data[].attributes.attachment_link.keywords[]
dark patterns in personal data collection: definition

# data[].attributes.attachment_link.title
Dark Patterns in Personal Data Collection: Definition, Taxonomy and Lawfulness

# data[].attributes.attachment_link.description
Dark patterns in data protection (DP), as I define them in this work, consist of user interface design choices that manipulate the data subject’s decision-makin

# data[].attributes.attachment_link.readable_text
Dark patterns in privacy are a trending topic. There are various academic papers (including mine) dealing with the topic, the EU Digital Services Act (DSA) and the California Privacy Rights Act (CPRA) explicitly prohibit dark patterns, and fines punishing dark patterns continue to accumulate on both sides of the Atlantic. Nevertheless, there is still uncertainty regarding where is the line that separates dark patterns from other design practices. In today's newsletter, I discuss the latest guidelines issued by the European Data Protection Board for cookie banners, and my proposed Privacy-Enhancing Design framework, showing that there is still a long way to go for the law to meet Privacy UX practices on the ground.

🔥 Before we start, our usual announcements:

As The Privacy Whisperer grows (57,500+ privacy supporters on multiple platforms), we want to keep spreading privacy awareness and providing value to the community on more fronts, especially with the ongoing layoffs and uncertain economic situation. Starting today, your weekly privacy newsletter will have more sections: privacy careers, upcoming privacy events, and privacy solutions for businesses. More news coming soon. If you have feedback, questions or want to propose a partnership in any of these areas, get in touch.

Visit our newsletter and podcast archives for previous editions. Follow me on Twitter and LinkedIn for daily privacy-related content. If someone forwarded this article to you, subscribe.

-

Despite recent fines, such as the record-breaking penalty issued by the FTC to Epic Games (the developers of Fortnite) or the smaller but conceptually meaningful penalty that the French Data Protection Authority (CNIL) issued to Discord, there are still blurred lines regarding what exactly will be considered a dark pattern in privacy (and punished as so) and what will not.

Yesterday, the European Data Protection Board (EDPB) issued a " Draft Report of the work undertaken by the Cookie Banner Taskforce" clarifying various types of dark patterns in the specific context of cookie banners. Before we review them, it is important to highlight the disclaimer issued by the EDPB regarding the practical meaning of their interpretation.

They presented various types of cookie banner dark patterns, which will serve to help the community understand how they look in practice. I must comment that it would have been even more helpful - especially to non-legal professionals - if the EDPB had incorporated visual representations of the dark patterns in their draft report. Let's go through each of them:

Type A: "No reject button on the first layer"

"When authorities were asked whether they would consider that a banner which does not provide for accept and refuse/reject/not consent options on any layer with a consent button is an infringement of the ePrivacy Directive, a vast majority of authorities considered that the absence of refuse/reject/not consent options on any layer with a consent button of the cookie consent banner is not in line with the requirements for a valid consent and thus constitutes an infringement."

Type B: "Pre-ticked boxes"

"The taskforce members confirmed that pre-ticked boxes to opt-in do not lead to valid consent as referred to either in the GDPR."

Type C: "Deceptive link design"

"In order for a valid consent to be freely given, the taskforce members agreed that in any case a website owner must not design cookie banners in a way that gives users the impression that they have to give a consent to access the website content, nor that clearly pushes the user to give consent"

Type D: "Deceptive button colors" & type E: "Deceptive button contrast"

"It appears that the configuration of some cookie banners in terms of colours and contrasts of the buttons (...) could lead to a clear highlight of the 'accept all' button over the available options."

Type H: "Legitimate interest claimed"

"(...). The controller relied on legitimate interests under article 6(1)(f) GDPR for different processing activities as, for example, 'Create a personalised content profile' or 'Select personalised ads' whereas it could be considered that no overriding legitimate interest would exist for such processing activities."

Type I: "Inaccurately classified essential"

"It appears that some controllers classify as 'essential' or 'strictly necessary' cookies and processing operations which use personal data and serve purposes which would not be considered as 'strictly necessary' within the meaning of Article 5(3) ePrivacy Directive or the ordinary meaning of 'strictly necessary' or 'essential' under the GDPR."

