22 ms·

Dark patterns after the GDPR: consent pop-ups and their influence

MereInterest 6y ago
Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative consent for non-essential tracking or not.
- ectopod 6y ago
  The best way to let a site know that you don't want tracking cookies is to disable cookies. Most sites work fine. This one redirects you to: https://dl.acm.org/action/cookieAbsent https://dl.acm.org/action/cookieAbsent
- danShumway 6y ago
  The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodically to help maintain and improve our Web Site and enforce our online service polices. ACM only uses analytical cookies and does not use any user-specific targeting cookies. > A cookie is a small file of letter and numbers that is placed on your device. Cookies are only set by ACM when you visit restricted portions of our Web Site and help us to provide you with an enhanced user experience. Raw log files are treated as confidential. So... not sure why a public portion of their website straight-up won't load without them. They're clearly not only checking/setting cookies on certain pages, otherwise they wouldn't know that my cookies were disabled.
  - shadowgovt 6y ago
    It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).
  - that_guy_iain 6y ago
    One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.
    - satellite2 6y ago
      It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
      - that_guy_iain 6y ago
- sandgiant 6y ago
  This is just a regular journal page. Not surprised they're tracking their users. A better place to link would probably have been the arXiv: https://arxiv.org/abs/2001.02479v1 https://arxiv.org/abs/2001.02479v1.
- deleted 6y ago
  [deleted]
- 1vuio0pswjnm7 6y ago
  "Interesting that this site itself may use one of the described patterns." Is it really interesting, though. For example, we have seen this as a very common retort in HN comments every time an author is critical of advertising, tracking/analytics, etc. Someone points out the author's site itself uses the thing being critiqued. Is that supposed to detract from the argument being made by the author. That does not make much sense. It is a bit like another common retort we see in discussing tech company behaviour: "But everyone else is doing it." Does that make it OK. Or one we see when discussing regulatory action: "They should be focusing on X not Y." Don't look here, look over there. I am highly skeptical of comments that try to leverage these tactics. The message is what it is. Whether or not it is valid does not depend on who is voicing it, where it appears, or what's going on somewhere else. This is pure misdirection. This paper might be a worthwhile read. It makes little sense to pre-judge it before reading, simply because it appears on ACM's website, and ACM's website developers try to get users to enable cookies. What if the paper is re-posted on a site with no Javascript and that does not try to set cookies. Does the content of the paper then become "legitimate". Why or why not. It is easy to retrieve this paper without using cookies, from another site. For example, https://web.archive.org/web/20210305175101/https://dl.acm.org/doi/10.1145/3313831.3376321 https://web.archive.org/web/20210305175101/https://dl.acm.or... PDF: https://web.archive.org/web/20200701025846if_/https://dl.acm.org/doi/pdf/10.1145/3313831.3376321 https://web.archive.org/web/20200701025846if_/https://dl.acm... Not trying to single out this one comment. It's fine. The paper is not really arguing for or against banners and other notice and consent mechanisms, just studying their use. I cannot even see the banner because I use a text-only browser. The most interesting paragraph in the paper IMO is the last one. They ask why the client, e.g., through browser settings, cannot be in control of the legal consent mechanism. What if clients were to sed an additional HTTP header to indicate whether or not the user consent to cookies. For example, Allow-Cookies: no. The online advertising companies have apparently fought against this, e.g., the DNT header. If you enable DNT in one popular browser deployed by an advertising company you get this ridiculous warning message. Why the heck is it a big deal if the user controls the headers sent and the server has to honour them. When you read RFCs about www development they always make it sound like clients and servers on are equal footing. The reality is quite different. These companies want to control how a user "consents".
- asdff 6y ago
  I get some sick satisfaction whenever I mouse over these, right click, and hit "Block element"
  - rgoulter 6y ago
    Another technique: I've just been trying out the tridactyl Firefox plugin. (vi-inspired keybindings for browser usage). In tridactyl, the element can be hidden by typing out ";k", followed by a couple of letters to select the element hierarchy to hide.
  - tomjen3 6y ago
    I have had some luck just using reader mode. It is not important when I am on my ipad, because I use Safari in private mode and it doesn’t share cookies with other tabs, but this is even easier.
    - asdff 6y ago
      depends on the page, but reader mode can move around images strangely in my experience
- stiray 6y ago
  What I have seen everywhere is that all the consent is based on violating one of fundamentals of GDPR Art. 7(4): "It shall be as easy to withdraw as to give consent." All those dark patterns to hide the rejection, keep some things ticked etc. are a complete waste of time. They all violate GDPR and are just another case for: no one has read the GDPR and is just copying everyone else. It is just a waste of developers time, hiding rejection of consent, making it less understandable, etc. is just violating the GDPR. Google is violating it, Facebook is violating it,... but they have money for lawsuits, if you have it too, no problem, just copy them, if not, reconsider your tactics. Bottom line, you are wasting time and effort to implement it, you are trolling the users with popups and at the end even the consents that you got is invalid and void. So why doing it? Imagine the scenario, your beautiful website, your beautiful android application is being checked for a GDPR compliance based on lawsuit. And you bring in your dark-patterned consent dialog (whoever the provider is, it doesn't matter, YOU are the controller, YOU are the one who needs to care for your visitors/users privacy and you will be fined if google ads are violating privacy by their scripts run from your application/site). What do you think will happen, you will get pat on your back and someone one will say "you poor thing, you didn't understand, let me pardon you" or you will get an "Tommy Lee Jones" implicit facepalm [1]? Same goes for all the sites that stuff the user id into the "consent/no consent" cookie where just setting "consent=yes" or "consent=no" would be enough. Again, just same thing, for avoiding storing one PII you create another PII (by GDPR, anything that is unique to a person is PII) and violate it by doing that. Just why. Dont bother. Wait for a law suit and that is it. Dont just waste more money with same result as not wasting it, rather label a jar with "GDPR Lawsuit" label and stuff the money wasted for illegal consent methods into the jar. [1] https://me.me/i/implied-facepalm-when-something-is-so-ridiculous-that-a-full-21442403 https://me.me/i/implied-facepalm-when-something-is-so-ridicu...
K0nserv 6y ago
This is the PDF: https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf I couldn't understand how to find it on the linked site. Maybe the submission URL should be changed?
- angrais 6y ago
  If you click "Get Access" you'll be asked to lot into a university account or such
Bakary 6y ago
Who came up with the term dark patterns? It's psychological manipulation and fraud, pure and simple
- hnuser123456 6y ago
  Because there are shades of gray
  - Bakary 6y ago
    There's a spectrum of gray in the effect and scale of the manipulation, but deciding to manipulate the user or not is a binary choice.
    - SpicyLemonZest 6y ago
      Is it? It's comforting to think so, but I'm not convinced there's a meaningful dichotomy that can be drawn. I add a "save this card" functionality to my store so users don't have to type it in every time they buy something: am I offering a neat convenience feature, or am I manipulating them by reducing the psychological barrier of a sale?
