7 ms·

Manipulative Consent Requests

123 points by openplatypus 3y ago

jjbinx007 3y ago
Latest snapshot: https://web.archive.org/web/20230421135056/https://wideangle.co/blog/dark-patterns-examples-of-manipulative-consent-requests https://web.archive.org/web/20230421135056/https://wideangle... Almost all cookie prompts use at least one of these dark patterns on the websites I visit. Interestingly, Hacker News doesn't prompt for cookies at all.
- nortlov 3y ago
  Thanks. One of my Pi-hole filters is blocking this page.
- BiteCode_dev 3y ago
  That's because it's not about cookies, it's about tracking cookies. If you don't track, you don't need the banner.
openplatypus 3y ago
There is larger gallery of real life examples: https://www.deceptive.design/ https://www.deceptive.design/ I, personally, dislike TrustArc https://www.deceptive.design/brands/trustarc https://www.deceptive.design/brands/trustarc
dijit 3y ago
fwiw: declining third party cookies has to be as easy (by law!) as accepting them. If there is no disagree to tracking or “only required cookies” option then you can notify the company and/or police.
- openplatypus 3y ago
  Company: yes. Police: no. Local Data Protection Authority: yes.
- tjpnz 3y ago
  In other words, the "Manage Preferences" dark pattern is a GDPR violation?
  - openplatypus 3y ago
    Check the note in section #5 > Note: This suggestion comes from EDPB guidance, but there wasn’t a unanimous agreement among the regulators. Some data protection authorities believe that the “Reject” button can appear on the second layer of the banner, behind the “Manage Preferences” button.
    - cratermoon 3y ago
      > Some data protection authorities It would be nice to know who employs those 'authorities'
  - hk__2 3y ago
    Yes. It should be as easy to deny cookies as to accept them.
yoaviram 3y ago
Very well written, I'm glad to see this topic getting attention. We're about to publish a similar work relating to dark patterns in the way companies respond to data protection requests (data deletion, access etc.): https://consciousdigital.org/wp-content/uploads/2023/04/dark-patterns.pdf https://consciousdigital.org/wp-content/uploads/2023/04/dark...
- openplatypus 3y ago
  Thanks! This is the second piece in the series about consent. If you like, you might appreciate our 1st entry here https://wideangle.co/blog/what-is-consent-under-gdpr https://wideangle.co/blog/what-is-consent-under-gdpr
rabuse 3y ago
I absolutely hate those cookie banners. A always click the accept button just to get rid of the damn thing.
- aednichols 3y ago
  Look up the “I still don’t care about cookies” browser extension. I can definitely see why people want to have the choice, but I simply don’t care and don’t want to be interrupted.
  - wpm 3y ago
    Most people don't want the choice, and in anything else, would never consent to the tracking in the first place. If it was opt-in, who the hell would opt in? What good would it do them? If there was an annoying person then followed you around the mall, taking note of everything you bought so they could sell that list to the other stores in the mall for a profit, would you let them? What if every time you went into a new store, another, differently dressed person wouldn't let you into the store until you answered some goddamn riddle about whether you want to consent to them following you around? Who would shop at that mall? I think the GDPR was a step in the right direction, but it should have more heavily regulated respecting the DNT cookie. Let me opt-out, permanently, everywhere unless I decide not to.
    - aednichols 3y ago
      Well said. > If there was an annoying person then followed you around the mall, taking note of everything you bought so they could sell that list to the other stores in the mall for a profit, would you let them? I use a credit card instead of cash, so I guess I have to answer yes to this one.
- nequo 3y ago
  You and I are alike. I absolutely hate those cookie banners. I always click the reject button just to get rid of the damn thing.
neilv 3y ago
> No ‘Reject’ Button This is one of the more annoying ones for me. I'm probably navigating in a very goal-directed way, with various efficiency tricks, juggling tabs and windows and thoughts. As soon as I see the "Accept Cookies" and "Manage Preferences" button pair, I assume one will let me see the page, and the other make me go through a pile of disingenuous, punitive nonsense.
- bootsmann 3y ago
  The French implementation of GDPR is very strict on this. It got google into court and they now comply with a single reject all button.
  - eitland 3y ago
    So you are the hero everyone can thank for getting Google to do the right thing in this case? I noticed it months ago, but always thought they unlike most others had a lawyer that could read. Edit: I'm bookmarking this for future reference and recommend others do to. It is proof that it is doable.
    - bootsmann 3y ago
      I’m not French, I just work for a French company :) The real hero is the French gdpr watchdog CNIL and the EU for giving them the ability to show teeth. https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-million-euros-and-facebook-60-million-euros-non-compliance https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-m...
      - deleted 3y ago
        [deleted]
  - Rygian 3y ago
    The same applies for all of Europe: * "The [French] CNIL's guidance reflects the position of the European Data Protection Board (EDPB) and the Court of Justice of the European Union (CJEU)." [1] * "although the CNIL’s decisions are only binding in France, these decisions should worry any website operators who have adopted similar cookie banner mechanisms to Facebook and Google in other European countries." [2] [1] https://www.termsfeed.com/blog/french-cookie-compliance-2021-crackdown/ https://www.termsfeed.com/blog/french-cookie-compliance-2021... [2] https://www.technologylawdispatch.com/2022/02/privacy-data-protection/january-2022-cookie-fines-in-france-is-it-the-beginning-of-a-cookie-gate/ https://www.technologylawdispatch.com/2022/02/privacy-data-p...