Type K: "No withdraw icon"

"It appears that where controllers provide an option allowing to withdraw consent, different forms of options are displayed. In particular, some controllers have not chosen to use the possibility to show a small hovering and permanently visible icon on all pages of the website that allows data subjects to return to their privacy settings, where they can withdraw their consent."

As someone researching dark patterns, it is very helpful that they brought more clarification on the matter. However, there should be much more detailed official guidelines and best practices recommendations on how to do Privacy UX properly.

In this newsletter, a few months ago, I proposed a framework called Privacy-Enhahcing Design, with the goal of bringing to attention this important interaction between the fields of privacy and UX design.

The central idea behind Privacy-Enhancing Design is that users are vulnerable, manipulable, and easily influenced by cognitive biases. UX designers can maliciously exploit cognitive biases through deceptive design (i.e., dark patterns), negatively affecting user privacy.

Privacy-Enhancing Design proposes that UX designers must acknowledge the existence of cognitive biases and human errors and create interfaces that respect user autonomy, and prioritize choices that preserve user privacy.

A privacy-enhancing UX design practice is a UX practice that acknowledges cognitive biases and human errors, respects user autonomy and prioritizes choices that preserve user privacy

To be able to implement Privacy-Enhancing Design correctly, UX designers and product managers must have some understanding of privacy and data protection law. From my point of view, it should be taught in design, computer science, marketing, and business schools (and also in law schools as part of data protection law).

The seven principles (or heuristics, as UX designers prefer) of Privacy-Enhancing Design are:

Acknowledgment of Cognitive Biases. Cognitive biases must be broadly recognized and acknowledged. The exploitation of cognitive biases to collect more - or more sensitive - personal data (i.e., through dark patterns in privacy) must be stopped throughout the UX design process. Users should be seen as vulnerable and manipulable, and it is the organization's responsibility to shield users from manipulation.

Below is a non-exhaustive list of practices that can be considered aligned with Privacy-Enhancing Design:

any default setting that favors zero data sharing;

building default settings that favor the most privacy-protective option;

using colors, fonts, sizes, or contrasts to prioritize the most "privacy-fostering" option in a menu;

building an interface that does not force or pressure users to constantly share more data;

transmitting any privacy-related information in a concise, usable user-friendly, and user-centered manner;

communicating a product or service's privacy features (and possible risks) in a proactive and straightforward way;

not using pressuring language or terminology to induce users to share more or more sensitive data;

making it easier for users to choose a privacy-protective option;

making the privacy-protective option faster or more prominent;

offer prompt help (e.g., online chat, 24/7 customer service, email with quick answers by a human) to support users in navigating privacy settings and choices;

doing user experience research to check, in practice, if the user understands and can navigate the available privacy options and settings properly;

constantly conducting user research to check for privacy weaknesses of the UX design or additional privacy risks that the user might be experiencing;

What are your views on the topic? Do you think that Privacy-Enhancing Design could be an effective framework to help curb dark patterns and make tech professionals aware of their privacy impact? What are the next steps to improve Privacy UX?

💡 I would love to hear your opinion. I am sharing this article on Twitter and on LinkedIn, you are welcome to join the discussion there.

-
📌 Privacy & Data Protection Careers
If you are looking for a job in the fields of privacy and data protection, explore the links below and use the platforms' filters to personalize results. Wishing you the best of luck!

LinkedIn Job Search:

Indeed Job Search:

-
📅 Upcoming Privacy Events & Conferences
IAPP Global Privacy Summit - April 4th-5th, 2023 - in Washington, DC, United States

Computers Privacy and Data Protection (CPDP) - May 24th-26th, 2023 - in Brussels, Belgium.

Privacy Law Scholars Conference (PLSC) - June 1st-2nd, 2023 - in Boulder, CO, United States.

Annual Privacy Forum - June 1st-2nd, 2023 - in Lyon, France

*To submit your privacy and data protection event, get in touch.

