4 ms·

California Passes Regulation Banning "Dark Patterns" Under Landmark Privacy Law

139 points by ryanwhitney 6y ago

ramphastidae 6y ago
Sorry for the negativity but does this matter? Like, at all? The CANSPAM act was implemented a decade ago and I still receive spam emails without unsubscribe links from salespeople at Fortune 500s. Reporting it does nothing. There is no real enforcement of any of this.
sodality2 6y ago
This seems like very good news! Wonder if I will have to VPN into CA to benefit though... :/
- bigiain 6y ago
  I might write a tool to fetch webpages from a CA VPN endpoint and a nonCA one - and highlight the diffs... Maybe even automatically tweet a “hall of shame”.?
- floatingatoll 6y ago
  One very popular CCPA white-label service cross-checks identity databases and credit reports in order to prove state residency. VPNs won’t help with that.
  - finnthehuman 6y ago
    That sounds sketchy as fuck. Whether I’m a California resident is not the type of fact that can be derived from publicly/commercially available data. Their business model is to guess, and false negatives deprive Californians of their rights.
Rebelgecko 6y ago
>The new regulations will also institute the use of a new Privacy Options icon, which internet consumers can use as a visual cue to opt-out of the sale of their personal information. What does this actually mean? An extra overlay to click away when I visit a new website for the first time?
- floatingatoll 6y ago
  The “Do Not Sell My Personal Information” links are awfully wordy. An icon would be nice to have. Why would you make an overlay from it, though?
cgearhart 6y ago
Is Gizmodo hosting this article in order to give a demonstration of “dark patterns” with their website? Auto playing video ad overlayed inline with the text, article content split and spread over the whole page. What utter garbage.
- Griffinsauce 6y ago
  Not all bad UX is a dark pattern.
  - beshrkayali 6y ago
    True, but you can easily predict when it’s intentionally misleading, there’s still chance of being wrong but people have been burnt too many times by this type of website (usually owned by media holding companies) that it’s safe to assume bad intentions.
marketingtech 6y ago
They use the term "dark patterns" in the press release, but the actual regulation is very specific, straightforward, and limited to the "Do Not Sell My Personal Information" link that's required by the California Consumer Privacy Act. The notice of right to opt-out shall be designed and presented in a way that is easy to read and understandable to consumers. The notice shall: a. Use plain, straightforward language and avoid technical or legal jargon. b. Use a format that draws the consumer’s attention to the notice and makes the notice readable, including on smaller screens, if applicable. c. Be available in the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements, and other information to consumers in California. d. Be reasonably accessible to consumers with disabilities. For notices provided online, the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Web Consortium, incorporated herein by reference. In other contexts, the business shall provide information on how a consumer with a disability may access the notice in an alternative format. source: https://oag.ca.gov/system/files/attachments/press-docs/CCPA%20March%2015%20Regs.pdf https://oag.ca.gov/system/files/attachments/press-docs/CCPA%...
- tony101 6y ago
  The press release is specific and limited too: "The newly-approved regulations ban so-called “dark patterns” that delay or obscure the process for opting out of the sale of personal information. Specifically, it prohibits companies from burdening consumers with confusing language or unnecessary steps such as forcing them to click through multiple screens or listen to reasons why they shouldn’t opt out." https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-additional-regulations-empower-data https://oag.ca.gov/news/press-releases/attorney-general-bece...
- ryanwhitney 6y ago
  Interesting. Stack Exchange has a truly awful dark pattern in their GDPR banner experience: You click to customize tracking cookies and get presented with a list of checkboxes, but primary button on the right is "Accept all cookies", whereas the left side (where you'd usually find a "Cancel") is a secondary-looking button that says "Accept changes". If you don't take the time to actually read the buttons, you end up unchecking a bunch of boxes just to inadvertently accept them all. Real scumbag stuff. From the above, it sounds like tricks like that may not even be covered.
mawise 6y ago
Disappointing that they would mandate details about the opt-out process for selling personal information instead of mandating that it be an opt-in process.
- tony101 6y ago
  That is not within the CA Attorney General's control. The statute (CCPA) specifies opt-out, not opt-in, for most consumers. (The exception is for children under 16, who get an opt-in process.)
  - TedDoesntTalk 6y ago
    How does a website proactively select opt-in without knowing its users’ ages?
causality0 6y ago
I wish they could extend these protections to local software. Imagine if all of your devices had a single "disable telemetry" button.
peter_d_sherman 6y ago