      - Bakary 6y ago
        >Is it? It's comforting to think so, but I'm not convinced there's a meaningful dichotomy that can be drawn. I rework my store's checkout workflow, making it simpler so users only have to click a couple buttons to buy a product: am I making their lives easier, or am I manipulating them by reducing the psychological barrier of a sale? "making their lives easier" implies that the purchase is the default outcome that the user needs to improve their lives, when the purchase could simply not be made at all. As long as the intention is to make more money, and that the effort expended does not improve the nature of what is purchased in some way, I'd say it technically qualifies even if the consequences are the lightest of grays. That said, your example is thoughtful, and you are probably right overall. We could look at the broader context of all these systems encouraging consumption, but that would be moving the goalposts on my part. edit: just to clarify an edit took place while I was replying
slacktide 6y ago
GDPR consent buttons and statements are as worthless as the California Proposition 65 cancer warning that gets slapped on every consumer product. Any plugins to strip them out or automatically consent?
- Zak 6y ago
  Yes: I don't care about cookies https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  - ganzuul 6y ago
    An Android version would be great. The mobile web is becoming harder and harder to use.
    - Zak 6y ago
      You can use it on Android with Kiwi Browser, a Chromium derivative. It used to work with Firefox, but it looks like Firefox still hasn't un-broken extensions on Android.
      - tobasq 6y ago
        Looking at the source code suggests that Kiwi is based on Chromium 77. A shame; it's a great idea. We need a mobile browser with extensions.
        Zak 6y ago
        I suppose that's getting a bit dated, but I'd have to be actively experiencing significant breakage to give up extensions for a browser update. I am not.
- ericra 6y ago
  ublock origin takes care of most of them. You will want to go to settings > filters and make sure that you have EasyList, EasyPrivacy, and EasyCookie all enabled. I would also recommend Fanboy's Annoyances filter list enabled, as it contains quite a few nice cosmetic filters to block out similar annoying web elements.
rwcarlsen 6y ago
For me personally - all these popup banners and modal walls for websites about cookies and stuff just really make the internet a worse place. I suspect that empirically, they don't accomplish what the GDPR intended to - and they make the internet less enjoyable. Thanks GDPR.
- sefrost 6y ago
  Same here. I would be interested to know from people outside the GDPR area - do you ever see cookie banners? Do you know what they are? Sometimes I hit a USA based news website which simply denies access, because I'm in the UK, on GDPR grounds. Which seems an overreaction.
  - bombcar 6y ago
    EVERY WEBSITE I visit from my location in the USA seems to have these stupid cookie popups. We added one to OUR WEBSITE even though nothing is hosted in the EU - simple cargo-culting "everyone is doing it so we must do it also". I doubt it actually does a @#$@$ darn thing.
    - shadowgovt 6y ago
      We've had them up long enough for somebody to have generated some hard numbers by now. I wonder what the numbers look like on percentage of users that modify the settings from the default?
    - layoutIfNeeded 6y ago
      I don’t have a cookie banner on my website. You know why? Because I don’t track my users with (or without) cookies. Maybe you should stop doing it on your website, and then the cookie banner can be removed.
    - josefx 6y ago
      > We added one to OUR WEBSITE even though nothing is hosted in the EU Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it. > simple cargo-culting "everyone is doing it so we must do it also". If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.
justkez 6y ago
I recently purchased something from the official UK Nintendo Store [1]. I did not opt-in, and was not asked to opt-in, to marketing emails. Several days after purchase I received a marketing email with an Unsubscribe link. I submitted a GDPR enquiry and after a few weeks I get: Having investigated this matter fully, we can see that you were opted in as a result of a small technical difficulty which we are now fixing. We have taken action to set your marketing permissions to "no" as requested. I think we're so far past the GDPR "start date" that there's an apathy to it from companies and they're pushing the limits again. How Nintendo can have such a formalised GDPR enquiry process but such sloppy controls is beyond me. I will formally complain to ICO (UK data regulator) but I doubt it'll effect much. [1]: https://store.nintendo.co.uk/ https://store.nintendo.co.uk/
- switch007 6y ago
  This is absolutely /rife/ in my experience.
- vMPQonVtAjLWmr 6y ago
  Is the UK still subject to the GDPR now after Brexit?
  - Nextgrid 6y ago
    I believe GDPR is supposed to be implemented in every participating country's legislation, so the GDPR was implemented in UK law and this remains the case even after Brexit. Nothing prevents them from amending that law and repealing the GDPR's effects on it though.
    - anoncake 6y ago
      No, regulations are directly applicable. Directives have to be implemented by each country.
  - lmkg 6y ago
    Yes, part of the Brexit agreement was the UK "domesticating" some parts of EU law by passing them as UK legislation. There is now a law called UK-GDPR, which is literally a copy-paste of GDPR, with names of EU institutions find-and-replaced with their UK equivalents. There are still some operational differences, around the fact that the UK regulators will not participate the cooperation mechanisms that the other regulators will. This ends up mattering for businesses: a significant aspect of GDPR was that a company only ever had to deal with one regulator, but now they need to interface with one for the EU and a second for the UK.
scotu 6y ago
My favorite deceptive pattern I encountered is "double click the checkbox to disable". Literally a checkbox but it wouldn't do anything. I got a little frustrated and started clicking furiously just to discover that a double click would reliably disable the items... (I don't remember if this was on desktop or mobile, on mobile s/click/tap/g) Also, I personally lean towards being in favor of GDPR and cookie law (wish there were some improvements though); I'd like to say it just because every opinion you find is "GDPR useless", "cookie law bad"
- Guest42 6y ago
  Yes, seems as though those opinions are the loudest and perhaps it encourages the dissenters to stay quiet for fear of down-votes. Ive noticed that with certain viewpoints and have adjusted towards censoring myself a bit. The crowd seems bimodal but perhaps that's the nature of the conversations and the voting tool reinforces that.
  - Bakary 6y ago
    Much of the audience benefits from this sort of manipulation and tracking, so it's normal they would be hostile to any cookie law
  - TeMPOraL 6y ago
    Depends on the timezone, perhaps. I hail from the EU, post mostly during EU wake hours, and often comment in favor of GDPR, and I very rarely if ever get negative karma on those comments.
    - Guest42 6y ago
      Glad to hear. I am grateful for GDPR because I feel that it is an important step in the right direction.
- fy20 6y ago
  Such dark patterns are not allowed under GDPR, which says it must be opt-in, not opt-out.
superjan 6y ago
Today’s xkcd: https://xkcd.com/2432/ https://xkcd.com/2432/
- midasuni 6y ago
  Xkcd, like hackernews, does not require these silly pop ups. The problem isn’t the gdpr, it’s sites trying to use your personal data against your will.
Causality1 6y ago
As someone who's blocked cookies and ads for years, the result of the GDPR has a been a parade of unblocked pop-ups. Frankly I liked it better when pop-ups had naked women in them.
pixelpoet 6y ago