-

📢 Privacy Solutions for Businesses (sponsored)

There are various companies offering privacy solutions for businesses. In today's newsletter, the featured privacy partner is Simple Analytics, an EU-based analytics service. Click on the image below to learn more about their privacy features. To get your first month for free, use my referral link.

*To get your product or service featured at The Privacy Whisperer, get in touch.

See you next week. All the best, Luiza Jarovsky

# data[].attributes.attachment_link.description
Dark patterns in privacy are a trending topic. There are various academic papers (including mine) dealing with the topic, the EU Digital Services Act (DSA) and the California Privacy Rights Act (CPRA) explicitly prohibit dark patterns, and fines punishing dark patterns continue to accumulate on both sides of the Atlantic.

# data[].attributes.attachment_link.readable_text
Hi everyone, in today's newsletter, I discuss dark patterns in privacy and how they are a form of autonomy impairment. Following the main discussion, you will find privacy-related resources that might be helpful to you or to people you know. I respect your time and will try to be as brief as possible. In this edition of The Privacy Whisperer, you will find:

🔥 Announcements

💡 Dark Patterns in Privacy: An Autonomy Problem

📅 Upcoming privacy events

🔁 Trending on social media

📌 Privacy & data protection careers

Let's get started.

-

The Privacy Whisperer is growing! There are now 60,000+ privacy supporters following us on various platforms. Visit our newsletter homepage for previous editions. For inquiries, get in touch.

Registration for our April online course 'Privacy-Enhancing Design: The Anti-Dark Patterns Framework' is now open. Use the coupon TPW-10-OFF and get 10% off.

Upcoming courses: Privacy & AI (in May) and Privacy-Aware Parenting (in June). Join the waitlist.

-
💡 Dark Patterns in Privacy: An Autonomy Problem
Now that dark patterns are expressly prohibited in EU and US laws (see more below), I would like to bring a new perspective on the topic.

The first edition of this newsletter, back in May 2022, was about deceptive design (dark patterns) in privacy. This is one of the topics of my Ph.D. research, and my academic paper on the matter (Dark Patterns in Personal Data Collection: Definition, Taxonomy, and Lawfulness) was cited by the EU and by the Organisation for Economic Co-operation and Development ( OECD) reports on dark patterns.

For those who are new, in simple terms, I define dark patterns in privacy as:

"deceptive design practices used by websites and apps to collect more personal data or more sensitive data from a user"

They are everywhere, and most probably, you encounter some form of dark pattern in privacy on a daily basis when you are online.

Here is an example of a cluster of dark patterns from my old friend TikTok (read my full TikTok analysis here):

In the same popup, there are 2 calls to action and 3 different explanations/assumptions:

➔ Calls to action:

➔ Explanations/assumptions:

It says that doing the above will lead to experience improvement

It says that connecting me with friends (from email and Facebook) is a form of experience improvement

It says that ad personalization is a form of experience improvement

My questions (and why there are dark patterns here):

1. What is the connection between giving access to a Facebook friends list and giving access to email? Why ask these two permissions in the same pop-up if these are two different contexts and types of data?

2. Why are personalized ads described as experience improvement? Will every additional access be described as an experience improvement?

3. Why the two calls to action are under one "OK" button? Shouldn't I have separate choices over my data?

4- Why are two different data processing purposes (experience improvement and personalized ads) under one "OK" button? Shouldn't I have separate choices over my data?

5. Why are the buttons asymmetric? "OK" is in capital letters and bold, while "Don't allow" is not capitalized and not bold. Why not use simply "allow" and "don't allow" (none in bold) to make it clear that there are permissions being asked and that I have a choice?

6- Does email access include all my email content or only my email contact list? It's not clear.

7- Bonus: I clicked on "Help Center," and a blank screen appeared on my mobile device. Screenshot and further comments here.

I have written various other articles about the topic, analyzing the cognitive biases behind dark patterns, how transparency can help us advance, how to design meaningful choices, fixing privacy settings, and so on.

