-Akshita Singh*
Abstract
It’s a Sunday, we are scrolling through our feeds and a notification pops up from our favourite shopping platform - “end of season sale, 50% off on top brands”. Next move: we are scouring the website to grab the best deal. As thrilling as the experience sounds, such tactics may, encapsulate practices which are intended to lure the consumers ultimately inducing a bittersweet flavour to our shopping experience.
Such practices, commonly referred to as “dark patterns”, are essentially a set of behavioural patterns which aim to puzzle the consumers. The GOI took a crucial step by coming up with Guidelines on prevention of dark patterns thereby lending some direction to the consumers today.
Through this article, the author walks through the key stipulations of these Guidelines which is followed by a comprehensive cross jurisdictional analysis and some insightful concluding remarks.
Introduction
Ever delved into the riveting tale of ‘Snow white and the seven dwarfs’ (1937) and its captivating character – the evil queen? If not, allow me to produce a quick glimpse of one of her iconic dialogues - ‘Mirror mirror, on the wall, who is the fairest of us all’? asked the queen eagerly. ‘Thou, O Queen, art the fairest in the land,’ responded the mirror’. Fast forwarded a few minutes, the subsequent claim of the mirror stating snow white as fairer, led her to gallop onto the mission of killing Snow white. While the scene and the movie call for a perfect score on the creativity scale, imagining its 2023 spin off would be a sight you cannot miss. For at least, in today’s times, she would be able to grab a fairness cream product, whose ability to make individuals fairer are advertised a celebrities, thereby enabling her to beat snow white in the fairness contest and saving herself from the tiresome mission. The only climax would be the product falling short of its claimed efficiency. The end. While this spin off would continue to remain a product of creativity, at the heart of the film would lie an underlying truth about the world today - ‘misleading advertisements’ and attempts to lure and trick the consumers.
Enter digitization and the issues surrounding today’s consumers have aggravated significantly across platforms and sellers in the past few months. With the intent to clamp these issues down and foster consumer protection, the caretakers of consumer interest of the country, i.e., the Central Consumer Protection Authority (“CCPA”) issued the Guidelines for Prevention & Regulation of Dark Patterns, 2023 (“Guidelines”). In addition to advertisers, these Guidelines apply to a gamut of other platforms including sellers offering goods and services in India. Given the significance these Guidelines bear in today’s digital era, it is of utmost importance to gain an understanding of its content, particularly its implications.
Keeping this in mind, the author takes a comprehensive dive into the Guidelines by listing down its essential features. However, the focus of the article lies on the cross jurisdictional analysis wherein the author walks through likewise legislations across other nations thereby, painting a holistic view on the issue. This is followed by a conclusion wherein the author puts forth her final remarks.
Dissecting the Guidelines: A glimpse of the key features
The Guidelines are applicable to a broad and exhaustive list of platforms which offer goods and services in India, advertisers and sellers.[i] The definitions of advertisers and sellers, as used in the Guidelines, is borrowed from other two primary legislations namely, the Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022 (“Misleading Advertisements Guidelines”) and the Consumer Protection (E-commerce) Rules, 2020 (“E-commerce Rules”) respectively.
The Guidelines define dark patterns as “practices or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision making or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights.”[ii] Most importantly, the Guidelines, specify a list of dark patterns practices in Annexure I.[iii] Some of the dark patterns identified include inter alia basket sneaking (inclusion of additional items to the consumer’s basket at the time of checkout without obtaining their explicit consent), false urgency (stating or implying the sense of urgency or scarcity with the intent to mislead a user), confirm shaming (creating a sense of fear or shame in the mind of the user in order to push them to act in a certain way), bait and switch (advertising a certain product using a specific outcome but serving another outcome deceptively) and disguised advertisements (masking or false advertisements). As a thumb rule, the Guidelines prohibit entities from engaging in any of the mentioned dark patterns as well as any other pattern which may be specified from time to time.
In essence, these Guidelines mark a significant step in the direction of tackling of dark patterns. An identification of However, the extent to which these Guidelines can attain success in spirit i.e., in actually curbing dark patterns remains a mystery for time to unravel given how manipulative these practices are which prompts the need for a slightly more nuanced approach.
Cross-jurisdictional analysis
While it is true that the Guidelines mark a momentous stride towards fortifying consumer interests in a time where digitization dominates the economy, it is also critical to take a ride through some of the similar laws in other countries to gain a more comprehensive overview. The countries (U.S.A, E.U., and Korea) have been carefully picked, bearing in mind their practical and mixed outlook towards handling dark patterns. While U.S.A and E.U. depict how different laws can be used harmoniously to address these patterns, Korea on the other hand, shows how even a single set of guidelines (through a clear scope and broader categories) can be smartly utilised to curb them.
