DARK PATTERNS IN E-COMMERCE: CONSUMER PROTECTION RELEVANCE.

INTRODUCTION

The designs of online platforms are far from neutral in the digital economy. Online platforms are increasingly designed to manipulate consumers through cognitive biases and manipulative user interface and user experience (UI/UX) designs that embody “dark patterns”.[1]From “scarcity timers” that create artificially high levels of urgency to precarious methods of subscription termination referred to as “roach motels”, these design decisions undermine consumer autonomy and distort economic activity.[2] Digital markets have grown at an exponential rate. However, the same legal doctrines that regulate markets remain anchored in traditional understandings of fraud and misrepresentation, which are ill-suited to regulating such subtle forms of psychological coercion by online platforms.

This article argues that dark patterns, which exploit behavioural patterns through psychological coercion, through the tricks and traps of interface design, cannot be appropriately regulated by current consumer protection laws, which are built upon the “information paradigm” and consumer disclosure. To protect consumers in the digital space, it is proposed that legislation should abandon the idea of mere disclosure and focus on a substantive fairness principle in choice architecture. This article is in three sections. The first section gives an account of the limitations of the information paradigm in regulating cognitive manipulation. Then, it considers recent comparative law developments in the European Union, the US, and India. And it proposes a design-based regulatory model with “fairness by design”.

III. MAIN BODY

The Information Paradigm is Limited

The paradigm for consumer protection is the “information paradigm”. The paradigm is based on the premise that consumers are rational economic actors who, if provided with appropriate information, will act to maximise their utility.[3] Therefore, the classic approach to regulatory governance has been to require information disclosure, promote transparency, and prohibit outright fraud. And often we have in mind the “average consumer”, a fictional character who is an informed, vigilant, and circumspect consumer.[4]

However, the claim of rationality in consumer decision-making has been falsified. Such research reflects the limitations of human behaviour in terms of bounded rationality and systematic bias (such as the default bias, framing, and information processing).[5] Dark patterns tap into these limitations. For instance, a “confirm shaming” interface may not necessarily deceive players, but rather, it may make them feel guilty or as if they are in a social situation when taking certain action to steer the consumer in a certain direction.[6]

The issues with the information paradigm are evident in the need for informed consent. Under regulations such as the General Data Protection Regulation (GDPR), consent must be freely given, specific, informed, and unambiguous.[7] But online, it is common to see consent obtained through “consent fatigue” and other asymmetrical buttons (e.g., a large and bright “Accept All” button but a small and less visible “Manage Preferences” button).[8] In these cases, disclosure is a weapon. The sheer volume of information and misleading design render the legal fiction of consent irrelevant. So, a regulatory approach that merely requires more disclosure without regard to design is problematic.

Legislative Comparisons: New Regulatory Developments

Recognising the regulatory deficiencies, other regulators have recently taken specific action against dark patterns as a shift to substantive (as opposed to pure) disclosure regulation.

In the European Union, the regulatory environment has now been fortified with the adoption of the Digital Services Act (DSA).[9] Article 25 of the DSA will prohibit the design, organisation, and functionalities of online interfaces of those providers of online platforms, which deceive consumers, manipulate consumers, or otherwise materially distort the ability of the recipients of a service to make an informed decision.[10] This is the first time that online consumer protection law has been settled with a statutory prohibition that focuses on the interface design rather than the content of the specific transaction. And the European Data Protection Board (EDPB) has issued special guidance to identify (and forbid) dark patterns in social media platforms, further cementing the link between data protection and consumer protection.[11]

In contrast, in the US, the dark pattern phenomenon has been tackled so far primarily through the enforcement arm of the Federal Trade Commission (FTC) under Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices”.[12] In 2022, the FTC published a lengthy report outlining its action plan to “aggressively pursue” dark patterns.[13] The FTC has subsequently implemented these remedies in its successful case against Epic Games, in which it secured a $245 million settlement over alleged dark patterns designed to trick customers into spending money on in-app purchases and difficult cancellation strategies.[14]

And new markets, too, are getting serious. In 2023, India’s Central Consumer Protection Authority (CCPA) published the Guidelines for Prevention and Regulation of Dark Patterns, which specifically defines and bans 13 types of dark patterns, including “basket sneaking” and “subscription traps”.[15] India has therefore adopted a proscriptive approach by categorising these designs as “unfair trade practices” under the Consumer Protection Act, 2019, which provides a warning to e-commerce operators. These examples show an international trend: to regulate online transactions, it is not what they say but how they say it.

Rethinking Regulation for Design

To combat the effects of dark patterns, it is maintained that international regulatory frameworks should follow a design-oriented approach that is based on the principle of “fairness by design”. This means that designs of digital interfaces should be neutral, not predicated on seizures of control.[16]

First, legislation must be able to turn the burden of proof on its head. If an e-commerce provider declares an extremely uneven choice of architecture (e.g., it is much more difficult to cancel subscriptions than to start them – the “roach motel” pattern), fairness should be presumed. The merchant should be required to prove that it is not manipulating the design.

Second, we need the regulatory perspective to switch from “average consumer” to “vulnerable consumer” in digital environments. Given that dark patterns are often “algorithmically” targeted to appeal to psychological vulnerabilities (e.g., targeting impulsive shoppers through a sense of urgency), the law must recognise that digital platforms create a short-lived vulnerability for everyone.[17]

Lastly, enforcement may include technological audits. It’s not enough for law enforcement to simply check the terms and conditions of service; authorities should have sufficient technological expertise to examine the source code, results of A/B testing, and user interface (UI) and user experience (UX) wireframes (design mockups) to determine the goals of the design obsessions. The integration of behavioural science and technological audits with legal enforcement will assist in transforming from information disclosure to digital regulation.

