research-article

Circumvention by design - dark patterns in cookie consent for online news outlets

Authors:

Oda Elise Nordberg,

Marija SlavkovikAuthors Info & Claims

NordiCHI '20: Proceedings of the 11th Nordic Conference on Human-Computer Interaction: Shaping Experiences, Shaping Society

Article No.: 19, Pages 1 - 12

https://doi.org/10.1145/3419249.3420132

Published: 26 October 2020 Publication History

Abstract

To ensure that users of online services understand what data are collected and how they are used in algorithmic decision-making, the European Union’s General Data Protection Regulation (GDPR) specifies informed consent as a minimal requirement. For online news outlets consent is commonly elicited through interface design elements in the form of a pop-up. We have manually analyzed 300 data collection consent notices from news outlets that are built to ensure compliance with GDPR. The analysis uncovered a variety of strategies or dark patterns that circumvent the intent of GDPR by design. We further study the presence and variety of these dark patterns in these “cookie consents” and use our observations to specify the concept of dark pattern in the context of consent elicitation.

References

[1]

Reporters Without Borders. 2020. World Press Freedom Index. Supported by the Adessium Foundation. https://rsf.org/en/ranking

[2]

Harry Brignull and Alexander Darlington. 2010. Getting round GDPR with dark patterns. A case study: Techradar. https://www.darkpatterns.org/

[3]

CookieBot. 2020. Solution for Compliant Use of Cookies and Online Tracking. Cybot Denmark. https://www.cookiebot.com/

[4]

Datatylsinet Denmark. 2020. Nye retningslinjer om behandling af personoplysninger om hjemmesidebesøgende. https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/feb/nye-retningslinjer-om-behandling-af-personoplysninger-om-hjemmesidebesoegende/

[5]

Rossana Ducato and Enguerrand Marique. 2019. Come to the Dark Side: We Have Patterns. Choice Architecture and Design for (Un)Informed Consent. https://ssrn.com/abstract=3365952

[6]

Norway Forbrukerrådet. 2018. DECEIVED BY DESIGN: How tech companies use dark patterns to discourage us from exercising our rights to privacy. Forbrukerrådet, Norway. https://fil.forbrukerradet.no/wp-content/uploads/2018/06/2018-06-27-deceived-by-design-final.pdf

[7]

Simson L. Garfinkel and David Alexander Cox. 2009. Finding and Archiving the Internet Footprint. In First Digital Lives Research Conference: Personal Digital Archives for the 21st Century, London, England, 9?11 February 2009. https://simson.net/clips/academic/2009.BL.InternetFootprint.pdf.

[8]

Colin M. Gray, Yubo Kou, Bryan Battles, Joseph Hoggatt, and Austin L. Toombs. 2018. The Dark (Patterns) Side of UX Design. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems (Montreal QC, Canada) (CHI ’18). ACM, New York, NY, USA, Article 534, 14 pages. https://doi.org/10.1145/3173574.3174108

Digital Library

[9]

California Legislative Infromation. 2018. Assembly Bill No. 375, CHAPTER 55, Legislative Councel’s Digest. The state of California. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

[10]

Roxanne Leitão and Filip Jakobsen. 2018. A Survey on User-Interface Design Strategies to Address Online Bias. In Extended Abstracts of the 2018 CHI Conference on Human Factors in Computing Systems (Montreal QC, Canada) (CHI EA ’18). ACM, New York, NY, USA, Article LBW084, 6 pages. https://doi.org/10.1145/3170427.3188567

Digital Library

[11]

Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2019. Cookie Glasses. https://github.com/Perdu/Cookie-Glasses.

[12]

Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2019. Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework. CoRR abs/1911.09964(2019). arxiv:1911.09964http://arxiv.org/abs/1911.09964

[13]

Nic Newman, Richard Fletcher, Antonis Kalogeropoulos, and Rasmus Kleis Nielsen. 2019. Reuters Institute Digital News Report 2019. Reuters Institute and the University of Oxford. https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2019-06/DNR_2019_FINAL_1.pdf

[14]

Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal. 2020. Consent-O-Matic. https://github.com/cavi-au/Consent-O-Matic.