In the last few months, there have been meaningful advances in the matter of dark patterns. Various academic papers and reports were published, the Digital Services Act (DSA) in the EU and the California Consumer Privacy Act in the US (CCPA, amended by the California Privacy Rights Act) are among the legislations with global influence that now expressly ban dark patterns, and large fines have been issued, such as the $520 million fine to Epic Games.

Despite these (welcome) advances, the issue of dark patterns is deeper, and it would be beneficial to look at it from a broader perspective: autonomy impairment.

Dark patterns are a way to bypass user autonomy through design. An organization creates an interface or feature that relies on cognitive biases to make the user do what the organization wants them to do. It does not allow the user to fully understand what is going on and express their conscious choice.

In the realm of data, there are various ways in which autonomy can be bypassed, not only through design.

When an organization creates a biased machine learning system (e.g., which was trained on biased data), it is also impacting user autonomy by creating harm, amplifying stigma, and restringing the opportunities of those affected by the bias/discrimination. So algorithm bias can also be seen as a way to bypass autonomy through code.

When a company launches a privacy-invasive device or software, e.g., one that collects or processes data in an unexpected way or that unnoticeably surveils passersby or third parties, it bypasses autonomy through architecture.

So our autonomy - one of the most central aspects of being human - is being threatened, a perspective which I do not see being sufficiently handled. This is one of the topics I research in my Ph.D., and I hope to offer a better regulatory framework. Stay tuned.

💡 If you would like to learn more about this topic, join our next live course in April, Privacy-Enhancing Design: The Anti-Dark Patterns Framework (4 weeks, 1 live session per week + additional material). Check out the program and register now using the coupon TPW-10-OFF to get 10% off. To learn more about our courses, or to organize a private cohort for your organization, visit: implementprivacy.com/courses

-
📅 Upcoming privacy events
On 16/Mar, in the 2nd edition of 'Women Advancing Privacy', I will discuss with Dr. Ann Cavoukian, the inventor of Privacy by Design:

The origins of Privacy by Design

How it is essential for businesses, especially today

Her new Privacy by Design ISO certification

How we should think of Privacy by Design in the Age of AI

This will be a fascinating conversation, and I would like to invite everyone to join on Linkedin Live. To watch our previous events, check out my YouTube channel.

-
🔁 Trending on social media
-
📌 Privacy & data protection careers
We have gathered relevant links from large job search platforms and additional privacy jobs-related info on our Privacy Careers page. We suggest you bookmark it and check it periodically for new openings. Wishing you the best of luck!

-
✅ Before you go:
See you next week. All the best, Luiza Jarovsky

# data[].attributes.attachment_link.title
Dark Patterns in Privacy: An Autonomy Problem

# data[].attributes.attachment_link.description
Hi everyone, in today's newsletter, I discuss dark patterns in privacy and how they are a form of autonomy impairment. Following the main discussion, you will find privacy-related resources that might be helpful to you or to people you know. I respect your time and will try to be as brief as possible.

# data[].attributes.attachment_link.readable_text
Dark patterns (or deceptive design), according to Harry Brignull - the first designer who coined the term - are "tricks used in websites and apps that make you do things that you didn't mean to, like buying or signing up for something." Some common examples are websites or apps that make it almost impossible to cancel or delete an account, almost invisible links to unsubscribe from a non-requested newsletter, and insurance products that are surreptitiously added to your shopping cart. You can check more examples here or tweet and expose your own personal findings using the hashtag #darkpattern (they might be retweeted by this account - it's worth checking out some outrageous examples there).

One of the chapters of my ongoing Ph.D. in data protection, fairness, and UX design is about dark patterns in the context of data protection (you can download the full article I wrote on the topic here). I defined them as "user interface design choices that manipulate the data subject's decision-making process in a way detrimental to his or her privacy and beneficial to the service provider." In simple terms, they are deceptive design practices used by websites and apps to collect more personal data or more sensitive data from you. They are everywhere, and most probably, you encounter some form of dark pattern on a daily basis during online activities. Below are some examples of practices I call dark patterns:

1- Screenshot from the TikTok sign-up page:

In this example, you cannot know if the "Yes" or "No" buttons are for the "are you over 18" or for the "do you allow TikTok to show personalized ads" question. According to my taxonomy, it would be a "mislead" type of dark pattern, as it misleads the data subject into not opting out of personalized ads.