_9hey 3y ago
Amazon uses dark patterns extensively while promoting Prime
Taek 3y ago
One big benefit of LLMs is that they should be able to parse the HTML page and detect dark patterns, and then re-write the UI to fix them.
bschwarz 3y ago
The only acceptable cookie banner is none at all.
Sohcahtoa82 3y ago
The people writing these dark patterns know exactly what they're doing. I interpret this page as "calling out" the designers, rather than educating them.
ryandrake 3y ago
Technology companies seem to have a chronic problem with consent. And when regulation drops in, they do everything they can to cry, complain, deceive, work-around, weasel-out, ignore, and fight against consent. If the web was a nightclub, Silicon Valley would be the creepy guy that hits on every woman with "Do you want to dance with me? [Yes] [Ask Me Again In Five Minutes]." It's embarrassing how out of control the industry is, how toothless regulators are, and how outraged companies are when something finally forces them to simply ask users permission to do things.
- dheera 3y ago
  While I agree with the consent issue, I think consent to use cookies isn't the problem. I already set my browser to not store cookies by default, and make exceptions for a few websites I need to log into. For me, consent is enforced at the browser level, not the website level. So I don't really care whether I hit "accept" or "decline". Their cookies aren't going to be stored either way. In fact it's even more ridiculous and annoying that they need to store a goddamn cookie or fingerprint me to remember that I declined, which of course doesn't get stored on my end, and results in the stupid dialog box appearing every time I visit the site. You know where I really hate tech companies and consent? Asking for phone numbers for SMS confirmations. No thanks. You don't need my phone number to do business with me. Just the other day a goddamn restaurant needed a phone number to order food in person at the restaurant via their abomination of a QR code at the table and a mobile webpage ordering system.
  - olivierduval 3y ago
    Watch out, cookie consent is more than just cookies: it's about keeping and exploitable your personal datas! When you accept cookies, you accept that the provider can use and sell your datas... so even if you automatically erase the cookie, it's only the tip of the iceberg GDPR is way larger than just cookies...
  - Rygian 3y ago
    When you instruct your browser to accept cookies for the few websites you log into, your browser is unable to limit acceptance only to the cookies that are strictly mandatory for proper functioning. Instead, your browser will accept any cookie, including unnecessary ones, because it can't tell the difference. Therefore, you cannot enforce consent at the browser level.
britzkopf 3y ago
The emotional steering pattern always gives me a chuckle... Choose between: ->Yes, send me the newsletter informing me of your latest charitable initiatives. ->No, I don't care about starving children.
- loa_in_ 3y ago
  "I want to download this file with all additional affiliate marketing executables and remote control included." vs "I do not want my grandma saved from a house fire preventable by products from our sponsors' catalogue."
- rpastuszak 3y ago
  My favourite one was an ad for a dating site, with the reject button saying "No, I don't want to be happy" and "No, I want to be alone".
roter 3y ago
Funny, as I scrolled down reading, a pop-up window appeared that obscured the content, advertising a "FREE Trial!". This has almost the same impact for me as a cookie banner --- something that diverts attention. They have a big red button to press versus a smaller X to kill.
- cratermoon 3y ago
  The tiny/invisible close control is a plague. Often it's designed to look unlike common "click here to close" convention, making it especially difficult to find.
- l3x4ur1n 3y ago
  Now that you mention it, I vaguely remember something like a pop-up window pop up, but I so automatically closed it I didn't even remember there was one!
- openplatypus 3y ago
  Thanks for mentioning this! We missed this _ironic issue_. Our new trial prompt features a more prominent close button now.
  - YeGoblynQueenne 3y ago
    Still says "Free trial" and "Hide this message" in different-coloured buttons. Is this in jest ("_ironic_")? If so, I at least am so used to such dark patterns that it did not register as a joke. If it's meant as a joke, then OK, I can chuckle. But while I'm curious to see what happens, I'm not pressing no buttons, no sir, joke or no joke. I'm jaded like that.
    - openplatypus 3y ago
      This is not a consent box. Neither choice creates cookies. Nor does it force you to surrender data. I recognized that using a smaller X close cross button was not fair and could lead, especially on mobile, to undesirable action. Now, the button is equally sized, and this should prevent accident presses for those not interested.
neilv 3y ago
One nice thing about the cookie consent rules is that they're familiar enough that the UX dark pattern dark arts are more obvious. "Why is it so hard to find where to cancel my subscription?" is more ambiguous than "Sigh, another 'accept, or go to the preferences department' dialog; what a dumb/jerky site."
mpsprd 3y ago
GDPR kept tracking going on while putting the internet back in the age of pop up windows.
