Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence (2001.02479v1)

Abstract: New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.

Analysis of Consent Management Platform Designs and Regulation Compliance Post-GDPR

The paper "Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence" provides an analytical investigation into the design and compliance of Consent Management Platforms (CMPs) post-GDPR regulation in the EU. This research primarily evaluates how prevalent CMP interface designs influence user consent behavior, potentially leading to inadequate compliance with GDPR standards.

The authors conducted their research in two distinct parts. First, they deployed a web scraper to collect data on the design elements of the top five CMPs used across 680 websites in the UK. Second, they executed a field experiment with 40 participants to quantify the impact of various design features on user consent decisions.

Scraping and Analyzing CMP Interface Elements

Utilizing their scraper, the researchers identified several persistent design issues. A major finding is that only 11.8% of CMPs meet their defined minimum compliance criteria based on European law. Many interfaces employed dark patterns to nudge users towards granting consent, contravening GDPR regulations intended to ensure freely given, specific, informed, and unambiguous consent.

Key observations include:

• A significant number (32.5%) of CMPs deployed implicit forms of consent, such as scrolling or continued site navigation, which do not comply with the requirement for explicit consent as per GDPR.
• A vast majority (87.4%) of CMPs lacked equally prominent "reject all" options alongside "accept all" choices, further complicating the user’s ability to refuse consent easily.
• More than half (56.2%) of the sites had pre-ticked optional purposes or vendor options, clearly contradicting the GDPR stipulation against pre-filled consent mechanisms.

Field Experiment on Consent Design Influence

The experimental aspect aimed to discern how design elements affect user consent behavior in practice. The results revealed notable trends:

• Notification style (barrier vs. banner) did not significantly impact the rate of consent, though banners were more often ignored.
• The lack of a "reject all" option on the first interaction page increased consent rates by 22-23 percentage points, indicating a substantial influence of button prominence on user decision-making.
• Including granular consent options directly on the first page decreased the probability of acceptance by 8-20 percentage points. This implies that presenting detailed choices upfront allows users to engage more critically with consent options.

Implications and Future Directions

The findings underscore the need for intensified regulatory enforcement and redesign strategies for CMPs to align with GDPR principles more effectively. Regulators might consider imposing stricter rules on CMP configurations to prohibit known non-compliant practices. Meanwhile, researchers and designers should explore alternative consent mechanisms, potentially leveraging browser settings or more integrated control systems, which cater to user preferences more respectfully and comprehensively.

Future work may explore scalable solutions for managing user consent across platforms and enhance transparency, potentially including AI-driven consent management agents. These agents could provide users with more articulate and personalized privacy management options, fostering a more balanced interaction between data privacy rights and digital service providers.

In conclusion, while the paper establishes a foundational understanding of CMP design issues and their legal compliance challenges, it also calls for a collaborative effort amongst policymakers, designers, and the academic community to refine consent mechanisms that are both user-friendly and legally sound.