2- Screenshot from Linkedin Settings:

Each of the sections above contains data protection-related choices (despite the fact that a few of the sections' titles does not seem related to data protection), accounting for almost hundreds of options. This excessive amount of choices is not empowering; on the contrary, it distracts data subjects from important data protection choices and confuses them. This type of dark pattern is "hinder," as by adding an excessive amount of choices, it hinders the capability of the data subject to choose according to his or her true preferences.

3- Screenshot from the website groopdealz.com:

Here, through manipulative language, the website is pressuring the data subject to add his or her email and subscribe to the newsletter, so the category of dark pattern is "pressure." To read more about the taxonomy and the different types of categories and sub-categories, click here.

In the full article about the topic, I have discussed dark patterns' mechanism of action and the behavioral biases that are exploited by them (showing how they manage to manipulate us to do something that was not our initial intention). I have also presented their legal status regarding the European General Data Protection Regulation - GDPR (no, they are not explicitly illegal) and offered a taxonomy to help us understand what is and what is not a dark pattern. Lastly, I proposed paths of regulatory changes that could help us move forward from here and improve the protection that is offered to us, data subjects.

My goal in talking about them in this newsletter is to increase awareness about the topic and to show that the design of websites and apps is not inoffensive or neutral. Design is a powerful tool to manipulate behavior, and sometimes - particularly because of behavioral biases - it is difficult to detect and avoid manipulative tricks, especially online.

What you can do as an individual is to try and be critical about your behavior online and why you are interacting with certain platforms in a certain way (what is your goal? What will you gain with that? What will the platform gain with that? Is is possible that you are being tricked into behaving in a certain way that is actually harmful to you?).

Online platforms that offer services that we love - such as Facebook, Twitter, Tiktok, Amazon, Netflix, Spotify, Tinder, and so on - are not "neutral." They are companies working for (a lot of) profit, and an important input for them to make money is your personal data. Their foremost goal isn't doing good to people and to the world but pleasing shareholders (hopefully following the law). Law is not always (perhaps never) at the same pace as the technologies it is applied to (and related manipulative techniques to make them more profitable), so it is important that you are aware of what is happening and decide what is better for you.
✅ Before you go:
See you next week. All the best, Luiza Jarovsky
Share Luiza Jarovsky's Weekly Newsletter

# data[].attributes.attachment_link.title
Dark Patterns (Deceptive Design) in Data Protection

# data[].attributes.attachment_link.description
Dark patterns (or deceptive design), according to Harry Brignull - the first designer who coined the term - are "tricks used in websites and apps that make you do things that you didn't mean to, like buying or signing up for something."

# data[].attributes.headline
A mini-game about pop ups, and the deviousness of websites and apps

# data[].attributes.subject
A mini-game about pop ups, and the deviousness of websites and apps

# data[].attributes.attachment_link.title
Terms & Conditions Apply - A fun mini-game about pop-ups and the deviousness of websites and apps

# data[].attributes.attachment_link.description
A fun mini-game about pop-ups and the deviousness of websites and apps

# data[].attributes.attachment_link.title
Dark Patterns: Manipulative UX Design and the Role of Regulation webinar recording 3.24.2021

# data[].attributes.attachment_link.description
Deceptive patterns (also known as "dark patterns") are tricks used in websites and apps that make you do things that you didn't mean to, like buying or signing up for something.

# data[].attributes.attachment_link.readable_text
To help you stay on top of developments we've built a high-level legislation tracker looking at areas relevant to digital businesses across the EU, UK and Germany. Our Digital Legislation Tracker covers incoming and recent law in:

digital and e-commerce

data and cybersecurity

ICT services, networks and infrastructure

consumer protection and product liability

copyright, media and advertising

AI and emerging technology

other tech-related legislation.

Access the tracker below - or download the mobile app via the App Store or Google Play - to find a brief summary of the legislation, who it impacts, how far it's got and when it will apply, as well as useful links. You can also search by title or across multiple topics and jurisdictions.