What absolutely infuriates me is this "legitimate interest" crap that is almost always hidden away, and often you have to scroll through literally hundreds of opt-outs with no way to disable them all in a single click. If I'm so damn "legimately interested", why is it on by default and basically impossible to turn off? Find me one person on this earth who is legitimately interested in being tracked by marketing companies who sell their information on to whatever giant collections. This should be illegal.
- detaro 6y ago
  While I agree it's often bullshit, "legitimate interest" is not trying to argue it to be your interest, but the sites.
- simpss 6y ago
  It's usually a good hint that it really isn't a legitimate intrest case if they allow you to turn it off. A legitimate intrest does not require an opt in (or an opt out). Consent does. If the page mixes those two up they're either clueless or trying to walk in the gray area and don't really understand(or don't want to understand) what either of those terms mean.
  - secondcoming 6y ago
    Legitimate Interest has a legal definition as a Legal Basis. It's a list of Purposes and Special Features that a Vendor declares to the IAB that they claim to need [0]. A User absoultely has the right to Object to Consent and Legitimate Interest. Any CMP that does not allow you to opt-out is on shaky GDPR legal ground. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json (see 'vendors' object)
    - Aachen 6y ago
      What's an IAB or CMP?
      - 6y ago
ddddfdohvsyknn 6y ago
These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the existing players (know who has the money to hire 20 compliance officers for every Tuscan villa?) and makes the barrier to entry to compete more difficult. Plenty of proto facebooks have fallen by the wayside. Remember AOL? Remember Myspace? Now the big players have a hand in writing the law that potential competitors will have to comply with.
- planb 6y ago
  Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.
  - Thlom 6y ago
    One thing I don’t understand is why in the good lords name do I have to consent to being tracked every day when I have already agreed to the goddamn cookie jar? Often several times per day as well!
    - bombcar 6y ago
      On iPhone at least Safari seems to throw away cookies with wild abandon resulting in the stupid popups continually popping up.
  - okamiueru 6y ago
    I for one welcome it. If a website has this popup, and it doesn't default to disabled tracking, and there are "legitimate interest" bullshit that cannot be turned off, I close down the website. I even uninstall apps (chess.com, here's looking at you). Just because website purposefully give a terrible UX in an effort circumvent the law does not mean the law is wrong. It's the implementation.
mLuby 6y ago
Whether something is "legal" is a fuzzy computation that runs in the minds of average citizens on a jury, though it's more commonly simulated by judges and lawyers. The text is not absolute. So what if an accept-only contract (like a ToS, EULA, or consent pop-up) did what average users think they agreed to, regardless of what the text says? This would shift the burden of understanding from the user, where it currently lies, to the company. If it's essential to a company's business model that users agree to something complex that most users don't understand, the company will just have to help the users understand, deploying all those marketing and UX patterns they've perfected over the years to do so. (Yes I know this isn't how contracts currently work; it's just a harmless little thought experiment.)
- Silhouette 6y ago
  FWIW, legal systems are sometimes closer to what you're describing there than you might realise. Obviously this varies with jurisdiction, but contracts of adhesion often do carry less weight in the event of litigation, for example automatically giving any benefit of the doubt to the party that didn't write the contract. Often there are relevant consumer protection rules as well, for example a general requirement that the terms of any B2C agreement must be reasonable or they will be unenforceable. More generally still, contract law is usually based on the basic idea of a meeting of minds, with an implication that all parties understand the contract they are entering into. When we drew up the Ts & Cs for my first business that was selling online, we took advice from a lawyer who specialised in this kind of work, and one of the first points they made was that if there was anything at all surprising or unusual in what we wanted for our terms, it should be emphasized prominently and early, not buried in small print at the back, for exactly the kind of reasons above. I once saw an anecdote (possibly apocryphal, I don't know) about a consumer rights lawyer who said they never bothered reading the small print in these situations. When someone expressed surprise that even a lawyer wouldn't check what they were signing up to, they replied that either the terms offered would be reasonable, in which case the lawyer would have no problem with them, or they wouldn't, in which case the unreasonable aspects would be unenforceable anyway.
deleted 6y ago
[deleted]
MaxBarraclough 6y ago
The paper is paywalled. Is it freely available anywhere? edit arxiv's preprint: https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf Also, off-topic: it's annoying that acm.org has now added a horizontal progress bar, similar to QuantaMagazine.org. I already know how far through the article I am, my browser shows me a scrollbar.
- xtracto 6y ago
  > my browser shows me a scrollbar. It is useful for mobile browser users.
  - anoncake 6y ago
    Apparently mobile browser makers disagree.
macinjosh 6y ago
GDPR is a textbook example of how government intetvention in our business never ends in the way the technocrats desire/promise. It simply makes things more convoluted and difficult for everyone including those they claim to be protecting.
- mrweasel 6y ago
  Given that the industry was never going to address the problem on their own, I don't see how there was ever an option other than government intervention. The only company that sort of care is Apple. Without government intervention privacy would something reserved for wealthy.
- rypskar 6y ago
  You have it backwards, this is big companies doing what they can to protest a law they don't agree with. Much in the same way big tobacco and big oil for years have been combating science
butz 6y ago
How about introducing a standard way to declare and categorize cookies and let browser take care of consent? On first start set your default cookie preferences for all websites and adjust per website, when needed. It could be quickly build as an extension first and later moved to browser core.
- zarq 6y ago
  This would be so easy for shady tracking websites to circumvent
- Macha 6y ago
  This was P3P. Without legal backing, advertiser's will weasel out of any technical measure. You can even see this in the common practice of showing a app specific permission prompt ahead of browser/OS level prompts because they no that being rejected at the OS level removes their ability to prompt again later. Legal systems are not so willing to prescribe specific technical solutions to avoid the "oh, you had very specific rules about advertising on radio, but this is TV so we get a few years of free roaming before you can update the law" issue
  - ketzu 6y ago
    > Legal systems are not so willing to prescribe specific technical solutions Also, when they do that, it is often critizised that the technical solution is out of date, inappropriate, prevents competition in the space and many more. (Often rightfully so.)
glsdfgkjsklfj 6y ago
permanent fix: learn to use your uBlock-Origin quick element picker. Every time you open a site and it shows a popup for picking your cookies, just open uBlockOrigin from your browser toolbar, click the quick element picker (eye dropper icon), click the popup. Done. Now you will never see the popup for that site (even if you do not save cookies, or clear your cookies), and you are technically guarantee to not accept any non-essential cookies ever (if they follow spec)
nickt 6y ago
Slightly OT, but for anyone using Safari "Hush Nag Blocker" is highly recommended. https://apps.apple.com/us/app/hush-nag-blocker/id1544743900 https://apps.apple.com/us/app/hush-nag-blocker/id1544743900
krlx 6y ago
The authors of this article also created a browser extension that allows you to pre-configure what data you consent to share and autofills a good number of the most common GDPR pop-ups : https://addons.mozilla.org/fr/firefox/addon/consent-o-matic/ https://addons.mozilla.org/fr/firefox/addon/consent-o-matic/
