[Paper Review] Circumvention by design -- dark patterns in cookie consents for online news outlets

Than Htut Soe, Oda Elise Nordberg+2 more|arXiv (Cornell University)|Jun 24, 2020

Privacy, Security, and Data Protection4 citations

TL;DR

This study manually analyzes 300 cookie consent notices from online news outlets in Scandinavia and English-speaking countries, revealing that 297 (99%) employ dark patterns—deceptive UI designs that circumvent GDPR's intent by manipulating user choices. The paper identifies eight distinct dark pattern types in consent interfaces, emphasizing the need for regulatory oversight of UI design to protect user autonomy in data consent decisions.

ABSTRACT

To ensure that users of online services understand what data are collected and how they are used in algorithmic decision-making, the European Union's General Data Protection Regulation (GDPR) specifies informed consent as a minimal requirement. For online news outlets consent is commonly elicited through interface design elements in the form of a pop-up. We have manually analyzed 300 data collection consent notices from news outlets that are built to ensure compliance with GDPR. The analysis uncovered a variety of strategies or dark patterns that circumvent the intent of GDPR by design. We further study the presence and variety of these dark patterns in these "cookie consents" and use our observations to specify the concept of dark pattern in the context of consent elicitation.

Motivation & Objective

• To investigate how online news outlets implement cookie consent notices in compliance with GDPR.
• To identify and categorize dark patterns used in these consent interfaces that undermine informed user consent.
• To examine whether ethical design principles are upheld in consent mechanisms, especially given news outlets' societal role in promoting truth and trust.
• To argue that UI design must be regulated alongside data processing to ensure genuine user control under privacy laws.
• To contribute a manually curated dataset and refined taxonomy of dark patterns specific to consent elicitation in news websites.

Proposed method

• Conducted a manual, qualitative analysis of 300 cookie consent notices from Scandinavian and English-language news outlets.
• Used Gray et al. 's (2018) framework of dark patterns as a theoretical lens to identify deceptive design strategies.
• Categorized observed patterns based on behavioral manipulation techniques such as forced continuity, privacy Zuckers, and disguised ads.
• Evaluated design complexity, including effort required to reject consent, textual clarity, and accessibility of opt-out mechanisms.
• Collected data via browser-based inspection on laptops, simulating first-time user interaction.
• Proposed a refined definition of dark patterns in consent contexts, emphasizing detectable, design-specific features for future automated detection.

Experimental results

Research questions

• RQ1 To what extent do online news outlets use dark patterns in their cookie consent interfaces despite GDPR requirements?
• RQ2 Which specific types of dark patterns are most prevalent in consent notices across news websites?
• RQ3 How do design choices in consent interfaces affect the user's ability to meaningfully opt out of data collection?
• RQ4 In what ways do the design features of consent notices undermine the principle of informed and freely given consent as mandated by GDPR?
• RQ5 Can a standardized, machine-readable taxonomy of dark patterns be developed from manually identified examples for regulatory and technical use?

Key findings

• Out of 300 analyzed cookie consent notices, 297 (99%) employed at least one dark pattern, indicating near-universal use of manipulative UI design.
• The most prevalent dark patterns included forced continuity (e.g., requiring users to click 'Accept' to proceed), privacy Zuckers (e.g., misleading labels like 'I understand' instead of 'Decline' or 'Reject' ), and disguised ads (e.g., making the 'Accept' button more prominent than 'Reject').
• Only 3 out of 300 consent notices allowed users to easily deny consent without significant interaction effort, highlighting systemic design barriers to opting out.
• Textual descriptions of cookie purposes and categories were often unclear or absent, reducing transparency and informed decision-making.
• The study found no evidence of consistent or accessible mechanisms for users to later change their consent preferences, undermining long-term user control.
• The authors propose a refined, actionable definition of dark patterns in consent contexts, with characterizing features that are both clearly identifiable and suitable for automated detection in future work.