CONCLUSION

Dark patterns are increasingly prevalent in e-commerce and a threat to market integrity and autonomy. As demonstrated in the article above, current trends in consumer protection based on the model of information and assumptions of the perfectly rational consumer cannot undo this exploitation of psychology through user-friendly interface and experience design. While the recent enactment and enforcement activities in the European Union, the US, and India have made great progress in this regard, it is but the beginning of a jurisprudential journey.

It is proposed here that, to safeguard consumers in the digital economy, we must move away from simple information regulations and start designing laws. States need to enact express statutory prohibitions against dark patterns and require “fairness by design”. By shifting the emphasis from information disclosure to information presentation, the law could help restore parity between digital platforms and consumers and ensure that the digital economy is based on the principle of autonomy and not manipulation.

REFERENCE(S):

Cases

Case C-210/96, Gut Springenheide GmbH v. Oberkreisdirektor des Landkreises Steinfurt, 1998 E.C.R. I-4657.

Legislation & Regulations

Federal Trade Commission Act, 15 U.S.C. § 45(a)(1).

Regulation (EU) 2016/679 (General Data Protection Regulation), 2016 O.J. (L 119)1.

Regulation (EU) 2022/2065 (Digital Services Act), 2022 O.J. (L 277) 1.

Books

Omri Ben-Shahar & Carl E. Schneider, More Than You Wanted to Know: The Failure of Mandated Disclosure (2014), https://chicagounbound.uchicago.edu/books/689/

Richard H. Thaler & Cass R. Sunstein, Nudge: Improving Decisions About Health, Wealth, and Happiness (2008), https://www.princeton.edu/~tleonard/reviews/nudge.pdf

Woodrow Hartzog, Privacy’s Blueprint: The Battle to Control the Design of New Technologies (2018).

Journal Articles

Harry Brull & Colin M. Gray, The Dark (Patterns) Side of UX Design, Proc. of the 2018 CHI Conf. on Hum. Factors in Computing Sys. 1 (2018).

Arunesh Mathur et al., Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites, 3 Proc. ACM on Hum. -Comput. Interaction 81:1 (2019).

Ryan Calo, Digital Market Manipulation, 82 Geo. Wash. L. Rev. 995 (2014). (“Georgetown Law Technology Review”), https://georgetownlawtechreview.org/online-manipulation-hidden-influences-in-a-digital-world/GLTR-01-2020/

Natali Helberger et al., The Vulnerable User, 40 Computer L. & Sec. Rev. 105495 (2021).

Reports

European Data Protection Board, Guidelines 3/2022 on Dark Patterns in Social Media Platform Interfaces: How to Recognise and Avoid Them (Mar. 14, 2022).

Fed. Trade Comm’n, Bringing Dark Patterns to Light (2022).

Press Release, Fed. Trade Comm’n, FTC Finalises Order Requiring Epic Games to Pay $245 Million for Tricking Users into Making Unwanted Charges (Mar. 14, 2023).

Cent. Consumer Prot. Auth. (India), Guidelines for Prevention and Regulation of Dark Patterns, Notification No. F. No. J-10/1/2023-CCPA (Nov. 30, 2023).

[1] Harry Brull & Colin M. Gray, The Dark (Patterns) Side of UX Design, 2018 Proc. of the 2018 CHI Conf. on Hum. Factors in Computing Sys. 1, 2 (2018).

[2] Arunesh Mathur et al., Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites, 3 Proc. ACM on Hum. -Comput. Interaction 81:1, 81:3 (2019).

[3] Omri Ben-Shahar & Carl E. Schneider, More Than You Wanted to Know: The Failure of Mandated Disclosure 34-36 (2014), https://chicagounbound.uchicago.edu/books/689/

[4] Case C-210/96, Gut Springenheide GmbH v. Oberkreisdirektor des Landkreises Steinfurt, 1998 E.C.R. I-4657, ¶ 31.

[5] Richard H. Thaler & Cass R. Sunstein, Nudge: Improving Decisions About Health, Wealth, and Happiness 83-85 (2008), https://www.princeton.edu/~tleonard/reviews/nudge.pdf

[6] Ryan Calo, Digital Market Manipulation, 82 Geo. Wash. L. Rev. 995, 1004 (2014), https://georgetownlawtechreview.org/online-manipulation-hidden-influences-in-a-digital-world/GLTR-01-2020/

[7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons concerning the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 4(11), 2016 O.J. (L 119) 1.

[8] Colin M. Gray et al., The Dark (Patterns) Side of UX Design, supra note 1, at 5.

[9] Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and Amending Directive 2000/31/EC (Digital Services Act), 2022 O.J. (L 277) 1.

[10] Id. at art. 25.

[11] European Data Protection Board, Guidelines 3/2022 on Dark Patterns in Social Media Platform Interfaces: How to Recognise and Avoid Them (Mar. 14, 2022).

[12] Federal Trade Commission Act, 15 U.S.C. § 45(a)(1).

[13] Fed. Trade Comm’n, Bringing Dark Patterns to Light 2-4 (2022).

[14] Press Release, Fed. Trade Comm’n, FTC Finalises Order Requiring Epic Games to Pay $245 Million for Tricking Users into Making Unwanted Charges (Mar. 14, 2023).

[15] Cent. Consumer Prot. Auth., Guidelines for Prevention and Regulation of Dark Patterns, 2023, Notification No. F. No. J-10/1/2023-CCPA (Nov. 30, 2023) (India).

[16] Woodrow Hartzog, Privacy’s Blueprint: The Battle to Control the Design of New Technologies 65-68 (2018).

[17] Natali Helberger et al., The Vulnerable User, 40 Computer L. & Sec. Rev. 105495, 3-5 (2021).