cratermoon 3y ago
The pattern I see most often falls into #9 and #10. Not only is the 'Accept All' button made more prominent, but other design tricks make it the default selected item. Tapping space or enter on a keyboard would click it, making it possible for the user to unintentionally opt-in through a slip of a finger.
HlessClaudesman 3y ago
11. "Be a real shame if someone scrambled that nice ordered playlist of yours." (cracks knuckles menacingly) - Google Having a unchecked random button, then randomly skipping about in a playlist anyway, unless you are a youtube premium user, is super dark pattern. Google pulling more and more user hostile shit like this is a gift to their competitors.
- wpm 3y ago
  I've de-googled most of my life except for YouTube, and sadly, YouTube Music. I'm still grandfathered in on the old Play Music + Premium deal for $9/mo or some shit. Too good of a deal to ever cancel, but man it sure does seem like Google is going out of their way to annoy the shit out of me until I do. Whether it's the dog crap tier STB/Mobile app, or the website, with almost scalpel like efficiency they manage to push me close to snapping every week. The new pastime, some moron decided either that they should store the choice for "Auto-play on hover" locally, or purposefully write crappy server-side code so the choice just so happens to randomly go back to the default "On" setting. I mean, my god, YouTube can keep track of over 500 channels I subscribe to, all of my stupid large playlists, but can't remember to keep a single boolean value about me? Oh gee whiz we turned auto play back on shucks where did I put your preferences? Can't find em here's a totally unrelated video haha!
  - HlessClaudesman 3y ago
    So annoying. So many great products end up eaten alive by bean counters and product managers trying to "improve" things. Just curious, what advantage does YoutubeMusic have over just playing songs & full albums in YouTube, other than the warm glow of being on the right side of copywrite laws?
photochemsyn 3y ago
This post is a list of things to avoid doing, but it could benefit from an example of acceptable examples. It's funny how the language around this kind of thing has grown more convoluted since 'whitelist' and 'blacklist' have been removed from the language, so instead we have 'dark pattern' which, on similar grounds, could inspire another call for language censorship. Fundamentally, it's just easier to check patterns against an allowed list than against a banned list, because if the pattern is in the acceptable set, you're done, but just because it's not found in the unacceptable set, doesn't mean it's not deceptive.
- remus 3y ago
  I find the various regulators tend to set a good example. e.g. the ICO in the UK https://ico.org.uk/ https://ico.org.uk/
hk__2 3y ago
A "nice" thing about these banners is that 80% of the websites I visit use one of the 2-3 big providers of cookie banners, so once you’re used to them you can quickly reject all cookies in 2 seconds thanks to muscle memory.
kimi 3y ago
Whatever the reason may be, and even in the best of cases without dark patterns, the fact that every freakin' site requires a click (positive consent) it simply idiotic.
kylecazar 3y ago
Another: when the controls are embedded within the privacy policy. I think cookiebot lets it's customers do this.
wpm 3y ago
Tracking cookie regulation should have defaulted to "Users must opt in" rather than opt out. Opt out will always lead to dark patterns and manipulation like this (try to cancel most "free trials" or subscriptions!). And why wasn't it? Because "No one would ever opt-in!" Yeah. Exactly. Leave us the fuck alone.
- MallocVoidstar 3y ago
  GDPR requires consent to be opt-in. Most companies ignore this.
jraph 3y ago
One not listed that is a mix of "5. No ‘Reject’ Button" and "10. Deceptive Button Contrast" is a big "Accept" button at the bottom, well in sight, and a decline/refuse grey link at the top that you notice if you look somewhat hard. I've been seeing it more and more lately.
AndrewStephens 3y ago
When I am king of the world all cookie banners will have standardized language: "This site uses cookies if you are logged on. But even if you aren't logged on, we share your browsing details with 6 other companies from around the world. And they sell your details onto other companies and possibly governments. We don't know. But we get $0.0003 for it, so we really want you to say yes to the following question. Do you consent?"
- dale_glass 3y ago
  Just 6? Before this got reigned in a bit, I've once encountered a pop-up that required me to manually opt-out out of more than a hundred trackers, one by one.
- ckastner 3y ago
  > This site uses cookies if you are logged on. But even if you aren't logged on, we share your browsing details with 6 other companies from around the world. That's one of the things the GDPR was created for. If your data is being shared, you must be informed of with whom it is being shared, and for what purpose. And if the only reason the data is being shared is so that you can earn $0.00003 for it, rather than being necessary in order for you to provide the service, than you probably need consent anyway. And at the minimum, you must offers users the option to object to that processing.
- karaterobot 3y ago
  When I'm king (that's right, I'm planning a coup!) I will make the browser manufacturers handle this with a standard dialog the site owners can only customize in limited ways. Users will be able to express general preferences and they will be respected (i.e. I can choose to opt in or out of marketing-related cookies in my browser settings, rather than on a per-site basis).