Crono 6y ago
I am working as a developer for a medium sized publisher in germany. Im pro GDPR and dont like the way the industry treats the users. But they just seem to continue on their course. Reaction on GDPR was very slow. Cookie Banners (before GDPR) where ignored. When GDPR was there we started to implement regular cookie banners - despite the warning from us developers that this would be illegal. The first real reaction on GDPR came at that moment Google forced them to. There was a deadline (somewhere in february 2021) where Google would limit ads if no consent-manager is implemented. When we finaly implemented it they set everything they can to fight against the user: The big blue floating button for the consent manager was hidden - instead i had to implement a link into the footer. Nobody will find it there. Then they disabled the "disable everything"-button. Now you can just allow everything or manually tick a hundred boxes. They totally know that its not legal. But nobody cares. Ad revenue is the most important thing and if they would follow the rules they would loose quiet a lot of money. As a developer its frustrating to see how user hostile the web has become ... Sure you can get another job, but its the same situation in every other place ... If you are just a user browsing the internet and beeing annoyed by all this stuff and mistreatment: Im sorry. Get an ad-blocker (uBlock Origin) and maybe additional uMatrix and learn how to protect yourself. The only way to "vote" is with the active denial of your data. They can see that statistics. They can see the rising number of people blocking all this tracking and advertisement stuff.
- ssijak 6y ago
  On the other hand if all their revenue is ad based, and they loose it, they will be out of business and you would lose that job too.
- rypskar 6y ago
  >>The first real reaction on GDPR came at that moment Google forced them to. There was a deadline (somewhere in february 2021) where Google would limit ads if no consent-manager is implemented. The irony is that the Cookie warning you get on all Googles sites are including all the dark patterns and seems to be there only to pretend they follow the law. All is op-out by default and you have to dig through many settings to turn off tracking
iamAy0 6y ago
Is this even relevant nowadays? I've been doing some tests with Edge and Firefox, and with their built-in tracking prevention + uBlock, it didn't matter whether I accepted all or only essential cookies, because at the end, only first party cookies are set. One might argue that accepting all allows tracking by the site itself. But, does it really matter? I'm already on the site because I'm willing to. At this point, we're no longer talking about tracking but analytics.
deleted 6y ago
[deleted]
mtm7 6y ago
Ideally, we'd be able to control opt-outs at the browser level. The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in: [Accept] / [Decline] / [Manage preferences]
- ketzu 6y ago
  > Ideally, we'd be able to control opt-outs at the browser level. We tried it at the protocol level with do-not-track and it just gave them an additional bit of info to track. But I agree: It would be awesome to have this as a browser option. Just send a list of all the optional things to my browser which responds with the accepted results. > The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in Isn't this what's written in the GDPR?
  - MaxBarraclough 6y ago
    > Isn't this what's written in the GDPR? Yes. A pity it's almost never enforced. From [0]: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Explicit consent requires a very clear and specific statement of consent. > Make it easy for people to withdraw consent and tell them how. [0] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... See also: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
  - cdrx 6y ago
    > Isn't this what's written in the GDPR? I wish it was this explicit, but it isn't. EU member states have all interpreted the regulation differently. Making it harder to opt out than in is explicitly prohibited in the UK and Germany. It is perfectly legal in Italy. In Spain, it is legal to bury the opt out buttons at the end of a 50 page cookie policy. Full compliance, across the whole of the EU, is exceptionally difficult.
musicale 6y ago
What exactly is meant by CHI 2020 Free Proceedings if they are actually paywalled? I don't know if it's a "dark" pattern much as an "inaccurate" pattern.... https://chi2020.acm.org/chi-2020-free-proceedings/ https://chi2020.acm.org/chi-2020-free-proceedings/ Actual paper from 2nd author web page: https://people.csail.mit.edu/ilaria/papers/Midas-MITCHI2020.pdf https://people.csail.mit.edu/ilaria/papers/Midas-MITCHI2020.... (I was under the impression that all ACM conference papers with NSF grant numbers in the acknowledgments would automatically be added to CHORUS, but this one seems to be missing.)
sergefaguet 6y ago
This highlights why governments are impotent: - it has been 5 years since GDPR was implemented to great fanfare - by the time of implementation data mining has been going on for many years - 5 years after 90% of businesses use dark patterns that are non-compliant - actual fines and enforcement are negligible - maybe they will start enforcing more aggressively... after another 5 years It is simply the case that large bureaucratic organizations are too slow and too incompetent to deal with rapidly changing technology. And the tech community sees this and has no respect for governments. How can you respect impotent Industrial Age structures today anyway? My view is that by mid-century Western governments will be going bankrupt in droves since tech will optimize out their ability to collect taxes or inflate currency. Plus they will just be extremely behind the curve and become irrelevant to everyone’s tech-dominated lives. It is tech companies that will lead the future. It doesn’t matter if this does not agree with pro-democratic sensibilities. Sensibilities will change and adapt to reality.
NiceWayToDoIT 6y ago
I know two things: - tracking cookies are bad and yes it is an issue. - GDPR and consent pop-ups are pain, surfing is becoming similar effort like moving through the mud. Solution? I hope we can embed response in the browser, so you say once I do not want to be tracked not even for "legitimate interests" :P and then in background browser does the rest? How difficult is that?
runeks 6y ago
We should standardize the GDPR “pop up” by putting it inside the browser settings, and send a HTTP header that reflects user choice. I see no difference between websites adhering to a HTTP header versus what the visitor chooses in the website’s custom pop up. To start with, we should add to the GDPR regulations that a “Do Not Track” HTTP header requires the website to not display the pop up and interpret it as the visitor allowing only “strictly necessary cookies for website to functionality”.
- anoncake 6y ago
  That would be a step back. Not giving consent is the default as is.
zwaps 6y ago
Things could be so simple if politicians had made the law more concrete or if it would be enforced. Because some websites do comply and have a reject all button on the first pop up. I know this us the law, but it should be... you know literally the law. Why is the law not enforced for the online marketing industry? After all, you will scarcely find an industry so full of criminals as this one!
n3storm 6y ago
Site announcing dark patterns study implements Disqus comments.
intricatedetail 6y ago
Why business models of Google or Facebook simply cannot be made illegal just like you can't setup a ponzi scheme?
xyst 6y ago
I can't read the paper beyond the summary. But for what it's worth, I agree that GDPR is a good thing in general. However the implementation and execution of it is sloppy (as seen with these "dark patterns") GDPR should have been aimed at the browser and then force websites to comply with the settings defined in the browser. Non-compliant sites would be immediately flagged by the user's browser instead of hiding behind numerous dark UI patterns. Perhaps it was easier to force thousands of EU sites rather than trying to coerce Google, Apple, Microsoft.