# data[].attributes.attachment_link.description
To help you stay on top of developments we've built a high-level legislation tracker looking at areas relevant to digital businesses across the EU, UK and Germany. Our Digital Legislation Tracker covers incoming and recent law in: digital and e-commerce data and cybersecurity ICT services, networks and infrastructure consumer protection and product liability copyright, media and advertising AI and emerging technology other tech-related legislation.

# data[].attributes.attachment_link.readable_text
The European Commission wants to discuss with stakeholders how to improve consumer awareness of online tracking and alternatives to tracking-based advertising as part of its exercise to reach a voluntary pledge to phase out cookies before the year's end.
As anticipated by EURACTIV, on 28 March, EU Justice Commissioner Didier Reynders announced the launch of a voluntary initiative to address the growing 'cookie fatigue' of internet users, namely the fact of having to continuously consent or refuse the processing of their data when landing on a website.

As such, the European Commission's consumer protection department is organising a series of roundtable discussions with stakeholders like publishers, advertisers, AdTech companies, digital platforms and consumer protection. The first roundtable will take place on 28 April.

"The objective would be to propose simpler choices of advertising models to consumers, respecting, if this is so, their wish not to be tracked, and provide alternative methods for the personalisation of advertising in exchange of continued free of monetary payment content," reads the discussion note for the roundtable, seen by EURACTIV.

In an interview with EURACTIV in December, Reynders anticipated that he sees voluntary initiatives as a way to prepare the ground for binding rules.

Cookie fatigue

Cookies are pieces of code that websites place on a user's web browser that can be retrieved later, for instance, to tell the website that the user has returned to the page. Cookies are regulated under the ePrivacy Directive, and they are used to collect consent for processing personal data under the General Data Protection Regulation (GDPR).

"The current cookie consent mechanisms can however be very complex: with cookie banners popping up every time users visit a new website," the document continues, "and with choices often presented in a confusing way which does not allow users to make a fully informed decision or drives them to make choices they would otherwise not necessarily have made."

The Commission considers that many people are tired of these complex cookie banners and just give up on expressing their privacy preferences.

Moreover, the EU consumer department considers that the heavy use of advertising trackers via cookies raises several privacy concerns, targeted advertising efficiency and lost consumer trust, pointing to research suggesting users do not want to be tracked.

"However, this does not mean that consumers would be against personalised advertising, as they want to continue benefiting from free of monetary payment online content and relevant ads. Personalisation, therefore, needs to be more respectful of their privacy aspirations," the note added.

Consumer information

Allowing consumers to make an informed decision is a significant part of the discussion. The Commission wants to give users more transparent information on the commercial context where they would be subject to tracking-based advertising and with what privacy implications.

Therefore, stakeholders will be asked how they think the information on the business model and personal data collection can be presented upfront and transparent and how it could interact with the transparency obligations under the GDPR and ePrivacy Directive.

A specific case is raised on marketplaces, as they would have to explain how their advertising activities are carried out in addition to their primary business model.

Another question is how consumers can be comprehensively and understandably informed about the privacy implication of their choice, avoiding an 'information overload'.

A critical point relates to whether web browsers or apps could be used to centralise the consumers' choice regarding the business model rather than being asked each time someone visits a website.

This proposal is not new and is somewhat controversial as the world's largest advertising company, Google, owns the most popular web browser, Chrome.

Alternatives to tracking

The other central strand of the discussion regards possible alternatives to tracking-based advertising that would still provide relevant ads with less intrusive personalisation solutions that would remove the need for cookies and similar technologies.

In this regard, the Commission wonders what performance criteria should be used to assess whether the alternative solutions allow publishers and AdTech intermediaries to offer comparably 'attractive' ads to advertisers and consumers.

In addition, stakeholders will be asked what type of information or user profiles would be needed to provide a meaningful alternative to personalised ads.

In terms of providing automated solutions, one idea on the table is to provide consumers with the possibility of choosing alternatives to track-based ads as the default options in the settings of their web browsers.