- TheCoelacanth 3y ago
  Why so unambitious? When I'm king, you will have to assume lack of consent without asking. If users want to be tracked they can opt-in by emailing trackme@<your domain>.
bigbacaloa 3y ago
Ethics has little importance in contemporary business activity.
tpoacher 3y ago
Sales people reading this: "What a marvellous list of great tips on tricks to use!"
- jraph 3y ago
  At least, people asked to implement them will be able to point at this page and say "No, we should not, because it is a well-known dark pattern and doing this would make us look bad which is not good for the business, and that's also not GDPR-friendly and conforming to the GDPR is the whole reason why we are implementing this consent banner in the first place so it makes no sense doing it. If we are doing it, we might as well not display this banner at all".
cerradokids 3y ago
These cookie banners are so bad. Bad idea, bad regulation, bad execution. The time wasted for all humans in the world dealing with such a bad idea is out of the charts. If I don't want to be tracked I will use an anonymous tab or configure my browser to not allow any cookies. The solution already existed. The people that care about it already knew it. The companies would come up with something better if there was a real problem, with people being worried about to the point of changing browser. Ayn Rand was right and still is. We live in the age of envy. Hatred of the good for being the good. Useless waste of time for all human beings to hurt a few big successful companies because of tiny, envious people with the excuse to protect some helpless citizens.
- openplatypus 3y ago
  > Bad idea, No, the idea is solid. > bad regulation, In parts, you are right. >bad execution. Agreed. > The people that care about it already knew it. Sadly, it is not so simple. There was and still is a group of people, “The people who did not know it, but would care if they did”. > The companies would come up with something better if there was a real problem Company, for the better or the worse, is usually oriented towards benefits of shareholders, not users, customers nor societies. Don't get me wrong, there are companies that are not evil. But how do we know which are? Luckily, we have laws that prevent escalation beyond certain norms and protect those, who are not shareholders.
westurner 3y ago
"fraudulent redefinition of consent" Unconscionability: https://en.wikipedia.org/wiki/Unconscionability https://en.wikipedia.org/wiki/Unconscionability : > Unconscionability (sometimes known as unconscionable dealing/conduct in Australia) is a doctrine in contract law that describes terms that are so extremely unjust, or overwhelmingly one-sided in favor of the party who has the superior bargaining power, that they are contrary to good conscience. Typically, an unconscionable contract is held to be unenforceable because no reasonable or informed person would otherwise agree to it. The perpetrator of the conduct is not allowed to benefit, because the consideration offered is lacking, or is so obviously inadequate, that to enforce the contract would be unfair to the party seeking to escape the contract. Statute of frauds: https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Statute_of_frauds : > A statute of frauds is a form of statute requiring that certain kinds of contracts be memorialized in writing, signed by the party against whom they are to be enforced, with sufficient content to evidence the contract. [1][2] […] > Raising the defense: A defendant in a contract case who wants to use the statute of frauds as a defense must raise it as an affirmative defense in a timely manner. [7] The burden of proving that a written contract exists comes into play only when a statute of frauds defense is raised by the defendant.
- westurner 3y ago
  Statute of frauds > United States > Uniform Commercial Code: https://en.m.wikipedia.org/wiki/Statute_of_frauds#Uniform_Commercial_Code https://en.m.wikipedia.org/wiki/Statute_of_frauds#Uniform_Co... : > Uniform Commercial Code: In addition to general statutes of frauds, under Article 2 of the Uniform Commercial Code (UCC), every state except Louisiana has adopted an additional statute of frauds that relates to the sale of goods. Pursuant to the UCC, contracts for the sale of goods where the price equals $500 or more fall under the statute of frauds, with the exceptions for professional merchants performing their normal business transactions, and for any custom-made items designed for one specific buyer. [42] IIUC, that means that if the USD amount of a contract for future performance is over $500 the court would regard a statute of frauds argument as just cause for dismissal? Or just goods?
handity 3y ago
"Consent requests" will never work. Until all web browsers present identical fingerprints and reveal no identifying data about the user, tracking will take place, whether laws mandate consent or not. Opt-in, opt-out, none of it matters as long as we're browsing the internet with our unique identities on full display to every site we visit. Thinking that the solution is to ask companies nicely to please not use that information is delusional.
yafbum 3y ago
Let's not forget another great one: "accept or subscribe", although that one is somehow sanctioned by the EU. Subscription-based freemium services are apparently ok to ask their users to either accept tracking or pay money. Many of the folks doing this are news services with great local political power. Coincidence?
IYasha 3y ago
I really WANT to read this article, but... https://i.postimg.cc/C1mZ6VLP/Screenshot-20230427-192121.png https://i.postimg.cc/C1mZ6VLP/Screenshot-20230427-192121.png Is it just my Linux, or the site is THAT bad?