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative consent for non-essential tracking or not.

ectopod 6y ago
The best way to let a site know that you don't want tracking cookies is to disable cookies. Most sites work fine. This one redirects you to: https://dl.acm.org/action/cookieAbsent https://dl.acm.org/action/cookieAbsent
danShumway 6y ago
The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodically to help maintain and improve our Web Site and enforce our online service polices. ACM only uses analytical cookies and does not use any user-specific targeting cookies. > A cookie is a small file of letter and numbers that is placed on your device. Cookies are only set by ACM when you visit restricted portions of our Web Site and help us to provide you with an enhanced user experience. Raw log files are treated as confidential. So... not sure why a public portion of their website straight-up won't load without them. They're clearly not only checking/setting cookies on certain pages, otherwise they wouldn't know that my cookies were disabled.
- shadowgovt 6y ago
  It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).
- that_guy_iain 6y ago
  One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.
  - satellite2 6y ago
    It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
    - that_guy_iain 6y ago
sandgiant 6y ago
This is just a regular journal page. Not surprised they're tracking their users. A better place to link would probably have been the arXiv: https://arxiv.org/abs/2001.02479v1 https://arxiv.org/abs/2001.02479v1.
deleted 6y ago
[deleted]
1vuio0pswjnm7 6y ago
"Interesting that this site itself may use one of the described patterns." Is it really interesting, though. For example, we have seen this as a very common retort in HN comments every time an author is critical of advertising, tracking/analytics, etc. Someone points out the author's site itself uses the thing being critiqued. Is that supposed to detract from the argument being made by the author. That does not make much sense. It is a bit like another common retort we see in discussing tech company behaviour: "But everyone else is doing it." Does that make it OK. Or one we see when discussing regulatory action: "They should be focusing on X not Y." Don't look here, look over there. I am highly skeptical of comments that try to leverage these tactics. The message is what it is. Whether or not it is valid does not depend on who is voicing it, where it appears, or what's going on somewhere else. This is pure misdirection. This paper might be a worthwhile read. It makes little sense to pre-judge it before reading, simply because it appears on ACM's website, and ACM's website developers try to get users to enable cookies. What if the paper is re-posted on a site with no Javascript and that does not try to set cookies. Does the content of the paper then become "legitimate". Why or why not. It is easy to retrieve this paper without using cookies, from another site. For example, https://web.archive.org/web/20210305175101/https://dl.acm.org/doi/10.1145/3313831.3376321 https://web.archive.org/web/20210305175101/https://dl.acm.or... PDF: https://web.archive.org/web/20200701025846if_/https://dl.acm.org/doi/pdf/10.1145/3313831.3376321 https://web.archive.org/web/20200701025846if_/https://dl.acm... Not trying to single out this one comment. It's fine. The paper is not really arguing for or against banners and other notice and consent mechanisms, just studying their use. I cannot even see the banner because I use a text-only browser. The most interesting paragraph in the paper IMO is the last one. They ask why the client, e.g., through browser settings, cannot be in control of the legal consent mechanism. What if clients were to sed an additional HTTP header to indicate whether or not the user consent to cookies. For example, Allow-Cookies: no. The online advertising companies have apparently fought against this, e.g., the DNT header. If you enable DNT in one popular browser deployed by an advertising company you get this ridiculous warning message. Why the heck is it a big deal if the user controls the headers sent and the server has to honour them. When you read RFCs about www development they always make it sound like clients and servers on are equal footing. The reality is quite different. These companies want to control how a user "consents".
asdff 6y ago
I get some sick satisfaction whenever I mouse over these, right click, and hit "Block element"
- rgoulter 6y ago
  Another technique: I've just been trying out the tridactyl Firefox plugin. (vi-inspired keybindings for browser usage). In tridactyl, the element can be hidden by typing out ";k", followed by a couple of letters to select the element hierarchy to hide.
- tomjen3 6y ago
  I have had some luck just using reader mode. It is not important when I am on my ipad, because I use Safari in private mode and it doesn’t share cookies with other tabs, but this is even easier.
  - asdff 6y ago
    depends on the page, but reader mode can move around images strangely in my experience
stiray 6y ago
What I have seen everywhere is that all the consent is based on violating one of fundamentals of GDPR Art. 7(4): "It shall be as easy to withdraw as to give consent." All those dark patterns to hide the rejection, keep some things ticked etc. are a complete waste of time. They all violate GDPR and are just another case for: no one has read the GDPR and is just copying everyone else. It is just a waste of developers time, hiding rejection of consent, making it less understandable, etc. is just violating the GDPR. Google is violating it, Facebook is violating it,... but they have money for lawsuits, if you have it too, no problem, just copy them, if not, reconsider your tactics. Bottom line, you are wasting time and effort to implement it, you are trolling the users with popups and at the end even the consents that you got is invalid and void. So why doing it? Imagine the scenario, your beautiful website, your beautiful android application is being checked for a GDPR compliance based on lawsuit. And you bring in your dark-patterned consent dialog (whoever the provider is, it doesn't matter, YOU are the controller, YOU are the one who needs to care for your visitors/users privacy and you will be fined if google ads are violating privacy by their scripts run from your application/site). What do you think will happen, you will get pat on your back and someone one will say "you poor thing, you didn't understand, let me pardon you" or you will get an "Tommy Lee Jones" implicit facepalm [1]? Same goes for all the sites that stuff the user id into the "consent/no consent" cookie where just setting "consent=yes" or "consent=no" would be enough. Again, just same thing, for avoiding storing one PII you create another PII (by GDPR, anything that is unique to a person is PII) and violate it by doing that. Just why. Dont bother. Wait for a law suit and that is it. Dont just waste more money with same result as not wasting it, rather label a jar with "GDPR Lawsuit" label and stuff the money wasted for illegal consent methods into the jar. [1] https://me.me/i/implied-facepalm-when-something-is-so-ridiculous-that-a-full-21442403 https://me.me/i/implied-facepalm-when-something-is-so-ridicu...