"Technically what do the different alternatives mean in terms of browser and operating systems settings or implications on other technical questions? Are there solutions to non-tracking based targeted advertising that are independent of browsers and operating systems?" the note asks.

A final question concerns the trackers used to improve websites' performance and measure advertising performance. The EU executive is trying to understand what data would still need to be collected for this purpose and what would be a more privacy-friendly approach.
[Edited by Nathalie Weatherald]

# data[].attributes.attachment_link.title
Cookie fatigue: The questions facing the EU Commission initiative

# data[].attributes.attachment_link.description
The European Commission wants to discuss with stakeholders how to improve consumer awareness of online tracking and alternatives to tracking-based advertising as part of its exercise to reach a voluntary pledge to phase out cookies before the year's end.

# data[].attributes.headline
‘Deceived by Design: How Tech Companies Use Dark Patterns to Discourage us From Exercising our Rights to Privacy’ (2018)

# data[].attributes.subject
‘Deceived by Design: How Tech Companies Use Dark Patterns to Discourage us From Exercising our Rights to Privacy’ (2018)

# data[].attributes.attachment_link.description
A statement or action can be said to be manipulative if it does not sufficiently engage or appeal to people’s capacity for reflective and deliberative choice. O

# data[].attributes.headline
Privacy and Manipulation in the Digital Age

# data[].attributes.subject
Privacy and Manipulation in the Digital Age

# data[].attributes.attachment_link.readable_text
32 Pages Posted: 7 Feb 2019

Date Written: January 23, 2019

Abstract

The digital age brings with it novel forms of data flow. As a result, individuals are constantly being monitored while consuming products, services and content. These abilities have given rise to a variety of concerns, which are most often framed using "privacy" and "data protection"-related paradigms. An important, oft-noted yet undertheorized concern is that these dynamics might facilitate the manipulation of subjects; a process in which firms strive to motivate and influence individuals to take specific steps and make particular decisions in a manner considered to be socially unacceptable. That it is important and imperative to battle manipulation carries with it a strong intuitive appeal. Intuition, however, does not always indicate the existence of a sound justification or policy option. For that, a deeper analytic and academic discussion is called for. This Article begins by emphasizing the importance of addressing the manipulation-based argument, which derives from several crucial problems and flaws in the legal and policy setting currently striving to meet the challenges of the digital age. Next, the Article examines whether the manipulation-based concerns are sustainable, or are merely a visceral response to changing technologies which cannot be provided with substantial analytical backing. Here the Article details the reasons for striving to block manipulative conduct and, on the other hand, reasons why legal intervention should be, in the best case, limited. The Article concludes with some general implications of this discussion for the broader themes and future directions of privacy law, while trying to ascertain whether the rise of the manipulation-based discourse will lead to information privacy's expansion or perhaps its demise.

Keywords: Privacy, Data Protection, Manipulation, Privacy As Control, Privacy Theory, Free Speech, Autonomy, PII

# data[].attributes.attachment_link.keywords[]
privacy and manipulation in the digital age

# data[].attributes.attachment_link.title
Privacy and Manipulation in the Digital Age

# data[].attributes.attachment_link.description
32 Pages Posted: 7 Feb 2019 Date Written: January 23, 2019 The digital age brings with it novel forms of data flow. As a result, individuals are constantly being monitored while consuming products, services and content.

# data[].attributes.headline
Bringing Design to the Privacy Table: Broadening “Design” in “Privacy by Design” Through the Lens of HCI

# data[].attributes.subject
Bringing Design to the Privacy Table: Broadening “Design” in “Privacy by Design” Through the Lens of HCI

# data[].attributes.attachment_link.readable_text
In calls for privacy by design (PBD), regulators and privacy scholars have investigated the richness of the concept of "privacy." In contrast, "design" in HCI is comprised of rich and complex concepts and practices, but has received much less attention in the PBD context. Conducting a literature review of HCI publications discussing privacy and design, this paper articulates a set of dimensions along which design relates to privacy, including: the purpose of design, which actors do design work in these settings, and the envisioned beneficiaries of design work. We suggest new roles for HCI and design in PBD research and practice: utilizing values- and critically-oriented design approaches to foreground social values and help define privacy problem spaces. We argue such approaches, in addition to current "design to solve privacy problems" efforts, are essential to the full realization of PBD, while noting the politics involved when choosing design to address privacy.