>"...dark patterns — tricks deployed by websites or apps that seek to frustrate or bamboozle users into doing things they wouldn’t normally do." Hmm, had not heard the term "dark patterns" -- until now... Anyway, it's going into my 2021 lexicon... I knew that there were "attack sites" on the Internet -- that is, websites which openly attacked the browser of any visitor... Maybe "dark patterns" could be thought of as the "lesser version" of that -- instead of attacking your browser -- the website attacks your rights (!) That is, by railroading you (the user) into "accepting" "agreements" -- that you normally would not have accepted! Now, the $64,000 question: Where have I seen that pattern before? ?
- rapnie 6y ago
  In IETF inclusive terminology repo the term 'deception pattern' is proposed. https://github.com/ietf/terminology https://github.com/ietf/terminology
gnicholas 6y ago
Funny, the California Bar Association uses dark patterns in their membership dues section. When you go to pay your dues, you are presented with many options to opt-in and pay extra for various causes. Then partway through the process, you are presented with other "adjustment" options, which in their default state show "none" in the dropdown selector. Only if you click on "none" do you learn that you can deduct various amounts (ranging up to $40) for each of the various dropdown menus. There is no way to adjust all of these menus with one selection — you have to do it separately for each of them. It took me a couple years of paying inflated dues before realizing that I was doing so. I think opt-outs are bad, but they are especially heinous when camouflaged amongst opt-ins. If the state ever expands their regulation of dark patterns (which are very narrow, as other commenters have pointed out), they will have to make sure that organizations like the CA Bar Association, which is tasked with setting and enforcing ethical rules related to judges and lawyers, get their houses in order.
justinzollars 6y ago
California has too many rules and the system is absolutely failing for the basic necessities of life.
- LimaBearz 6y ago
  I filed my taxes last night through TurboTax. I love the idea of “regulations are bad”, but left unchecked intuit is great example of dark patterns and why there needs to be governing body over private business. Those crooked bastards tried to upsell me or trick me into needing a more expensive product at the start of every section. Likewise lately I’ve found myself wanting a better general news source and I think NYT is fairly reputable, until some quick research shows you can not unsubribe without calling someone, but sign up yeah absolutely, a few clicks and you’re done If there was bill addressing the first one, that’s not “failing for the basic necessities of life”. I don’t think it’s unreasonable to demand business not try to F you cause they can. There’s been so much consolidation in the market that “voting with your money” has become nothing more than an untenable aphorism.
  - ALittleLight 6y ago
    You'd think the government could build their own turbotax and let everyone use that for free. I assume a good/simple version would make people more likely to pay their taxes correctly and the profit off of that would more than cover the expense of making it. Of course, in reality, I know the government would botch it. Still, the system seems really bad.
    - distances 6y ago
      I'm not sure why you would be so cynical about government abilities. Automated taxes work great in quite many countries worldwide. Do you think US government is somehow especially incompetent?
      - ramphastidae 6y ago
        Perhaps you should do some basic reading about the average length and costs of public infrastructure projects in the US vs. other developed nations.
TedDoesntTalk 6y ago
Why does Gizmodo still suck without an ad blocker?
Jan454 6y ago
Does this make Micros*t dark-pattern practice to overwrite the bootloader without consent on install (and thus making it extra complicated to setup dualboot with e.g. Linux) illegal?
zaphirplane 6y ago
What’s the fine when the government does it. Oh like say California DMV
Digit-Al 6y ago
Wish they could do something about Amazon. Every time they "offer" me an Amazon Prime subscription it's an absolute nightmare trying to find the link to continue without it. A tiny little link with absolutely no highlighting hidden in the middle of the page. I did once end up accidentally subscribing and had to cancel. Ever since then I'm really paranoid about that page.
jhart99 6y ago
Does it really matter though? In my experience, the CA attorney general fails to enforce even flagrant violations of the CCPA. All you get is a form letter when you report a violation. Some examples I have collected: non-response to requests, spamming the email address used for a request, failure to disclose specific pieces of personal information, etc. The best one I had was a letter from Experian where they had everything redacted even my address.
devoutsalsa 6y ago
Eventually there will be so much regulation, the only thing you'll be able to post online with violating the law is public domain picture of a brick, and you'll still get a shakedown letter from Getty Images that demands tribute.
harrylepotter 6y ago
Has anyone noticed in SF at least that the parking meters now automatically go to the highest-possible time and you have to decrement the meter rather than increment it? Is this a 'Dark Pattern'?