K0nserv 6y ago

This is the PDF: https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf I couldn't understand how to find it on the linked site. Maybe the submission URL should be changed?

angrais 6y ago
If you click "Get Access" you'll be asked to lot into a university account or such

Bakary 6y ago

Who came up with the term dark patterns? It's psychological manipulation and fraud, pure and simple

hnuser123456 6y ago
Because there are shades of gray
- Bakary 6y ago
  There's a spectrum of gray in the effect and scale of the manipulation, but deciding to manipulate the user or not is a binary choice.
  - SpicyLemonZest 6y ago
    Is it? It's comforting to think so, but I'm not convinced there's a meaningful dichotomy that can be drawn. I add a "save this card" functionality to my store so users don't have to type it in every time they buy something: am I offering a neat convenience feature, or am I manipulating them by reducing the psychological barrier of a sale?
    - Bakary 6y ago
      >Is it? It's comforting to think so, but I'm not convinced there's a meaningful dichotomy that can be drawn. I rework my store's checkout workflow, making it simpler so users only have to click a couple buttons to buy a product: am I making their lives easier, or am I manipulating them by reducing the psychological barrier of a sale? "making their lives easier" implies that the purchase is the default outcome that the user needs to improve their lives, when the purchase could simply not be made at all. As long as the intention is to make more money, and that the effort expended does not improve the nature of what is purchased in some way, I'd say it technically qualifies even if the consequences are the lightest of grays. That said, your example is thoughtful, and you are probably right overall. We could look at the broader context of all these systems encouraging consumption, but that would be moving the goalposts on my part. edit: just to clarify an edit took place while I was replying

slacktide 6y ago

GDPR consent buttons and statements are as worthless as the California Proposition 65 cancer warning that gets slapped on every consumer product. Any plugins to strip them out or automatically consent?

Zak 6y ago
Yes: I don't care about cookies https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- ganzuul 6y ago
  An Android version would be great. The mobile web is becoming harder and harder to use.
  - Zak 6y ago
    You can use it on Android with Kiwi Browser, a Chromium derivative. It used to work with Firefox, but it looks like Firefox still hasn't un-broken extensions on Android.
    - tobasq 6y ago
      Looking at the source code suggests that Kiwi is based on Chromium 77. A shame; it's a great idea. We need a mobile browser with extensions.
      - Zak 6y ago
        I suppose that's getting a bit dated, but I'd have to be actively experiencing significant breakage to give up extensions for a browser update. I am not.
ericra 6y ago
ublock origin takes care of most of them. You will want to go to settings > filters and make sure that you have EasyList, EasyPrivacy, and EasyCookie all enabled. I would also recommend Fanboy's Annoyances filter list enabled, as it contains quite a few nice cosmetic filters to block out similar annoying web elements.

rwcarlsen 6y ago

For me personally - all these popup banners and modal walls for websites about cookies and stuff just really make the internet a worse place. I suspect that empirically, they don't accomplish what the GDPR intended to - and they make the internet less enjoyable. Thanks GDPR.

sefrost 6y ago
Same here. I would be interested to know from people outside the GDPR area - do you ever see cookie banners? Do you know what they are? Sometimes I hit a USA based news website which simply denies access, because I'm in the UK, on GDPR grounds. Which seems an overreaction.
- bombcar 6y ago
  EVERY WEBSITE I visit from my location in the USA seems to have these stupid cookie popups. We added one to OUR WEBSITE even though nothing is hosted in the EU - simple cargo-culting "everyone is doing it so we must do it also". I doubt it actually does a @#$@$ darn thing.
  - shadowgovt 6y ago
    We've had them up long enough for somebody to have generated some hard numbers by now. I wonder what the numbers look like on percentage of users that modify the settings from the default?
  - layoutIfNeeded 6y ago
    I don’t have a cookie banner on my website. You know why? Because I don’t track my users with (or without) cookies. Maybe you should stop doing it on your website, and then the cookie banner can be removed.
  - josefx 6y ago
    > We added one to OUR WEBSITE even though nothing is hosted in the EU Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it. > simple cargo-culting "everyone is doing it so we must do it also". If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.

justkez 6y ago

I recently purchased something from the official UK Nintendo Store [1]. I did not opt-in, and was not asked to opt-in, to marketing emails. Several days after purchase I received a marketing email with an Unsubscribe link. I submitted a GDPR enquiry and after a few weeks I get: Having investigated this matter fully, we can see that you were opted in as a result of a small technical difficulty which we are now fixing. We have taken action to set your marketing permissions to "no" as requested. I think we're so far past the GDPR "start date" that there's an apathy to it from companies and they're pushing the limits again. How Nintendo can have such a formalised GDPR enquiry process but such sloppy controls is beyond me. I will formally complain to ICO (UK data regulator) but I doubt it'll effect much. [1]: https://store.nintendo.co.uk/ https://store.nintendo.co.uk/

switch007 6y ago
This is absolutely /rife/ in my experience.
vMPQonVtAjLWmr 6y ago
Is the UK still subject to the GDPR now after Brexit?
- Nextgrid 6y ago
  I believe GDPR is supposed to be implemented in every participating country's legislation, so the GDPR was implemented in UK law and this remains the case even after Brexit. Nothing prevents them from amending that law and repealing the GDPR's effects on it though.
  - anoncake 6y ago
    No, regulations are directly applicable. Directives have to be implemented by each country.
- lmkg 6y ago
  Yes, part of the Brexit agreement was the UK "domesticating" some parts of EU law by passing them as UK legislation. There is now a law called UK-GDPR, which is literally a copy-paste of GDPR, with names of EU institutions find-and-replaced with their UK equivalents. There are still some operational differences, around the fact that the UK regulators will not participate the cooperation mechanisms that the other regulators will. This ends up mattering for businesses: a significant aspect of GDPR was that a company only ever had to deal with one regulator, but now they need to interface with one for the EU and a second for the UK.

scotu 6y ago

My favorite deceptive pattern I encountered is "double click the checkbox to disable". Literally a checkbox but it wouldn't do anything. I got a little frustrated and started clicking furiously just to discover that a double click would reliably disable the items... (I don't remember if this was on desktop or mobile, on mobile s/click/tap/g) Also, I personally lean towards being in favor of GDPR and cookie law (wish there were some improvements though); I'd like to say it just because every opinion you find is "GDPR useless", "cookie law bad"

Guest42 6y ago
Yes, seems as though those opinions are the loudest and perhaps it encourages the dissenters to stay quiet for fear of down-votes. Ive noticed that with certain viewpoints and have adjusted towards censoring myself a bit. The crowd seems bimodal but perhaps that's the nature of the conversations and the voting tool reinforces that.
- Bakary 6y ago
  Much of the audience benefits from this sort of manipulation and tracking, so it's normal they would be hostile to any cookie law
- TeMPOraL 6y ago
  Depends on the timezone, perhaps. I hail from the EU, post mostly during EU wake hours, and often comment in favor of GDPR, and I very rarely if ever get negative karma on those comments.
  - Guest42 6y ago
    Glad to hear. I am grateful for GDPR because I feel that it is an important step in the right direction.
fy20 6y ago
Such dark patterns are not allowed under GDPR, which says it must be opt-in, not opt-out.

superjan 6y ago

Today’s xkcd: https://xkcd.com/2432/ https://xkcd.com/2432/

midasuni 6y ago
Xkcd, like hackernews, does not require these silly pop ups. The problem isn’t the gdpr, it’s sites trying to use your personal data against your will.

