How you get manipulated by Dark Patterns without even realising.

In March 2021, California passed a law that banned the use of three dark patterns. These dark patterns prevent the intentional obfuscation and complexification of the 'unsubscribe' processes. The changes are being heralded as progress in the right direction for customers and their data rights (and respect toward customer ethics in my opinion).

Intentional obfuscation and complexification might be a bit of a mouthful but you’ve likely experienced these Dark Patterns before. 

Have you ever subscribed to something to download a whitepaper or something similar, only to be met with an unnecessarily complex ‘unsubscribe’ process? That’s an example of a dark pattern.

The common theme around the banned dark patterns is focused on the ability to opt-out easily, and not be tricked into opting in. The Verge details:

 The newly-approved regulation does not ban all uses of dark patterns, only those that have “the substantial effect of subverting or impairing a consumer’s choice to opt-out” of schemes where their personal data is being sold. The regulation offers a number of examples of such dark patterns, including:

• Using confusing language like double-negatives (eg “Don’t Not Sell My Personal Information”)
• Forcing users to “click through or listen to reasons why they should not submit a request to opt-out before confirming their request.”
• Requiring users to “search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out.”

These seem like common sense when you think about your experience as a customer, but for some reason, they are needed to be included as legislation because those things we expect as customers somehow get forgotten when it comes to aggressive growth and acquisition targets. Ethics seem to have gone out of the window when it comes to outcomes.

My experience with Dark Patterns from an Australian Bank

Responsible lending practices aside, there are other areas where banks “strive to achieve outcomes.” 

One of the more recent examples I’ve experienced is from one of the big four Australian banks. If you bank with them too, you may have seen it pop up in the app at some point. The message prompts you to make a decision where you are forced to accept the terms and conditions. I would imagine that many people pressed ‘accept’ without giving it much thought as their intention for opening the app was not to read a lengthy 'terms and conditions policy' but to access their balance or make a transfer.

The way this change was forced upon customers raised my suspicions of the intent behind the action. After reading the fine print, my suspicions were confirmed.

What customers were presented with upon opening the app was a terms and conditions splash page. To access any of their accounts or balances, customers were forced to accept the terms and conditions. By accepting those terms and conditions, customers had been opted into the bank’s rewards program. This rewards program enabled deidentified transaction data to be shared with advertisers. Those advertisers were then able to use that data to target customers with promotions.

It’s also virtually impossible to unsubscribe from this program, and even when you do, their partners can still send you notifications. You might recognise this example and the way Dark Patterns were used (it's a combination of Roach Motel and Privacy Zuckering techniques)

It’s likely that you’ve been exposed to these two, and many other Dark Patterns in your online experiences. Here are a few to get you further clued up and at the same time annoyed that they’ve been used on you.

Three common dark patterns you’ve probably seen in the wild.

Roach Motel:

The premise of this is that it’s super easy to sign up and virtually impossible to close your account.

Ever tried to close your Amazon account? Try it without googling it, I’ll bet you probably won’t work out the steps required to close it. Research suggests 5D Chess is easier. 

Yeah, that’s like that on purpose to create a barrier of effort between you and your ownership of your data. That’s an example of a dark pattern.

Improvements on closing your account have been made with some of the bigger tech players. This progress is likely due to GDPR and 'the right to be forgotten'. It’s not perfect but it is going in the right direction amidst strong resistance from Google for example.

Oh, and if you’re still trying to work out how to close your Amazon account, here’s a video guide: https://youtu.be/VS8wZP3nvSE

Privacy Zuckering:

The premise of this is that you might be giving more information than you actually need to, to use the service.

You might be answering some rather simple questions but it’s actually a data mining process. You get stitched up sharing more than you thought you did.

Like when you install an app and it asks you to sync your contacts. That message comes up often and is a convenience smokescreen for data mining. 

From CPRC, this type of action is categorised as a forced action: 

Forced action – requiring the user to perform a certain action to access, or continue to access, certain functionality (e.g. “Privacy Zuckering” whereby consumers are tricked into sharing more information about themselves than they intend to or would agree to).

Image Source: https://medium.com/@mohityadav0493/privacy-zuckering-deceiving-your-privacy-by-design-d41b6263b564 

Apple’s data privacy labels have caused a bit of a stir in the app store, particularly with the data Google Chrome sucks up from an app installed on the device. Do you really need all that data to be shared with Chrome on your phone?

Forced Continuity:

The premise here is that you sign up for the free subscription, forget to cancel and then start getting charged.

This is the classic ‘get into a premium but only want to get the free version’ tactic. You know the kind, ‘sign up for a free trial but enter your credit card details first so we can charge you after the trial expires’ kind.

We all know it and think it’s normal, except it’s actually an example of a dark pattern. This is one that I’d like to know what the detriment to conversion rate has been, if people walk away when they have to enter their credit card details, is that worth the revenue you make from tricking customers into signing up?

If you want more info on dark patterns, Harry Brignull created a website about them back in 2010. https://www.darkpatterns.org/types-of-dark-pattern 

Where I think dark patterns have originated from

I think many of these dark patterns may have arisen from unethical optimisation - Optimisations that are made purely to achieve a better result regardless of the ethical implications. As a good guide, remember to maintain the balance between good for business AND good for the customer.

Our responsibility and respect for customer data.

Many years ago I was having a discussion with a friend at the pub about the quality of data from forced sign-in to access content. This was between two broadcasters, one of which had an optional sign-up but fewer members and the other which had forced sign up but a larger number of members. The question is, are those that have chosen to opt-in more valuable than those that have not? After all, they have chosen to provide you with the data as opposed to having been forced to provide it.

That’s about where the questions behind the integrity of the data acquired via dark patterns lead us to. If people don’t want to give you this information willingly, how good is the magnetism of the product?

Rather than tricking customers into giving up their data, working out what benefits members have may better solve the problem of data acquisition. Maybe there is more utility that can be unlocked in the product that can compel customers to willingly and consciously decide to share their details by creating an account. 

To get out of the dark pattern spiral, reframe your approach to think about the membership benefits rather than other ways to coerce and deceitfully acquire membership.