123 points by openplatypus 3y ago

Latest snapshot: https://web.archive.org/web/20230421135056/https://wideangle.co/blog/dark-patterns-examples-of-manipulative-consent-requests https://web.archive.org/web/20230421135056/https://wideangle... Almost all cookie prompts use at least one of these dark patterns on the websites I visit. Interestingly, Hacker News doesn't prompt for cookies at all.

nortlov 3y ago
Thanks. One of my Pi-hole filters is blocking this page.
BiteCode_dev 3y ago
That's because it's not about cookies, it's about tracking cookies. If you don't track, you don't need the banner.

openplatypus 3y ago

There is larger gallery of real life examples: https://www.deceptive.design/ https://www.deceptive.design/ I, personally, dislike TrustArc https://www.deceptive.design/brands/trustarc https://www.deceptive.design/brands/trustarc

dijit 3y ago

fwiw: declining third party cookies has to be as easy (by law!) as accepting them. If there is no disagree to tracking or “only required cookies” option then you can notify the company and/or police.

openplatypus 3y ago
Company: yes. Police: no. Local Data Protection Authority: yes.
tjpnz 3y ago
In other words, the "Manage Preferences" dark pattern is a GDPR violation?
- openplatypus 3y ago
  Check the note in section #5 > Note: This suggestion comes from EDPB guidance, but there wasn’t a unanimous agreement among the regulators. Some data protection authorities believe that the “Reject” button can appear on the second layer of the banner, behind the “Manage Preferences” button.
  - cratermoon 3y ago
    > Some data protection authorities It would be nice to know who employs those 'authorities'
- hk__2 3y ago
  Yes. It should be as easy to deny cookies as to accept them.

yoaviram 3y ago

Very well written, I'm glad to see this topic getting attention. We're about to publish a similar work relating to dark patterns in the way companies respond to data protection requests (data deletion, access etc.): https://consciousdigital.org/wp-content/uploads/2023/04/dark-patterns.pdf https://consciousdigital.org/wp-content/uploads/2023/04/dark...

openplatypus 3y ago
Thanks! This is the second piece in the series about consent. If you like, you might appreciate our 1st entry here https://wideangle.co/blog/what-is-consent-under-gdpr https://wideangle.co/blog/what-is-consent-under-gdpr

rabuse 3y ago

I absolutely hate those cookie banners. A always click the accept button just to get rid of the damn thing.

aednichols 3y ago
Look up the “I still don’t care about cookies” browser extension. I can definitely see why people want to have the choice, but I simply don’t care and don’t want to be interrupted.
- wpm 3y ago
  Most people don't want the choice, and in anything else, would never consent to the tracking in the first place. If it was opt-in, who the hell would opt in? What good would it do them? If there was an annoying person then followed you around the mall, taking note of everything you bought so they could sell that list to the other stores in the mall for a profit, would you let them? What if every time you went into a new store, another, differently dressed person wouldn't let you into the store until you answered some goddamn riddle about whether you want to consent to them following you around? Who would shop at that mall? I think the GDPR was a step in the right direction, but it should have more heavily regulated respecting the DNT cookie. Let me opt-out, permanently, everywhere unless I decide not to.
  - aednichols 3y ago
    Well said. > If there was an annoying person then followed you around the mall, taking note of everything you bought so they could sell that list to the other stores in the mall for a profit, would you let them? I use a credit card instead of cash, so I guess I have to answer yes to this one.
nequo 3y ago
You and I are alike. I absolutely hate those cookie banners. I always click the reject button just to get rid of the damn thing.

neilv 3y ago

> No ‘Reject’ Button This is one of the more annoying ones for me. I'm probably navigating in a very goal-directed way, with various efficiency tricks, juggling tabs and windows and thoughts. As soon as I see the "Accept Cookies" and "Manage Preferences" button pair, I assume one will let me see the page, and the other make me go through a pile of disingenuous, punitive nonsense.

bootsmann 3y ago
The French implementation of GDPR is very strict on this. It got google into court and they now comply with a single reject all button.
- eitland 3y ago
  So you are the hero everyone can thank for getting Google to do the right thing in this case? I noticed it months ago, but always thought they unlike most others had a lawyer that could read. Edit: I'm bookmarking this for future reference and recommend others do to. It is proof that it is doable.
  - bootsmann 3y ago
    I’m not French, I just work for a French company :) The real hero is the French gdpr watchdog CNIL and the EU for giving them the ability to show teeth. https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-million-euros-and-facebook-60-million-euros-non-compliance https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-m...
    - deleted 3y ago
      [deleted]
- Rygian 3y ago
  The same applies for all of Europe: * "The [French] CNIL's guidance reflects the position of the European Data Protection Board (EDPB) and the Court of Justice of the European Union (CJEU)." [1] * "although the CNIL’s decisions are only binding in France, these decisions should worry any website operators who have adopted similar cookie banner mechanisms to Facebook and Google in other European countries." [2] [1] https://www.termsfeed.com/blog/french-cookie-compliance-2021-crackdown/ https://www.termsfeed.com/blog/french-cookie-compliance-2021... [2] https://www.technologylawdispatch.com/2022/02/privacy-data-protection/january-2022-cookie-fines-in-france-is-it-the-beginning-of-a-cookie-gate/ https://www.technologylawdispatch.com/2022/02/privacy-data-p...