[15]

Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal. 2020. Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence. CoRR abs/2001.02479(2020). arxiv:2001.02479http://arxiv.org/abs/2001.02479

[16]

European Parlament and Council. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). EU. http://data.europa.eu/eli/reg/2016/679/oj

[17]

Leon Paternoster. 2018. Getting round GDPR with dark patterns. A case study: Techradar. Suffolk Libraries. https://www.leonpaternoster.com/posts/techradar-gdpr/

[18]

Truls Pedersen and Sjur Kristoffer Dyrkolbotn. 2018. The legally mandated approximate language about AI. Norsk Informatikkonferanse(2018). https://ojs.bibsys.no/index.php/NIK/article/view/506

[19]

Helle Sjøvaag and Truls Andre Pedersen. 2019. Female Voices in the News: Structural Conditions of Gender Representations in Norwegian Newspapers. Journalism & Mass Communication Quarterly 96, 1 (2019), 215–238. https://doi.org/10.1177/1077699018789885 arXiv:https://doi.org/10.1177/1077699018789885

[20]

Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. 2019. (Un)Informed Consent: Studying GDPR Consent Notices in the Field. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (London, United Kingdom) (CCS ’19). Association for Computing Machinery, New York, NY, USA, 973–990. https://doi.org/10.1145/3319535.3354212

Digital Library

Cited By

Xu MDennis LMustafa MDastani MSichman JAlechina NDignum V(2024)Safeguard Privacy for Minimal Data Collection with Trustworthy Autonomous AgentsProceedings of the 23rd International Conference on Autonomous Agents and Multiagent Systems10.5555/3635637.3663060(1966-1974)Online publication date: 6-May-2024
https://dl.acm.org/doi/10.5555/3635637.3663060
Bushati GRasmusen SKurteva AVats ANako PFensel A(2024)What is in your cookie box? Explaining ingredients of web cookies with knowledge graphsSemantic Web10.3233/SW-23343515:5(1593-1609)Online publication date: 9-Oct-2024
https://doi.org/10.3233/SW-233435
Schäfer RSahabi SBrocker ABorchers J(2024)Growing Up With Dark Patterns: How Children Perceive Malicious User Interface DesignsProceedings of the 13th Nordic Conference on Human-Computer Interaction10.1145/3679318.3685358(1-17)Online publication date: 13-Oct-2024
https://dl.acm.org/doi/10.1145/3679318.3685358
Show More Cited By

Index Terms

Circumvention by design - dark patterns in cookie consent for online news outlets

Index terms have been assigned to the content through auto-classification.

Recommendations

A US-UK Usability Evaluation of Consent Management Platform Cookie Consent Interface Design on Desktop and Mobile
CHI '23: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems

Websites implement cookie consent interfaces to obtain users’ permission to use non-essential cookies, as required by privacy regulations. We extend prior research evaluating the impact of interface design on cookie consent through an online behavioral ...
Mitigating User Exposure to Dark Patterns in Cookie Banners Through Automated Consent
Computational Science and Its Applications – ICCSA 2023 Workshops
Abstract
The General Data Protection Regulation (GDPR) has established a de facto standard for presenting consent banners to users. To comply with the GDPR, websites are required to obtain user consent before processing their personal data, both for the ...
Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
CHI '20: Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems

New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

NordiCHI '20: Proceedings of the 11th Nordic Conference on Human-Computer Interaction: Shaping Experiences, Shaping Society

October 2020

1177 pages

ISBN:9781450375795

DOI:10.1145/3419249

General Chairs:
David Lamas
Tallinn University, Estonia
,
Hegle Sarapuu
Trinidad Wiseman, Estonia
,
Publications Chairs:
Ilja Šmorgun
Tallinn University, Estonia
,
Gerd Berget
Oslo Metropolitan University, Norway

Copyright © 2020 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 26 October 2020