Causality1 6y ago

As someone who's blocked cookies and ads for years, the result of the GDPR has a been a parade of unblocked pop-ups. Frankly I liked it better when pop-ups had naked women in them.

pixelpoet 6y ago

What absolutely infuriates me is this "legitimate interest" crap that is almost always hidden away, and often you have to scroll through literally hundreds of opt-outs with no way to disable them all in a single click. If I'm so damn "legimately interested", why is it on by default and basically impossible to turn off? Find me one person on this earth who is legitimately interested in being tracked by marketing companies who sell their information on to whatever giant collections. This should be illegal.

detaro 6y ago
While I agree it's often bullshit, "legitimate interest" is not trying to argue it to be your interest, but the sites.
simpss 6y ago
It's usually a good hint that it really isn't a legitimate intrest case if they allow you to turn it off. A legitimate intrest does not require an opt in (or an opt out). Consent does. If the page mixes those two up they're either clueless or trying to walk in the gray area and don't really understand(or don't want to understand) what either of those terms mean.
- secondcoming 6y ago
  Legitimate Interest has a legal definition as a Legal Basis. It's a list of Purposes and Special Features that a Vendor declares to the IAB that they claim to need [0]. A User absoultely has the right to Object to Consent and Legitimate Interest. Any CMP that does not allow you to opt-out is on shaky GDPR legal ground. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json (see 'vendors' object)
  - Aachen 6y ago
    What's an IAB or CMP?
    - 6y ago

ddddfdohvsyknn 6y ago

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the existing players (know who has the money to hire 20 compliance officers for every Tuscan villa?) and makes the barrier to entry to compete more difficult. Plenty of proto facebooks have fallen by the wayside. Remember AOL? Remember Myspace? Now the big players have a hand in writing the law that potential competitors will have to comply with.

planb 6y ago
Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.
- Thlom 6y ago
  One thing I don’t understand is why in the good lords name do I have to consent to being tracked every day when I have already agreed to the goddamn cookie jar? Often several times per day as well!
  - bombcar 6y ago
    On iPhone at least Safari seems to throw away cookies with wild abandon resulting in the stupid popups continually popping up.
- okamiueru 6y ago
  I for one welcome it. If a website has this popup, and it doesn't default to disabled tracking, and there are "legitimate interest" bullshit that cannot be turned off, I close down the website. I even uninstall apps (chess.com, here's looking at you). Just because website purposefully give a terrible UX in an effort circumvent the law does not mean the law is wrong. It's the implementation.

mLuby 6y ago

Whether something is "legal" is a fuzzy computation that runs in the minds of average citizens on a jury, though it's more commonly simulated by judges and lawyers. The text is not absolute. So what if an accept-only contract (like a ToS, EULA, or consent pop-up) did what average users think they agreed to, regardless of what the text says? This would shift the burden of understanding from the user, where it currently lies, to the company. If it's essential to a company's business model that users agree to something complex that most users don't understand, the company will just have to help the users understand, deploying all those marketing and UX patterns they've perfected over the years to do so. (Yes I know this isn't how contracts currently work; it's just a harmless little thought experiment.)

Silhouette 6y ago
FWIW, legal systems are sometimes closer to what you're describing there than you might realise. Obviously this varies with jurisdiction, but contracts of adhesion often do carry less weight in the event of litigation, for example automatically giving any benefit of the doubt to the party that didn't write the contract. Often there are relevant consumer protection rules as well, for example a general requirement that the terms of any B2C agreement must be reasonable or they will be unenforceable. More generally still, contract law is usually based on the basic idea of a meeting of minds, with an implication that all parties understand the contract they are entering into. When we drew up the Ts & Cs for my first business that was selling online, we took advice from a lawyer who specialised in this kind of work, and one of the first points they made was that if there was anything at all surprising or unusual in what we wanted for our terms, it should be emphasized prominently and early, not buried in small print at the back, for exactly the kind of reasons above. I once saw an anecdote (possibly apocryphal, I don't know) about a consumer rights lawyer who said they never bothered reading the small print in these situations. When someone expressed surprise that even a lawyer wouldn't check what they were signing up to, they replied that either the terms offered would be reasonable, in which case the lawyer would have no problem with them, or they wouldn't, in which case the unreasonable aspects would be unenforceable anyway.

deleted 6y ago

[deleted]

MaxBarraclough 6y ago

The paper is paywalled. Is it freely available anywhere? edit arxiv's preprint: https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf Also, off-topic: it's annoying that acm.org has now added a horizontal progress bar, similar to QuantaMagazine.org. I already know how far through the article I am, my browser shows me a scrollbar.

xtracto 6y ago
> my browser shows me a scrollbar. It is useful for mobile browser users.
- anoncake 6y ago
  Apparently mobile browser makers disagree.

macinjosh 6y ago

GDPR is a textbook example of how government intetvention in our business never ends in the way the technocrats desire/promise. It simply makes things more convoluted and difficult for everyone including those they claim to be protecting.

mrweasel 6y ago
Given that the industry was never going to address the problem on their own, I don't see how there was ever an option other than government intervention. The only company that sort of care is Apple. Without government intervention privacy would something reserved for wealthy.
rypskar 6y ago
You have it backwards, this is big companies doing what they can to protest a law they don't agree with. Much in the same way big tobacco and big oil for years have been combating science

butz 6y ago

How about introducing a standard way to declare and categorize cookies and let browser take care of consent? On first start set your default cookie preferences for all websites and adjust per website, when needed. It could be quickly build as an extension first and later moved to browser core.

zarq 6y ago
This would be so easy for shady tracking websites to circumvent
Macha 6y ago
This was P3P. Without legal backing, advertiser's will weasel out of any technical measure. You can even see this in the common practice of showing a app specific permission prompt ahead of browser/OS level prompts because they no that being rejected at the OS level removes their ability to prompt again later. Legal systems are not so willing to prescribe specific technical solutions to avoid the "oh, you had very specific rules about advertising on radio, but this is TV so we get a few years of free roaming before you can update the law" issue
- ketzu 6y ago
  > Legal systems are not so willing to prescribe specific technical solutions Also, when they do that, it is often critizised that the technical solution is out of date, inappropriate, prevents competition in the space and many more. (Often rightfully so.)

glsdfgkjsklfj 6y ago

permanent fix: learn to use your uBlock-Origin quick element picker. Every time you open a site and it shows a popup for picking your cookies, just open uBlockOrigin from your browser toolbar, click the quick element picker (eye dropper icon), click the popup. Done. Now you will never see the popup for that site (even if you do not save cookies, or clear your cookies), and you are technically guarantee to not accept any non-essential cookies ever (if they follow spec)

nickt 6y ago

Slightly OT, but for anyone using Safari "Hush Nag Blocker" is highly recommended. https://apps.apple.com/us/app/hush-nag-blocker/id1544743900 https://apps.apple.com/us/app/hush-nag-blocker/id1544743900

krlx 6y ago

The authors of this article also created a browser extension that allows you to pre-configure what data you consent to share and autofills a good number of the most common GDPR pop-ups : https://addons.mozilla.org/fr/firefox/addon/consent-o-matic/ https://addons.mozilla.org/fr/firefox/addon/consent-o-matic/

