3 ms·

Part of the problem is that most of their end users don't care. I'm not saying that they shouldn't care, or that there aren't people (like you and me) who care.

Part of the problem is that most of their end users don't care. I'm not saying that they shouldn't care, or that there aren't people (like you and me) who care. But when your business model, for logical reasons, tries to please the most amount of people without trying to please everyone then there is a disincentive to prioritize things like privacy. The cookie banners that came about after GDPR didn't help the culture around privacy and security. All they did was piss off the great masses of end users to the point where some browsers (ex: Brave) now have specialized pop-up blockers just to stop annoying users with something that was [ironically] put in place to safeguard the privacy and rights of the masses who didn't actually ask for that. When I talk about privacy and security, most people tell me to my face that they prefer convenience and don't care at all, one tiny little bit, about their data or privacy. And so now we're starting to regulate and consider "digital rights", using the strong arm of the law to force companies to care. I'm not saying that we shouldn't. I have very low trust when it comes to tech companies and online services, particularly in the field of data security and PII. I wish that companies would be held liable for data breaches. But my point is that a huge part of the problem is that there seems to be a major disconnect between what the government is trying to force companies to do (a government that is supposed represent the will of the people) and what the actual people (customers) are telling the companies that they want. Changing culture is a near impossible feat, but I think this is more of a cultural problem than a lack of legislation problem.

deleted 4y ago
[deleted]
yafbum 4y ago
User indifference is not the problem behind dark patterns. Some of these UIs are clearly designed to discourage people who do care, by making non-essential cookie rejection more expensive in terms of user time (one more click, obfuscation, hiding behind a "manage settings" button, walls of legalese...). I'm pretty sure there are orders of magnitude fewer users who want to manage detailed cookie settings at a super granular level, but somehow, as a user who would rather just reject all non-essential cookies, I see a lot of "cookie settings management UI" that I have to "save", when all I could've done with is a "reject all" button. This isn't a user problem.
- gspencley 4y ago
  I've seen how these types of things play out in companies, though. I'm proud to say that I once did refuse to implement something that I thought was unethical. But I can also understand why companies would want to actively discourage users who care and it's not always a matter of being malicious. It's [usually] a matter of: - The users affected are in the minority - Regulations are forcing us to do something to be compliant - The ROI of doing it "right" is extremely low - So what can we do to be compliant while getting that tiny minority of users to voluntarily GTFO because genuinely don't want to have to worry about such a small niche market?
  - yafbum 4y ago
    The ROI of doing it right is negative; that's an assumed cost of most regulations. But it's not negative because it's more complex to build it right - it's negative because monetization is that much lower even for that so called "tiny minority" that it will materially affect revenue. In most cases it is much simpler to add a one-click reject-all option than to pretend there are users interested in granular choices that present long lists of toggle controls and put that behind a "Manage cookie settings" button. So the "I" of "ROI of doing it right" is lower than the "I" for doing it in a shady way. I completely understand the companies' motives. But to the OP, I disagree that these UIs are because users don't care. It's probably because companies care a great deal more about their profit. Which they should! That's what companies do and that's even why they exist. But let's not pretend users not caring is the problem.
  - TheCoelacanth 4y ago
    What you are describing is 100% malicious. These companies are intentionally ignoring their legal obligations for their own benefit and to their users' detriment. Obviously people making the decision are going to try to come up with a justification to make themselves feel okay about doing it, though.
bee_rider 4y ago
How often do you talk to people about privacy? The general feeling I have, and that I’ve gotten from other people, is that they’ve basically given up, not because they don’t really care, but because it is a totally hopeless fight. The options are: have your privacy violated, or use some tiny boutique service that isn’t hitting any economies of scale.
- gspencley 4y ago
  These types of things need to be studied with an appropriate methodology, otherwise we're just sharing anecdotes and opinions. I will share with you one specific anecdote. One of the people I admire most in this world, who taught me everything that I know about software engineering, who - we both suspect - might be on the high-functioning autism spectrum and has the exact personality and knowledge profile typical of someone who cares. This person straight up told me that "convenience trumps privacy" for them. This is a concrete example of someone telling me that they don't care if companies prioritize privacy or not, they just love the convenience that modern tech offers them. So those types of experiences make me wonder. If someone who is in the industry and has the personality type typical of someone who usually cares more than most, if THEY don't care ... what does that say about the average every day person? Again, it's purely anecdotal. I would love for this type of stuff get researched properly at the academic level so that we can get answers. EDIT: Another anecdotal example is my mother. She has told me that she doesn't value or care about data / online privacy at all. That convenience matters most. Anecdotally, the only times I hear people complain are either tech nerds or on Joe Rogan's podcast. The people I talk to about this in every day situations tend to tell me that it's just not top of mind for them and if they had to sacrifice convenience to get more privacy they would prefer the convenience.