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Funding Sources

Norges Forskningsråd

Conference

NordiCHI '20

NordiCHI '20: Shaping Experiences, Shaping Society

October 25 - 29, 2020

Tallinn, Estonia

Acceptance Rates

NordiCHI '20 Paper Acceptance Rate 89 of 399 submissions, 22%;

Overall Acceptance Rate 379 of 1,572 submissions, 24%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

69
Total Citations
View Citations
2,381
Total Downloads

Downloads (Last 12 months)456
Downloads (Last 6 weeks)44

Reflects downloads up to 14 Oct 2024

Other Metrics

View Author Metrics

Citations

Cited By

Xu MDennis LMustafa MDastani MSichman JAlechina NDignum V(2024)Safeguard Privacy for Minimal Data Collection with Trustworthy Autonomous AgentsProceedings of the 23rd International Conference on Autonomous Agents and Multiagent Systems10.5555/3635637.3663060(1966-1974)Online publication date: 6-May-2024
https://dl.acm.org/doi/10.5555/3635637.3663060
Bushati GRasmusen SKurteva AVats ANako PFensel A(2024)What is in your cookie box? Explaining ingredients of web cookies with knowledge graphsSemantic Web10.3233/SW-23343515:5(1593-1609)Online publication date: 9-Oct-2024
https://doi.org/10.3233/SW-233435
Schäfer RSahabi SBrocker ABorchers J(2024)Growing Up With Dark Patterns: How Children Perceive Malicious User Interface DesignsProceedings of the 13th Nordic Conference on Human-Computer Interaction10.1145/3679318.3685358(1-17)Online publication date: 13-Oct-2024
https://dl.acm.org/doi/10.1145/3679318.3685358
Hadan HChoong LZhang-Kennedy LNacke L(2024)Deceived by Immersion: A Systematic Analysis of Deceptive Design in Extended RealityACM Computing Surveys10.1145/365994556:10(1-25)Online publication date: 17-Apr-2024
https://dl.acm.org/doi/10.1145/3659945
Inal YVolden FCarlsen CHjelmtveit S(2024)My Eyes Don't Consent! Exploring Visual Attention in Cookie Consent InterfacesProceedings of the 2024 Symposium on Eye Tracking Research and Applications10.1145/3649902.3653352(1-7)Online publication date: 4-Jun-2024
https://dl.acm.org/doi/10.1145/3649902.3653352
Zhang-Kennedy LKeleher MValiquette M(2024)Navigating the Gray: Design Practitioners' Perceptions Toward the Implementation of Privacy Dark PatternsProceedings of the ACM on Human-Computer Interaction10.1145/36373748:CSCW1(1-26)Online publication date: 26-Apr-2024
https://dl.acm.org/doi/10.1145/3637374
Seaborn KItagaki TWatanabe MWang YGeng PFujii TMandai YKojima MYoshida S(2024)Deceptive, Disruptive, No Big Deal: Japanese People React to Simulated Dark Commercial PatternsExtended Abstracts of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613905.3651099(1-8)Online publication date: 11-May-2024
https://dl.acm.org/doi/10.1145/3613905.3651099
Caragay EXiong KZong JJackson D(2024)Beyond Dark Patterns: A Concept-Based Framework for Ethical Software DesignProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642781(1-16)Online publication date: 11-May-2024
https://dl.acm.org/doi/10.1145/3613904.3642781
Asthana SIm JChen ZBanovic N(2024)"I know even if you don't tell me": Understanding Users' Privacy Preferences Regarding AI-based Inferences of Sensitive Information for PersonalizationProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642180(1-21)Online publication date: 11-May-2024
https://dl.acm.org/doi/10.1145/3613904.3642180
Singh VVishvakarma NKumar V(2024)Unveiling Digital Manipulation and Persuasion in e-Commerce: A Systematic Literature Review of Dark Patterns and Digital NudgingJournal of Internet Commerce10.1080/15332861.2024.233081323:2(144-171)Online publication date: 25-Mar-2024
https://doi.org/10.1080/15332861.2024.2330813
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

HTML Format

View this article in HTML Format.

Media

Figures

Other

Tables

View Table of Contents