139 points by ryanwhitney 6y ago

Sorry for the negativity but does this matter? Like, at all? The CANSPAM act was implemented a decade ago and I still receive spam emails without unsubscribe links from salespeople at Fortune 500s. Reporting it does nothing. There is no real enforcement of any of this.

sodality2 6y ago

This seems like very good news! Wonder if I will have to VPN into CA to benefit though... :/

bigiain 6y ago
I might write a tool to fetch webpages from a CA VPN endpoint and a nonCA one - and highlight the diffs... Maybe even automatically tweet a “hall of shame”.?
floatingatoll 6y ago
One very popular CCPA white-label service cross-checks identity databases and credit reports in order to prove state residency. VPNs won’t help with that.
- finnthehuman 6y ago
  That sounds sketchy as fuck. Whether I’m a California resident is not the type of fact that can be derived from publicly/commercially available data. Their business model is to guess, and false negatives deprive Californians of their rights.

Rebelgecko 6y ago

>The new regulations will also institute the use of a new Privacy Options icon, which internet consumers can use as a visual cue to opt-out of the sale of their personal information. What does this actually mean? An extra overlay to click away when I visit a new website for the first time?

floatingatoll 6y ago
The “Do Not Sell My Personal Information” links are awfully wordy. An icon would be nice to have. Why would you make an overlay from it, though?

cgearhart 6y ago

Is Gizmodo hosting this article in order to give a demonstration of “dark patterns” with their website? Auto playing video ad overlayed inline with the text, article content split and spread over the whole page. What utter garbage.

Griffinsauce 6y ago
Not all bad UX is a dark pattern.
- beshrkayali 6y ago
  True, but you can easily predict when it’s intentionally misleading, there’s still chance of being wrong but people have been burnt too many times by this type of website (usually owned by media holding companies) that it’s safe to assume bad intentions.

marketingtech 6y ago

They use the term "dark patterns" in the press release, but the actual regulation is very specific, straightforward, and limited to the "Do Not Sell My Personal Information" link that's required by the California Consumer Privacy Act. The notice of right to opt-out shall be designed and presented in a way that is easy to read and understandable to consumers. The notice shall: a. Use plain, straightforward language and avoid technical or legal jargon. b. Use a format that draws the consumer’s attention to the notice and makes the notice readable, including on smaller screens, if applicable. c. Be available in the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements, and other information to consumers in California. d. Be reasonably accessible to consumers with disabilities. For notices provided online, the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Web Consortium, incorporated herein by reference. In other contexts, the business shall provide information on how a consumer with a disability may access the notice in an alternative format. source: https://oag.ca.gov/system/files/attachments/press-docs/CCPA%20March%2015%20Regs.pdf https://oag.ca.gov/system/files/attachments/press-docs/CCPA%...

tony101 6y ago
The press release is specific and limited too: "The newly-approved regulations ban so-called “dark patterns” that delay or obscure the process for opting out of the sale of personal information. Specifically, it prohibits companies from burdening consumers with confusing language or unnecessary steps such as forcing them to click through multiple screens or listen to reasons why they shouldn’t opt out." https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-additional-regulations-empower-data https://oag.ca.gov/news/press-releases/attorney-general-bece...
ryanwhitney 6y ago
Interesting. Stack Exchange has a truly awful dark pattern in their GDPR banner experience: You click to customize tracking cookies and get presented with a list of checkboxes, but primary button on the right is "Accept all cookies", whereas the left side (where you'd usually find a "Cancel") is a secondary-looking button that says "Accept changes". If you don't take the time to actually read the buttons, you end up unchecking a bunch of boxes just to inadvertently accept them all. Real scumbag stuff. From the above, it sounds like tricks like that may not even be covered.

mawise 6y ago

Disappointing that they would mandate details about the opt-out process for selling personal information instead of mandating that it be an opt-in process.

tony101 6y ago
That is not within the CA Attorney General's control. The statute (CCPA) specifies opt-out, not opt-in, for most consumers. (The exception is for children under 16, who get an opt-in process.)
- TedDoesntTalk 6y ago
  How does a website proactively select opt-in without knowing its users’ ages?

causality0 6y ago

I wish they could extend these protections to local software. Imagine if all of your devices had a single "disable telemetry" button.