_9hey 3y ago

Amazon uses dark patterns extensively while promoting Prime

Taek 3y ago

One big benefit of LLMs is that they should be able to parse the HTML page and detect dark patterns, and then re-write the UI to fix them.

bschwarz 3y ago

The only acceptable cookie banner is none at all.

Sohcahtoa82 3y ago

The people writing these dark patterns know exactly what they're doing. I interpret this page as "calling out" the designers, rather than educating them.

ryandrake 3y ago

Technology companies seem to have a chronic problem with consent. And when regulation drops in, they do everything they can to cry, complain, deceive, work-around, weasel-out, ignore, and fight against consent. If the web was a nightclub, Silicon Valley would be the creepy guy that hits on every woman with "Do you want to dance with me? [Yes] [Ask Me Again In Five Minutes]." It's embarrassing how out of control the industry is, how toothless regulators are, and how outraged companies are when something finally forces them to simply ask users permission to do things.

dheera 3y ago
While I agree with the consent issue, I think consent to use cookies isn't the problem. I already set my browser to not store cookies by default, and make exceptions for a few websites I need to log into. For me, consent is enforced at the browser level, not the website level. So I don't really care whether I hit "accept" or "decline". Their cookies aren't going to be stored either way. In fact it's even more ridiculous and annoying that they need to store a goddamn cookie or fingerprint me to remember that I declined, which of course doesn't get stored on my end, and results in the stupid dialog box appearing every time I visit the site. You know where I really hate tech companies and consent? Asking for phone numbers for SMS confirmations. No thanks. You don't need my phone number to do business with me. Just the other day a goddamn restaurant needed a phone number to order food in person at the restaurant via their abomination of a QR code at the table and a mobile webpage ordering system.
- olivierduval 3y ago
  Watch out, cookie consent is more than just cookies: it's about keeping and exploitable your personal datas! When you accept cookies, you accept that the provider can use and sell your datas... so even if you automatically erase the cookie, it's only the tip of the iceberg GDPR is way larger than just cookies...
- Rygian 3y ago
  When you instruct your browser to accept cookies for the few websites you log into, your browser is unable to limit acceptance only to the cookies that are strictly mandatory for proper functioning. Instead, your browser will accept any cookie, including unnecessary ones, because it can't tell the difference. Therefore, you cannot enforce consent at the browser level.

britzkopf 3y ago

The emotional steering pattern always gives me a chuckle... Choose between: ->Yes, send me the newsletter informing me of your latest charitable initiatives. ->No, I don't care about starving children.

loa_in_ 3y ago
"I want to download this file with all additional affiliate marketing executables and remote control included." vs "I do not want my grandma saved from a house fire preventable by products from our sponsors' catalogue."
rpastuszak 3y ago
My favourite one was an ad for a dating site, with the reject button saying "No, I don't want to be happy" and "No, I want to be alone".

roter 3y ago

Funny, as I scrolled down reading, a pop-up window appeared that obscured the content, advertising a "FREE Trial!". This has almost the same impact for me as a cookie banner --- something that diverts attention. They have a big red button to press versus a smaller X to kill.

cratermoon 3y ago
The tiny/invisible close control is a plague. Often it's designed to look unlike common "click here to close" convention, making it especially difficult to find.
l3x4ur1n 3y ago
Now that you mention it, I vaguely remember something like a pop-up window pop up, but I so automatically closed it I didn't even remember there was one!
openplatypus 3y ago
Thanks for mentioning this! We missed this _ironic issue_. Our new trial prompt features a more prominent close button now.
- YeGoblynQueenne 3y ago
  Still says "Free trial" and "Hide this message" in different-coloured buttons. Is this in jest ("_ironic_")? If so, I at least am so used to such dark patterns that it did not register as a joke. If it's meant as a joke, then OK, I can chuckle. But while I'm curious to see what happens, I'm not pressing no buttons, no sir, joke or no joke. I'm jaded like that.
  - openplatypus 3y ago
    This is not a consent box. Neither choice creates cookies. Nor does it force you to surrender data. I recognized that using a smaller X close cross button was not fair and could lead, especially on mobile, to undesirable action. Now, the button is equally sized, and this should prevent accident presses for those not interested.

neilv 3y ago

One nice thing about the cookie consent rules is that they're familiar enough that the UX dark pattern dark arts are more obvious. "Why is it so hard to find where to cancel my subscription?" is more ambiguous than "Sigh, another 'accept, or go to the preferences department' dialog; what a dumb/jerky site."

mpsprd 3y ago

GDPR kept tracking going on while putting the internet back in the age of pop up windows.

cratermoon 3y ago

The pattern I see most often falls into #9 and #10. Not only is the 'Accept All' button made more prominent, but other design tricks make it the default selected item. Tapping space or enter on a keyboard would click it, making it possible for the user to unintentionally opt-in through a slip of a finger.