# data[].attributes.attachment_link.title
Bringing Design to the Privacy Table | Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems

# data[].attributes.attachment_link.description
In calls for privacy by design (PBD), regulators and privacy scholars have investigated the richness of the concept of "privacy." In contrast, "design" in HCI is comprised of rich and complex concepts and practices, but has received much less attention in the PBD context.

# data[].attributes.headline
Transparency by Design: Reducing Informational Vulnerabilities Through UX Design 

# data[].attributes.subject
Transparency by Design: Reducing Informational Vulnerabilities Through UX Design 

# data[].attributes.attachment_link.title
Transparency by Design: Reducing Informational Vulnerabilities Through UX Design

# data[].attributes.attachment_link.description
Can transparency help us solve the challenges posed by dark patterns and other unfair practices online? Despite the many weaknesses of transparency obligations

# data[].attributes.headline
Improving Consent in Information Privacy Through Autonomy-Preserving Protective Measures (APPMs) 

# data[].attributes.subject
Improving Consent in Information Privacy Through Autonomy-Preserving Protective Measures (APPMs) 

# data[].attributes.attachment_link.readable_text
16 Pages Posted: 5 Apr 2019

Date Written: September 2018

Abstract

In this article, I argue that due to numerous shortcomings, current online consent mechanisms do not allow data subjects to think, decide and choose according to their internal beliefs, therefore impairing essential individual freedoms - or capabilities, following Martha Nussbaum's Capabilities Approach. I identify the main shortcomings of consent in privacy as issues of cognitive limitations, information overload, information insufficiency, lack of intervenability and lack of free choice, describing the type of imbalance present in each category. Then, based on current privacy theories and focusing on the concepts of autonomy and protection - and how they can be combined and manifested in policymaking - I propose the MAPP (Methodology for Autonomy-Preserving Protection), a methodology to evaluate (old) or design (new) measures to improve consent and reinstall the freedoms of thought, decision and choice in this context. According to the MAPP, if an entity A wants to generate positive welfare to an individual B, then: 1) the intentions or goals of A must be transparent, known to B and open to legal questioning and criticism; 2) the actions of A must be transparent, non-manipulative, known to B and open to legal questioning and criticism; and 3) the actions of A must not interfere in the decision-making capacities of B, preserving her autonomy. Lastly, applying the methodology, I present a non-exhaustive list of Autonomy-Preserving Protective Measures (APPMs), showing how they can enable the three freedoms highlighted in the present work and support more effective consent mechanisms.

Keywords: Data Protection, Data Privacy, Privacy, Consent, Information Privacy, GDPR, General Data Protection Regulation, Autonomy

Jarovsky, Luiza, Improving Consent in Information Privacy Through Autonomy-Preserving Protective Measures (APPMs) (September 2018). European Data Protection Law Review, Volume 4, Issue 4 (2018) pp. 447 - 458, Available at SSRN: https://ssrn.com/abstract=3350052

# data[].attributes.attachment_link.keywords[]
improving consent in information privacy through autonomy-preserving protective measures (appms)

# data[].attributes.attachment_link.title
Improving Consent in Information Privacy Through Autonomy-Preserving Protective Measures (APPMs)

# data[].attributes.attachment_link.description
16 Pages Posted: 5 Apr 2019 Date Written: September 2018 In this article, I argue that due to numerous shortcomings, current online consent mechanisms do not allow data subjects to think, decide and choose according to their internal beliefs, therefore impairing essential individual freedoms - or capabilities, following Martha Nussbaum's Capabilities Approach.

# data[].attributes.headline
IP Report: Shaping Choices in the Digital World, From dark patterns to data protection: the influence of UX/UI design on user empowerment

# data[].attributes.subject
IP Report: Shaping Choices in the Digital World, From dark patterns to data protection: the influence of UX/UI design on user empowerment