Crono 6y ago

I am working as a developer for a medium sized publisher in germany. Im pro GDPR and dont like the way the industry treats the users. But they just seem to continue on their course. Reaction on GDPR was very slow. Cookie Banners (before GDPR) where ignored. When GDPR was there we started to implement regular cookie banners - despite the warning from us developers that this would be illegal. The first real reaction on GDPR came at that moment Google forced them to. There was a deadline (somewhere in february 2021) where Google would limit ads if no consent-manager is implemented. When we finaly implemented it they set everything they can to fight against the user: The big blue floating button for the consent manager was hidden - instead i had to implement a link into the footer. Nobody will find it there. Then they disabled the "disable everything"-button. Now you can just allow everything or manually tick a hundred boxes. They totally know that its not legal. But nobody cares. Ad revenue is the most important thing and if they would follow the rules they would loose quiet a lot of money. As a developer its frustrating to see how user hostile the web has become ... Sure you can get another job, but its the same situation in every other place ... If you are just a user browsing the internet and beeing annoyed by all this stuff and mistreatment: Im sorry. Get an ad-blocker (uBlock Origin) and maybe additional uMatrix and learn how to protect yourself. The only way to "vote" is with the active denial of your data. They can see that statistics. They can see the rising number of people blocking all this tracking and advertisement stuff.

ssijak 6y ago
On the other hand if all their revenue is ad based, and they loose it, they will be out of business and you would lose that job too.
rypskar 6y ago
>>The first real reaction on GDPR came at that moment Google forced them to. There was a deadline (somewhere in february 2021) where Google would limit ads if no consent-manager is implemented. The irony is that the Cookie warning you get on all Googles sites are including all the dark patterns and seems to be there only to pretend they follow the law. All is op-out by default and you have to dig through many settings to turn off tracking

iamAy0 6y ago

Is this even relevant nowadays? I've been doing some tests with Edge and Firefox, and with their built-in tracking prevention + uBlock, it didn't matter whether I accepted all or only essential cookies, because at the end, only first party cookies are set. One might argue that accepting all allows tracking by the site itself. But, does it really matter? I'm already on the site because I'm willing to. At this point, we're no longer talking about tracking but analytics.

deleted 6y ago

[deleted]

mtm7 6y ago

Ideally, we'd be able to control opt-outs at the browser level. The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in: [Accept] / [Decline] / [Manage preferences]

ketzu 6y ago
> Ideally, we'd be able to control opt-outs at the browser level. We tried it at the protocol level with do-not-track and it just gave them an additional bit of info to track. But I agree: It would be awesome to have this as a browser option. Just send a list of all the optional things to my browser which responds with the accepted results. > The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in Isn't this what's written in the GDPR?
- MaxBarraclough 6y ago
  > Isn't this what's written in the GDPR? Yes. A pity it's almost never enforced. From [0]: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Explicit consent requires a very clear and specific statement of consent. > Make it easy for people to withdraw consent and tell them how. [0] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... See also: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- cdrx 6y ago
  > Isn't this what's written in the GDPR? I wish it was this explicit, but it isn't. EU member states have all interpreted the regulation differently. Making it harder to opt out than in is explicitly prohibited in the UK and Germany. It is perfectly legal in Italy. In Spain, it is legal to bury the opt out buttons at the end of a 50 page cookie policy. Full compliance, across the whole of the EU, is exceptionally difficult.

musicale 6y ago

What exactly is meant by CHI 2020 Free Proceedings if they are actually paywalled? I don't know if it's a "dark" pattern much as an "inaccurate" pattern.... https://chi2020.acm.org/chi-2020-free-proceedings/ https://chi2020.acm.org/chi-2020-free-proceedings/ Actual paper from 2nd author web page: https://people.csail.mit.edu/ilaria/papers/Midas-MITCHI2020.pdf https://people.csail.mit.edu/ilaria/papers/Midas-MITCHI2020.... (I was under the impression that all ACM conference papers with NSF grant numbers in the acknowledgments would automatically be added to CHORUS, but this one seems to be missing.)

sergefaguet 6y ago

This highlights why governments are impotent: - it has been 5 years since GDPR was implemented to great fanfare - by the time of implementation data mining has been going on for many years - 5 years after 90% of businesses use dark patterns that are non-compliant - actual fines and enforcement are negligible - maybe they will start enforcing more aggressively... after another 5 years It is simply the case that large bureaucratic organizations are too slow and too incompetent to deal with rapidly changing technology. And the tech community sees this and has no respect for governments. How can you respect impotent Industrial Age structures today anyway? My view is that by mid-century Western governments will be going bankrupt in droves since tech will optimize out their ability to collect taxes or inflate currency. Plus they will just be extremely behind the curve and become irrelevant to everyone’s tech-dominated lives. It is tech companies that will lead the future. It doesn’t matter if this does not agree with pro-democratic sensibilities. Sensibilities will change and adapt to reality.

NiceWayToDoIT 6y ago

I know two things: - tracking cookies are bad and yes it is an issue. - GDPR and consent pop-ups are pain, surfing is becoming similar effort like moving through the mud. Solution? I hope we can embed response in the browser, so you say once I do not want to be tracked not even for "legitimate interests" :P and then in background browser does the rest? How difficult is that?

runeks 6y ago

We should standardize the GDPR “pop up” by putting it inside the browser settings, and send a HTTP header that reflects user choice. I see no difference between websites adhering to a HTTP header versus what the visitor chooses in the website’s custom pop up. To start with, we should add to the GDPR regulations that a “Do Not Track” HTTP header requires the website to not display the pop up and interpret it as the visitor allowing only “strictly necessary cookies for website to functionality”.

anoncake 6y ago
That would be a step back. Not giving consent is the default as is.

zwaps 6y ago

Things could be so simple if politicians had made the law more concrete or if it would be enforced. Because some websites do comply and have a reject all button on the first pop up. I know this us the law, but it should be... you know literally the law. Why is the law not enforced for the online marketing industry? After all, you will scarcely find an industry so full of criminals as this one!

n3storm 6y ago

Site announcing dark patterns study implements Disqus comments.

intricatedetail 6y ago

Why business models of Google or Facebook simply cannot be made illegal just like you can't setup a ponzi scheme?

xyst 6y ago

I can't read the paper beyond the summary. But for what it's worth, I agree that GDPR is a good thing in general. However the implementation and execution of it is sloppy (as seen with these "dark patterns") GDPR should have been aimed at the browser and then force websites to comply with the settings defined in the browser. Non-compliant sites would be immediately flagged by the user's browser instead of hiding behind numerous dark UI patterns. Perhaps it was easier to force thousands of EU sites rather than trying to coerce Google, Apple, Microsoft.