peter_d_sherman 6y ago

>"...dark patterns — tricks deployed by websites or apps that seek to frustrate or bamboozle users into doing things they wouldn’t normally do." Hmm, had not heard the term "dark patterns" -- until now... Anyway, it's going into my 2021 lexicon... I knew that there were "attack sites" on the Internet -- that is, websites which openly attacked the browser of any visitor... Maybe "dark patterns" could be thought of as the "lesser version" of that -- instead of attacking your browser -- the website attacks your rights (!) That is, by railroading you (the user) into "accepting" "agreements" -- that you normally would not have accepted! Now, the $64,000 question: Where have I seen that pattern before? ?

rapnie 6y ago
In IETF inclusive terminology repo the term 'deception pattern' is proposed. https://github.com/ietf/terminology https://github.com/ietf/terminology

gnicholas 6y ago

Funny, the California Bar Association uses dark patterns in their membership dues section. When you go to pay your dues, you are presented with many options to opt-in and pay extra for various causes. Then partway through the process, you are presented with other "adjustment" options, which in their default state show "none" in the dropdown selector. Only if you click on "none" do you learn that you can deduct various amounts (ranging up to $40) for each of the various dropdown menus. There is no way to adjust all of these menus with one selection — you have to do it separately for each of them. It took me a couple years of paying inflated dues before realizing that I was doing so. I think opt-outs are bad, but they are especially heinous when camouflaged amongst opt-ins. If the state ever expands their regulation of dark patterns (which are very narrow, as other commenters have pointed out), they will have to make sure that organizations like the CA Bar Association, which is tasked with setting and enforcing ethical rules related to judges and lawyers, get their houses in order.

justinzollars 6y ago

California has too many rules and the system is absolutely failing for the basic necessities of life.

LimaBearz 6y ago
I filed my taxes last night through TurboTax. I love the idea of “regulations are bad”, but left unchecked intuit is great example of dark patterns and why there needs to be governing body over private business. Those crooked bastards tried to upsell me or trick me into needing a more expensive product at the start of every section. Likewise lately I’ve found myself wanting a better general news source and I think NYT is fairly reputable, until some quick research shows you can not unsubribe without calling someone, but sign up yeah absolutely, a few clicks and you’re done If there was bill addressing the first one, that’s not “failing for the basic necessities of life”. I don’t think it’s unreasonable to demand business not try to F you cause they can. There’s been so much consolidation in the market that “voting with your money” has become nothing more than an untenable aphorism.
- ALittleLight 6y ago
  You'd think the government could build their own turbotax and let everyone use that for free. I assume a good/simple version would make people more likely to pay their taxes correctly and the profit off of that would more than cover the expense of making it. Of course, in reality, I know the government would botch it. Still, the system seems really bad.
  - distances 6y ago
    I'm not sure why you would be so cynical about government abilities. Automated taxes work great in quite many countries worldwide. Do you think US government is somehow especially incompetent?
    - ramphastidae 6y ago
      Perhaps you should do some basic reading about the average length and costs of public infrastructure projects in the US vs. other developed nations.

TedDoesntTalk 6y ago

Why does Gizmodo still suck without an ad blocker?

Jan454 6y ago

Does this make Micros*t dark-pattern practice to overwrite the bootloader without consent on install (and thus making it extra complicated to setup dualboot with e.g. Linux) illegal?

zaphirplane 6y ago

What’s the fine when the government does it. Oh like say California DMV

Digit-Al 6y ago

Wish they could do something about Amazon. Every time they "offer" me an Amazon Prime subscription it's an absolute nightmare trying to find the link to continue without it. A tiny little link with absolutely no highlighting hidden in the middle of the page. I did once end up accidentally subscribing and had to cancel. Ever since then I'm really paranoid about that page.

jhart99 6y ago

Does it really matter though? In my experience, the CA attorney general fails to enforce even flagrant violations of the CCPA. All you get is a form letter when you report a violation. Some examples I have collected: non-response to requests, spamming the email address used for a request, failure to disclose specific pieces of personal information, etc. The best one I had was a letter from Experian where they had everything redacted even my address.

devoutsalsa 6y ago

Eventually there will be so much regulation, the only thing you'll be able to post online with violating the law is public domain picture of a brick, and you'll still get a shakedown letter from Getty Images that demands tribute.

harrylepotter 6y ago

Has anyone noticed in SF at least that the parking meters now automatically go to the highest-possible time and you have to decrement the meter rather than increment it? Is this a 'Dark Pattern'?