23 march 2023
“Dark Patterns” sounds like a Netflix series, doesn’t it? In fact, however, these are manipulation methods that we all encounter every day – in our non-digital lives, but especially online. Data protection expert Tobias Mielke from TÜVIT explains what “dark patterns” are all about and how you can protect yourself from them.
#explore: What are Dark Patterns?
Tobias Mielke: Dark patterns are certain techniques and methods that are used to influence the way people behave in specific circumstances: in other words, to manipulate them. You find these both in the digital and the analogue worlds: one example would be when fruit and vegetables are lit in a particular way in the supermarket to make them appear especially fresh and appetising. Or when expensive branded products are placed on the shelf at eye level, and the cheap ones hidden away down below.
#explore: How and in what form do the operators of websites and online shops use dark patterns to influence their customers?
Tobias Mielke: One example would be the use of confusing menus to deliberately make it difficult for users to cancel their subscriptions or delete a social media account. Dark patterns are also very often used with cookie banners: The button to “Allow all” is then highlighted in colour and in the typeface, while the button for “Reject all” blends into the background with its small, grey font or is even hidden away on a subpage. Website operators take a bet on the fact that you won’t bother negotiating multiple windows and will just click on “Allow all” instead. According to a study by the EU Commission, 97 percent of the most popular websites use such methods.
What is the point of strategies such as scarcity or confirm-shaming?
Confirm-shaming refers to methods of making users feel guilty so that they give their consent to something. In an online shop, for example, you might be asked to subscribe to the newsletter via a pop-up window, for which you will then be given a discount on the first order. But if you don’t want to do that, the reject button will have a text like: “No, I don’t want to save money. I’d rather pay the full price.” Scarcity is often something you find on hotel booking portals. We probably all know the pop-up which tells us that “there are only two rooms left”. Which often goes with the announcement that “20 people are looking at this hotel room right now”. This combination of a limited supply and lots of competition puts users under pressure to make decisions: the idea is to prevent you from thinking long and hard about your options or comparing offers. Whether the number of hotel rooms on any given site is actually limited is difficult to judge from the outside. Whatever the case, this actual or alleged scarcity is deliberately exploited by the providers as a booking incentive. The countdown which tells you how little is left of the discount period on promotional days or the special supermarket offers that are highlighted in bright red also fall into this category.
Zur Person
Tobias Mielke doubles as an appraiser and auditor for data protection and as an expert in management systems for information security and data protection at TÜViT.
What is the point of strategies such as scarcity or confirm-shaming?
Confirm-shaming refers to methods of making users feel guilty so that they give their consent to something. In an online shop, for example, you might be asked to subscribe to the newsletter via a pop-up window, for which you will then be given a discount on the first order. But if you don’t want to do that, the reject button will have a text like: “No, I don’t want to save money. I’d rather pay the full price.” Scarcity is often something you find on hotel booking portals. We probably all know the pop-up which tells us that “there are only two rooms left”. Which often goes with the announcement that “20 people are looking at this hotel room right now”. This combination of a limited supply and lots of competition puts users under pressure to make decisions: the idea is to prevent you from thinking long and hard about your options or comparing offers. Whether the number of hotel rooms on any given site is actually limited is difficult to judge from the outside. Whatever the case, this actual or alleged scarcity is deliberately exploited by the providers as a booking incentive. The countdown which tells you how little is left of the discount period on promotional days or the special supermarket offers that are highlighted in bright red also fall into this category.
Manipulation techniques: What does the law say?
All dark patterns are designed to help companies gain an advantage. But not all of them harm users to the same extent, says Tobias Mielke. In the event of data protection violations, such as cookie banners, the EU General Data Protection Regulation (GDPR) comes into play, as does the Telecommunications-Telemedia Data Protection Act (TTDSG) in Germany. Other dark patterns are now set to be banned by the Digital Services Act (DSA). This came into force at the end of 2022, and providers must comply with all the relevant obligations by 17 February 2024: in principle, for example, they must make it as easy for users to terminate their memberships as it is to register, and they mustn’t otherwise impair or hinder the users’ freedom of choice. According to Mielke, however, dark patterns might also be covered in Germany by the Act against Unfair Competition. In respect of the law, therefore, the picture is a mixed one. “It remains to be seen whether all cases of dark patterns will be covered by the current and future regulations – whether users are comprehensively protected – and also which law will be applicable in which case. This means that tests must always be carried out on a case-by-case basis or in the context of the process,” says the TÜVIT expert.