HlessClaudesman 3y ago

11. "Be a real shame if someone scrambled that nice ordered playlist of yours." (cracks knuckles menacingly) - Google Having a unchecked random button, then randomly skipping about in a playlist anyway, unless you are a youtube premium user, is super dark pattern. Google pulling more and more user hostile shit like this is a gift to their competitors.

wpm 3y ago
I've de-googled most of my life except for YouTube, and sadly, YouTube Music. I'm still grandfathered in on the old Play Music + Premium deal for $9/mo or some shit. Too good of a deal to ever cancel, but man it sure does seem like Google is going out of their way to annoy the shit out of me until I do. Whether it's the dog crap tier STB/Mobile app, or the website, with almost scalpel like efficiency they manage to push me close to snapping every week. The new pastime, some moron decided either that they should store the choice for "Auto-play on hover" locally, or purposefully write crappy server-side code so the choice just so happens to randomly go back to the default "On" setting. I mean, my god, YouTube can keep track of over 500 channels I subscribe to, all of my stupid large playlists, but can't remember to keep a single boolean value about me? Oh gee whiz we turned auto play back on shucks where did I put your preferences? Can't find em here's a totally unrelated video haha!
- HlessClaudesman 3y ago
  So annoying. So many great products end up eaten alive by bean counters and product managers trying to "improve" things. Just curious, what advantage does YoutubeMusic have over just playing songs & full albums in YouTube, other than the warm glow of being on the right side of copywrite laws?

photochemsyn 3y ago

This post is a list of things to avoid doing, but it could benefit from an example of acceptable examples. It's funny how the language around this kind of thing has grown more convoluted since 'whitelist' and 'blacklist' have been removed from the language, so instead we have 'dark pattern' which, on similar grounds, could inspire another call for language censorship. Fundamentally, it's just easier to check patterns against an allowed list than against a banned list, because if the pattern is in the acceptable set, you're done, but just because it's not found in the unacceptable set, doesn't mean it's not deceptive.

remus 3y ago
I find the various regulators tend to set a good example. e.g. the ICO in the UK https://ico.org.uk/ https://ico.org.uk/

hk__2 3y ago

A "nice" thing about these banners is that 80% of the websites I visit use one of the 2-3 big providers of cookie banners, so once you’re used to them you can quickly reject all cookies in 2 seconds thanks to muscle memory.

kimi 3y ago

Whatever the reason may be, and even in the best of cases without dark patterns, the fact that every freakin' site requires a click (positive consent) it simply idiotic.

kylecazar 3y ago

Another: when the controls are embedded within the privacy policy. I think cookiebot lets it's customers do this.

wpm 3y ago

Tracking cookie regulation should have defaulted to "Users must opt in" rather than opt out. Opt out will always lead to dark patterns and manipulation like this (try to cancel most "free trials" or subscriptions!). And why wasn't it? Because "No one would ever opt-in!" Yeah. Exactly. Leave us the fuck alone.

MallocVoidstar 3y ago
GDPR requires consent to be opt-in. Most companies ignore this.

jraph 3y ago

One not listed that is a mix of "5. No ‘Reject’ Button" and "10. Deceptive Button Contrast" is a big "Accept" button at the bottom, well in sight, and a decline/refuse grey link at the top that you notice if you look somewhat hard. I've been seeing it more and more lately.

AndrewStephens 3y ago

When I am king of the world all cookie banners will have standardized language: "This site uses cookies if you are logged on. But even if you aren't logged on, we share your browsing details with 6 other companies from around the world. And they sell your details onto other companies and possibly governments. We don't know. But we get $0.0003 for it, so we really want you to say yes to the following question. Do you consent?"

dale_glass 3y ago
Just 6? Before this got reigned in a bit, I've once encountered a pop-up that required me to manually opt-out out of more than a hundred trackers, one by one.
ckastner 3y ago
> This site uses cookies if you are logged on. But even if you aren't logged on, we share your browsing details with 6 other companies from around the world. That's one of the things the GDPR was created for. If your data is being shared, you must be informed of with whom it is being shared, and for what purpose. And if the only reason the data is being shared is so that you can earn $0.00003 for it, rather than being necessary in order for you to provide the service, than you probably need consent anyway. And at the minimum, you must offers users the option to object to that processing.
karaterobot 3y ago
When I'm king (that's right, I'm planning a coup!) I will make the browser manufacturers handle this with a standard dialog the site owners can only customize in limited ways. Users will be able to express general preferences and they will be respected (i.e. I can choose to opt in or out of marketing-related cookies in my browser settings, rather than on a per-site basis).
TheCoelacanth 3y ago
Why so unambitious? When I'm king, you will have to assume lack of consent without asking. If users want to be tracked they can opt-in by emailing trackme@<your domain>.