(i) U.S.A
In the United States of America (“USA”), there is not standalone legislation on dark patterns and has largely been left open to states for independent regulation. However, that does not mean that efforts have not been made to address them altogether. Notably, the country strives to address dark patterns both from the perspective of consumer protection as well as data privacy. This approach takes cognizance of different implications of dark patterns across sectors thereby streamlining the regulation, an issue which may arise in India.
From a consumer protection angle, the Federal Trade Commission (“FTC”) of the USA has taken significant steps to protect its consumers, including inter alia, announcing its 10-million-dollar settlement against an online subscription service which ran a deceptive subscription program (as it failed to inform the consumers of the automatic renewal of their memberships because of which they were charged on a recurring basis without their explicit authorisation) and proposing amendments to its Rule concerning the Use of Prenotification Negative Option Plans (“Negative Option Rule”),. which mandates sellers to disclose their plan’s material terms vividly before consumers subscribe for the service, for tackling dark patterns. Vide the proposed amendment, the FTC seeks to expand the scope of the Negative Option Rule to also cover subscriptions and other negative option arrangements such as automatic renewals or continuity plans. To this end, an informal hearing has been scheduled in January 2024. Whereas from a data privacy perspective, there is the recently amended California Consumer Privacy Act, 2020[iv] (“CCPA”) and the California Privacy Rights Act, 2020 (through their respective definitions of ‘consent’ and ‘dark patterns’) both of which, draw attention to the validity of consent and frown upon such business practices which either obtain consent through dark patterns or impair the consumer’s right to revoke his or her consent.[v] So, technically by not having a single legislation on dark patterns, the USA has actually taken a more practical approach by letting the states address dark patterns via different laws in a way that they harmonise and not contradict each other.
It is also important to note that the FTC had released a staff report in September 2022 titled ‘Bringing dark patterns to light’ wherein they identified dark patterns through its objectives. For instance, the report, discussed dark patterns in the context of ‘design elements which inter alia subverted privacy choices, caused unauthorised charges, induced false beliefs and hid material information from consumers’.[vi] The report also took into account businesses which targeted a specific group of consumers such as children or native speakers and accordingly prescribed necessary standards of consumer protection. A guidance-based approach such as this has allowed the country to tackle dark patterns more effectively.
(ii) European Union
The European Commission and the national consumer protection authorities of twenty-three states had commenced the year 2023 by releasing the results of its investigation on nearly 400 retail websites to assess how frequently dark patterns were used by these platforms. The results revealed that almost 40% of the online shopping websites employed manipulative tactics to trick the consumers. As immediate next steps, the national authorities got in touch with the traders and asked them to rectify their websites and make it free of such practices.
The screening followed the guidelines on dark patterns issued by the European Data Protection Board (EDPB).[1] Titled as “Dark Patterns in social media platform interfaces: How to recognise and avoid them” (“EDPB guidelines”), the EDPB guidelines were adopted in March 2022. Version 2.0 of the EDPB guidelines was released in February 2023. They refrained from stating definitive or bright-line standards for determining whether a user interface design involves dark patterns, but cautioned the users against certain specific categories of deceptive design patterns including “overloading (attempts to overwhelm the user with multiple requests or information), skipping (purposely making the user forget specific data protection aspects through manipulative user interface), stirring (appealing to the emotions of the users), hindering (preventing the user from making an informed decision), fickle (creating confusion in the mind of the users by projecting information in an unclear way) and left in the dark” (hiding key information or privacy control from users), all of which violated the requirements envisioned under the European Union – General Data Protection Regime (“GDPR”).
In terms of legislations, the EU in fact, has a broad spectrum of laws which regulate dark patterns in one way or the other which categorically ban dark patterns. In a nutshell, these laws include the Unfair Commercial Practices Directive, the Digital Services Act and a host of sector-specific legislations (for instance, the statement issued by the German Federal Financial Supervisory Authority on prohibiting dark patterns in trading apps or trading portals in November 2022). Further, while the GDPR and the e-Privacy Directive (formally referred to as the Directive 2002/58 on Privacy and Electronic Communications, the directive seeks to keep the confidentiality of electronic communications intact) do not categorically mention dark patterns, they do form a part of the current legal framework which regulate dark patterns. For instance, in cases where organizations rely on consent as the legal basis for processing personal data under the GDPR or obtain consent for cookies or marketing communications under the e-Privacy Directive, it may be possible that they engaged in dark patterns while procuring such consent, thereby inducing the GDPR or the e-Privacy Directive respectively.
