The FTC’s interest in dark patterns highlights evolving debate over online consent

The Federal Trade Commission (FTC) last week held a workshop where researchers, academics, consumer advocates, and lawmakers discussed the deceptive design practices known as dark patterns and explored regulatory strategies for protecting consumers from them. Speakers warned some of these practices may violate consumer protection laws, and Sen. Mark Warner, who has cosponsored dark pattern legislation, said he believed the FTC possessed authority to prohibit certain types of dark patterns.

Dark patterns are click behaviors, choice architectures, and design cues intended to manipulate users into making choices that benefit platforms. These can present themselves in the form of intentionally obscure unsubscribe buttons, countdown checkout timers that manufacture false urgency, unwanted products appearing unsolicitedly in user’s shopping carts, and pop-ups that use subtle coercion to pressure users from leaving the platform.

The use of dark patterns is fairly common online, posing a problem that states are trying to address in the absence of federal law. In 2019, Princeton researchers scanned 11,000 shopping websites and found instances of at least 15 different types of dark patterns on 11% of the scanned sites. In March, new regulations were clarified under the California Consumer Privacy Act (CCPA) that prohibit developers from using dark patterns to influence users. Legislation addressing dark patterns was also included in Washington state’s failed privacy bill. Without a federal privacy standard, FTC regulations could act as check on dark patterns above the state level.

The FTC’s interest in dark patterns suggests regulators may soon confront broader questions about the meaning of informed consent. Dark patterns are inseparable from the issue of informed consent—a user’s ability to agree to terms of services based on transparent, easily understandable explanations. While the definition and standard for determining consent are hotly contested, consent was a key component of both the GDPR and the CCPA. In practice, however, consent requirements have had mixed results. During the FTC workshop, Jennifer King, a privacy and data fellow at Stanford, aptly characterized the current mechanisms for acquiring consent online as a “complete failure.”

If Congress follows the FTC’s lead and addresses dark patterns as part of a possible federal data privacy standard, that decision will be met with industry opposition. At least one ad network, the Network Advertising Initiative, is reportedly already gearing up to fight off any legislative attempts to address dark patterns the practice, per Digiday. Similar to data privacy laws more generally, a state-level patchwork approach to dark pattern regulation may be more susceptible to industry lobbying than federal efforts.