deleted 4y ago

[deleted]

yafbum 4y ago

User indifference is not the problem behind dark patterns. Some of these UIs are clearly designed to discourage people who do care, by making non-essential cookie rejection more expensive in terms of user time (one more click, obfuscation, hiding behind a "manage settings" button, walls of legalese...). I'm pretty sure there are orders of magnitude fewer users who want to manage detailed cookie settings at a super granular level, but somehow, as a user who would rather just reject all non-essential cookies, I see a lot of "cookie settings management UI" that I have to "save", when all I could've done with is a "reject all" button. This isn't a user problem.

gspencley 4y ago
I've seen how these types of things play out in companies, though. I'm proud to say that I once did refuse to implement something that I thought was unethical. But I can also understand why companies would want to actively discourage users who care and it's not always a matter of being malicious. It's [usually] a matter of: - The users affected are in the minority - Regulations are forcing us to do something to be compliant - The ROI of doing it "right" is extremely low - So what can we do to be compliant while getting that tiny minority of users to voluntarily GTFO because genuinely don't want to have to worry about such a small niche market?
- yafbum 4y ago
  The ROI of doing it right is negative; that's an assumed cost of most regulations. But it's not negative because it's more complex to build it right - it's negative because monetization is that much lower even for that so called "tiny minority" that it will materially affect revenue. In most cases it is much simpler to add a one-click reject-all option than to pretend there are users interested in granular choices that present long lists of toggle controls and put that behind a "Manage cookie settings" button. So the "I" of "ROI of doing it right" is lower than the "I" for doing it in a shady way. I completely understand the companies' motives. But to the OP, I disagree that these UIs are because users don't care. It's probably because companies care a great deal more about their profit. Which they should! That's what companies do and that's even why they exist. But let's not pretend users not caring is the problem.
- TheCoelacanth 4y ago
  What you are describing is 100% malicious. These companies are intentionally ignoring their legal obligations for their own benefit and to their users' detriment. Obviously people making the decision are going to try to come up with a justification to make themselves feel okay about doing it, though.

bee_rider 4y ago

How often do you talk to people about privacy? The general feeling I have, and that I’ve gotten from other people, is that they’ve basically given up, not because they don’t really care, but because it is a totally hopeless fight. The options are: have your privacy violated, or use some tiny boutique service that isn’t hitting any economies of scale.

gspencley 4y ago
These types of things need to be studied with an appropriate methodology, otherwise we're just sharing anecdotes and opinions. I will share with you one specific anecdote. One of the people I admire most in this world, who taught me everything that I know about software engineering, who - we both suspect - might be on the high-functioning autism spectrum and has the exact personality and knowledge profile typical of someone who cares. This person straight up told me that "convenience trumps privacy" for them. This is a concrete example of someone telling me that they don't care if companies prioritize privacy or not, they just love the convenience that modern tech offers them. So those types of experiences make me wonder. If someone who is in the industry and has the personality type typical of someone who usually cares more than most, if THEY don't care ... what does that say about the average every day person? Again, it's purely anecdotal. I would love for this type of stuff get researched properly at the academic level so that we can get answers. EDIT: Another anecdotal example is my mother. She has told me that she doesn't value or care about data / online privacy at all. That convenience matters most. Anecdotally, the only times I hear people complain are either tech nerds or on Joe Rogan's podcast. The people I talk to about this in every day situations tend to tell me that it's just not top of mind for them and if they had to sacrifice convenience to get more privacy they would prefer the convenience.