bigbacaloa 3y ago

Ethics has little importance in contemporary business activity.

tpoacher 3y ago

Sales people reading this: "What a marvellous list of great tips on tricks to use!"

jraph 3y ago
At least, people asked to implement them will be able to point at this page and say "No, we should not, because it is a well-known dark pattern and doing this would make us look bad which is not good for the business, and that's also not GDPR-friendly and conforming to the GDPR is the whole reason why we are implementing this consent banner in the first place so it makes no sense doing it. If we are doing it, we might as well not display this banner at all".

cerradokids 3y ago

These cookie banners are so bad. Bad idea, bad regulation, bad execution. The time wasted for all humans in the world dealing with such a bad idea is out of the charts. If I don't want to be tracked I will use an anonymous tab or configure my browser to not allow any cookies. The solution already existed. The people that care about it already knew it. The companies would come up with something better if there was a real problem, with people being worried about to the point of changing browser. Ayn Rand was right and still is. We live in the age of envy. Hatred of the good for being the good. Useless waste of time for all human beings to hurt a few big successful companies because of tiny, envious people with the excuse to protect some helpless citizens.

openplatypus 3y ago
> Bad idea, No, the idea is solid. > bad regulation, In parts, you are right. >bad execution. Agreed. > The people that care about it already knew it. Sadly, it is not so simple. There was and still is a group of people, “The people who did not know it, but would care if they did”. > The companies would come up with something better if there was a real problem Company, for the better or the worse, is usually oriented towards benefits of shareholders, not users, customers nor societies. Don't get me wrong, there are companies that are not evil. But how do we know which are? Luckily, we have laws that prevent escalation beyond certain norms and protect those, who are not shareholders.

westurner 3y ago

"fraudulent redefinition of consent" Unconscionability: https://en.wikipedia.org/wiki/Unconscionability https://en.wikipedia.org/wiki/Unconscionability : > Unconscionability (sometimes known as unconscionable dealing/conduct in Australia) is a doctrine in contract law that describes terms that are so extremely unjust, or overwhelmingly one-sided in favor of the party who has the superior bargaining power, that they are contrary to good conscience. Typically, an unconscionable contract is held to be unenforceable because no reasonable or informed person would otherwise agree to it. The perpetrator of the conduct is not allowed to benefit, because the consideration offered is lacking, or is so obviously inadequate, that to enforce the contract would be unfair to the party seeking to escape the contract. Statute of frauds: https://en.wikipedia.org/wiki/Statute_of_frauds https://en.wikipedia.org/wiki/Statute_of_frauds : > A statute of frauds is a form of statute requiring that certain kinds of contracts be memorialized in writing, signed by the party against whom they are to be enforced, with sufficient content to evidence the contract. [1][2] […] > Raising the defense: A defendant in a contract case who wants to use the statute of frauds as a defense must raise it as an affirmative defense in a timely manner. [7] The burden of proving that a written contract exists comes into play only when a statute of frauds defense is raised by the defendant.

westurner 3y ago
Statute of frauds > United States > Uniform Commercial Code: https://en.m.wikipedia.org/wiki/Statute_of_frauds#Uniform_Commercial_Code https://en.m.wikipedia.org/wiki/Statute_of_frauds#Uniform_Co... : > Uniform Commercial Code: In addition to general statutes of frauds, under Article 2 of the Uniform Commercial Code (UCC), every state except Louisiana has adopted an additional statute of frauds that relates to the sale of goods. Pursuant to the UCC, contracts for the sale of goods where the price equals $500 or more fall under the statute of frauds, with the exceptions for professional merchants performing their normal business transactions, and for any custom-made items designed for one specific buyer. [42] IIUC, that means that if the USD amount of a contract for future performance is over $500 the court would regard a statute of frauds argument as just cause for dismissal? Or just goods?

handity 3y ago

"Consent requests" will never work. Until all web browsers present identical fingerprints and reveal no identifying data about the user, tracking will take place, whether laws mandate consent or not. Opt-in, opt-out, none of it matters as long as we're browsing the internet with our unique identities on full display to every site we visit. Thinking that the solution is to ask companies nicely to please not use that information is delusional.

yafbum 3y ago

Let's not forget another great one: "accept or subscribe", although that one is somehow sanctioned by the EU. Subscription-based freemium services are apparently ok to ask their users to either accept tracking or pay money. Many of the folks doing this are news services with great local political power. Coincidence?

IYasha 3y ago

I really WANT to read this article, but... https://i.postimg.cc/C1mZ6VLP/Screenshot-20230427-192121.png https://i.postimg.cc/C1mZ6VLP/Screenshot-20230427-192121.png Is it just my Linux, or the site is THAT bad?