Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affe...
| Main Authors: | , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
Association for Computing Machinery (ACM)
2021
|
| Online Access: | https://hdl.handle.net/1721.1/129999 |
| _version_ | 1826196660122812416 |
|---|---|
| author | Nouwens, Midas Liccardi, Ilaria Veale, Michael Karger, David R Kagal, Lalana |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Nouwens, Midas Liccardi, Ilaria Veale, Michael Karger, David R Kagal, Lalana |
| author_sort | Nouwens, Midas |
| collection | MIT |
| description | New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet our minimal requirements based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22-23 percentage points; and providing more granular controls on the first page decreases consent by 8-20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance. |
| first_indexed | 2024-09-23T10:33:05Z |
| format | Article |
| id | mit-1721.1/129999 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T10:33:05Z |
| publishDate | 2021 |
| publisher | Association for Computing Machinery (ACM) |
| record_format | dspace |
| spelling | mit-1721.1/1299992022-09-27T09:58:21Z Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence Nouwens, Midas Liccardi, Ilaria Veale, Michael Karger, David R Kagal, Lalana Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet our minimal requirements based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22-23 percentage points; and providing more granular controls on the first page decreases consent by 8-20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance. NSF (Award 1639994) 2021-02-24T21:03:49Z 2021-02-24T21:03:49Z 2020-04 2020-12-23T15:56:35Z Article http://purl.org/eprint/type/ConferencePaper 9781450367080 https://hdl.handle.net/1721.1/129999 Nouwens, Midas et al. "Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence." Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, April 2020, Honolulu, Hawaii, Association for Computing Machinery, April 2020. © 2020 ACM en http://dx.doi.org/10.1145/3313831.3376321 Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf Association for Computing Machinery (ACM) arXiv |
| spellingShingle | Nouwens, Midas Liccardi, Ilaria Veale, Michael Karger, David R Kagal, Lalana Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title | Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title_full | Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title_fullStr | Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title_full_unstemmed | Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title_short | Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence |
| title_sort | dark patterns after the gdpr scraping consent pop ups and demonstrating their influence |
| url | https://hdl.handle.net/1721.1/129999 |
| work_keys_str_mv | AT nouwensmidas darkpatternsafterthegdprscrapingconsentpopupsanddemonstratingtheirinfluence AT liccardiilaria darkpatternsafterthegdprscrapingconsentpopupsanddemonstratingtheirinfluence AT vealemichael darkpatternsafterthegdprscrapingconsentpopupsanddemonstratingtheirinfluence AT kargerdavidr darkpatternsafterthegdprscrapingconsentpopupsanddemonstratingtheirinfluence AT kagallalana darkpatternsafterthegdprscrapingconsentpopupsanddemonstratingtheirinfluence |