(iii) South Korea
The Korea Fair Trade Commission (“KFTC”) had issued new set of guidelines on the Self-Management of Dark Patterns (“Self-Management Guidelines”) providing specific guidance on how companies can avoid using dark patterns (i.e., deceptive marketing schemes) in their online user interfaces. The scope of the Self-Management Guidelines is limited to online transactions and advertisements which are regulated under the Consumer Protection in E-commerce Transactions Act and the Fair Labeling and Advertising Act , 1999 respectively.
Created as a follow-up to the KFTC’s announcement of its Policy Direction for Protecting Consumers from Online Dark Patterns in April 2023, the Self-Management Guidelines explain how the KFTC classifies dark patterns into specific types of conduct and provides guidelines for companies on engaging in each type of conduct, which consumers should also keep in mind when making online transactions. Accordingly, it sets forth both ‘categories of dark patterns’ and ‘conduct types’ under each of these categories. Each of these categories are identified basis the predominant feature of the pattern and include - defrauding, obstructive, misleading and pressuring. Under these categories are specific types of patterns which have been identified. Common conduct types under the category ‘defrauding’ entail hidden renewals, basket sneaking or offering of false discounts. In a similar vein, the conduct types under the category ‘obstructive’ are repeated interferences, emotional steering or concealed information.
The way forward
At this juncture, it may actually be interesting to note that the term ‘dark patterns’ is not a recent revelation. It was coined in the year 2010 by Harry Brignull to describe such practices that “trick or manipulate users into making choices they would not otherwise have made and that may cause harm”. This means that such practices are not infants and have grown up to become widespread practices. Which is why combating dark patterns calls for us to go the extra mile which inevitably lies beyond a laundry list of dark patterns. This need also surfaces considering the two fundamental characteristics of any denomination of a dark pattern i.e. deception and manipulation, because of which a consumer may not even realise their presence in the first place, let alone bucketing them under a specific head as identified under Annexure I.
Hence, a more consumer friendly and a business-friendly solution could have been a list of some common traits of dark patterns which could also be relied by both consumers, businesses and courts as guiding principles for identification of a practice as a dark pattern. An example of this approach would be the Competition Act, 2002[vii] which enlists factors that can be considered while gauging the dominance of an enterprise, thereby providing a direction to both the market players as well as the competition watchdog of the country. Some amount of clarity is also needed on the scope of the Guidelines given that a bunch of the dark pattern practices stipulated under the Annexure (for e.g., false urgency or interface interference) are actually used by entities for marketing/promotional purposes just to draw the attention of the consumers which is, in fact, essential for their sustenance given the cut-throat competition in the online space.
That said, the Guidelines do mark a positive measure as it comes as an acknowledgement of dark patterns by the government. However, the success of these Guidelines hinges on two factors: (i) awareness and (ii) adaptability. Generating awareness among the consumers of these patterns through workshops, campaigns, and other initiatives would play a key role in fortifying their interests. As a suggestive measure, a part of these awareness initiatives can entail ‘celebrity consciousness drives’ to prevent them from being dragged into the courts in cases involving misleading advertisements. Adaptability, on the other hand would allow the Guidelines remain organic and keep its relevance intact despite transitioning times.
It would be rather crucial for the courts and the government to wisely interpret and enforce their decisions on alleged dark patterns in a manner which ensures harmony across sectoral laws on the subject, regardless of whether they form a part of the dark patterns listed under Annexure I of the Guidelines. For instance, some of the dark patterns also run the risk of contravening consent specific requirements as required under the newly enacted Digital Personal Data Protection Act, 2023. As such, it needs to be deliberated and explained by the government as to how they intend on dealing with parallel contraventions which could also result in a double penalty. So long as the Annexure I is only used for guidance and not as a standalone guideline, by itself, these Guidelines could play a vital role shaping the future of consumers in the country.
References
[i] Section 3 of the Guidelines
[ii] Section 2(e) of the Guidelines
[iii] Section 2(i) of the Guidelines
[iv] California Consumer Privacy Act, 2020 defines dark patterns as “a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice, as further defined by regulation.”
[v] California Privacy Rights Act, 2020 specifically stipulates that “Likewise, agreement obtained through use of dark patterns does not constitute consent.”
[vi] Please refer to the section ‘Common Dark Patterns & Consumer Protection Concerns’ from page 4 onwards of the staff report.
[vii] Section 19(4) of the Competition Act, 2002
*Akshita Singh is an Associate in the TMT team at IndusLaw.