Dark Patterns

Die Hersteller von Computer- und Videospielen, die Publisher, sehen sich in den vergangenen Jahren immer häufiger Kritik hinsichtlich der in ihren Spielen implementierten Geschäftsmodellmuster ausgesetzt. Diese betreffen nicht immer nur das Spiel selbst, sondern gegebenenfalls auch Aspekte, die außerhalb des eigentlichen Spiels liegen, man denke etwa an Abonnements, die abgeschlossen werden müssen. Ein Beispiel für die wachsende Kritik an den Geschäftsmodellen ist das Spiel „Fortnite“ vom Publisher „Epic Games“. Dieses verfügt über eine Vielzahl von intelligent eingesetzten Modellen und setzt diese umfassend ein. Es sind in den USA und Kanada zahlreiche Klagen gegen den Publisher anhängig. Es zeigt sich daher, dass die Auseinandersetzung mit und die Betrachtung von Geschäftsmodellen in Computer- und Videospielen von hoher praktischer Relevanz als auch Aktualität sind.


INTRODUCTION TO DARK PATTERNS
Dark patterns is a term that refers to deceptive and manipulative features of a user interface ("UI") that push or nudge people into making choices that are not in their best interests.While concern about dark patterns is growing amongst European consumer and data protection regulators, there is still considerable uncertainty over when the use of dark patterns will cross the threshold from persuasive marketing technique to illegal practice.
As the e-commerce world has become more sophisticated, businesses have developed more and more innovative methods to influence consumer choices, culminating in a perception that there is a culture of "dark pattern" usage.Regulators in Europe typically take the view that consumers encountering dark patterns on retailer websites may end up, for example, purchasing items more quickly and with less consideration than intended, or entering into subscriptions and being unable to cancel them.Data protection regulators are concerned that dark patterns may coax users into inadvertently consenting to the processing of their personal data or accepting more privacy-intrusive settings than they otherwise might.
Despite being a major concern for European regulators, dark patterns did not start as a legal concept and as a result they are not clearly or consistently defined.For example, the newly enacted EU Digital Services Act (the "DSA") 2 refers to them as practices on the UI that "materially distort or impair, either 2 European Council Regulation No. 2022/2065, 2022 O.J (L 277/1) (Digital Services Act).
4 Proposal for European Council Regulation on harmonised rules on fair access to and use of data No. 2022/0047(COD), 2022 COM(2022) 68 final (Data Act Proposal).
12 Press Release, European Commission, Consumer protection: manipulative online practices found on 148 out of 399 online shops screened (Jan.30, 2023), (IP/23/418) https://ec.europa.eu/commission/presscorner/detail/en/ip_23_418.on purpose or in effect, the ability of recipients of the service to make autonomous and informed choices or decisions." 3Similarly the EU's proposal for the Data Act 4 views dark patterns as "design techniques that push or deceive consumers into decisions that have negative consequences for them." 5 In subtle contrast, the guidelines of the European Data Protection Board (the "EDPB") on dark patterns in social media platform interfaces 6 consider dark patterns themselves to be a form of UI or user experience 7 and deem the decisions that users are pushed into regarding their personal data to be "unintended, unwilling and potentially harmful." 8Adding further uncertainty are the multiple typologies of dark pattern and variations in their names.Recently, the UK's Consumer and Markets Authority (the "CMA") flagged 21 potentially harmful forms of "Online Choice Architecture" (which is the term the CMA and Dutch regulator 9 use for dark patterns) practice, divided into three categories; those affecting choice structure (the design and presentation of options), choice information (the content and framing of information provided), and choice pressure (through indirect influence of choices). 10It has pinpointed the dark patterns it considers "almost always harmful" as "choice overload and decoys," "sensory manipulation," "sludge," "dark nudge," "forced outcomes," "drip pricing," "complex language," and "information overload." 11 January this year the European Commission announced the results of a sweep by the Consumer Protection Cooperation (the "CPC") of 399 retail websites which showed that nearly 40 percent were using "manipulative online practices to exploit consumer vulnerabilities or trick them." 12The sweep focused on the following dark patterns: fake countdown timers; web interfaces designed to lead consumers to purchases, subscriptions or other choices; and hidden information.
© 2023 Competition Policy International ® All Rights Reserved Our review of the different typologies and naming conventions suggests that while there is a lack of consensus about the names of the different dark patterns themselves, dark patterns can broadly be broken down into nine themes: 1. Pressure -repeatedly being asked to act or confronted with (alleged) social norms or scarcity of goods.2. Force -users are (de facto) forced to take action or acquiesce to do something.3. Obstacles -users face various obstacles to dissuade them from taking certain actions.4. Sneaking -additional purchases or goods or services are imposed on users.5. Deception and misdirection -the UI is created to distract from relevant information or to frustrate the usual expectations of the UI design.6. Overloading -users are faced with an avalanche of requests, information, options or possibilities in order to prompt them to make certain choices.7. Hindering -the obstruction or blocking of users from becoming informed or being able to make certain choices.8. Fickle -UI design that is inconsistent or not clear, making it hard for the user to navigate to make the choices they want to make.9. Left in the dark -UI designed to hide information or choices.
We consider that individual dark patterns can then be categorized within these themes.For example, confirm-shaming (where the UI attempts to make the user feel guilty for selecting their preferred option) and limited stock notifications sit within "Pressure.""Roach motels" (subscription traps with numerous barriers to cancel, making cancellation significantly harder than signing up) would come under "Obstacles." Currently "roach motels," pre-selection of advantageous choices and false timers seem to be drawing particular attention in Europe.

REGULATION OF DARK PATTERNS
The concept of reducing friction and optimizing UI design has been around for many years.Even the idea that consumers might be "nudged" into certain choices is not new.Consumer protection and data protection law have always applied to UI design as much as to other aspects of businesses' interactions with consumers.However, it is only recently that European regulators and legislators have used the term "dark patterns" and specifically called out how consumer protection and data protection law should regulate these practices.
Increasingly dark patterns are explicitly mentioned and expressly outlawed in new and proposed legislation, such as in the DSA. 13 Further, the EU's public consultation as part of the Fitness Check of EU consumer law on digital fairness 14 clearly had dark patterns in mind when it probed respondents on whether: they had experienced websites designed to pressure them to purchase and make them uncertain of their rights and obligations; they had encountered difficulties cancelling subscriptions; and they would agree that stronger protections against "digital practices that unfairly influence consumer decision-making" 15 were required.

A. Consumer Law
The use of dark patterns can contravene the Unfair Commercial Practices Directive 16 (the "UCPD") at an EU level, which is mirrored in the UK by Consumer Protection from Unfair Trading Regulations 2008 ("CPUT"). 17These prohibit unfair commercial practices, including practices that amount to misleading actions or omissions, that are aggressive or that use harassment, coercion or undue influence.A commercial practice is also unfair under this legislation if it is "contrary to the requirements of professional diligence" 18 and "it materially distorts or is likely to materially distort the economic behavior with regard to the product of the average consumer whom it reaches or to whom it is addressed, or of the average member of the group when a commercial practice is directed to a particular group of consumers." 19Guidance on the UCPD from the European Commission 20 expressly states that it can be utilized to challenge the fairness of the application of dark patterns in business-to-consumer commercial relationships and suggests, for example, that confirm-shaming could amount to an "aggressive practice using undue influence to impair the consumer's decision-making." 21It also sets out the practices often recognized as dark patterns that are caught by the list of so-called "blacklisted offences"commercial practices that are always considered unfair under the UCPD (which is also replicated in CPUT).
The "blacklisted offences" under the UCPD and CPUT include, for example, "[f]alsely stating that a product will only be available for a very limited time, or that it will only be available on particular terms for a very limited time, in order to elicit an immediate decision and deprive consumers of sufficient opportunity or time to make an informed choice." 22It is easy to see how the use of countdown timers, a "Pressure" dark pattern, could fit within this if they are counting down to the expiry of a sale or deal which will not in fact end when the timer ends and are therefore false.This is endorsed by the European Commission's guidance on the UCPD 23 and the CMA also took this view when it announced at the end of 2022 that it would be examining whether the mattress-in-abox company, Emma Sleep, had misled consumers by using countdown timers that implied a discount would end, when this was potentially not the case. 24This investigation by the CMA forms part of its Online Choice Architecture program to tackle potentially harmful online selling practices.
Even if the practices targeted are not always expressly referred to as "dark patterns," there has been significant enforcement across Europe under consumer protection legislation.An early example of regulation of dark patterns under the UCPD is the Italian Competition Authority's ("AGCM") decision to fine two online travel operators for using practices that hindered consumers' ability to view all of the relevant information on additional costs attached to the purchase. 25It also found the automatic pre-selection of an optional insurance policy misled consumers into believing this was compulsory.The AGCM in general has been active in its use of consumer law to regulate dark patterns.More recently, the Norwegian Consumer Council has written to various platform hosts alleging the use of dark patterns in their interfaces.
Even if the practices targeted are not always expressly referred to as "dark patterns," there has been significant enforcement across Europe under consumer protection legislation Further, The CPC's sweep of dark patterns in relation to ecommerce and the call for European consumer protection regulators to contact e-commerce websites which have been identified as featuring dark patterns 26 may very well lead to enforcement.The CMA also announced that the Emma Sleep investigation would be the first of its investigations in relation to Online Choice Architecture 27 and therefore further action is anticipated in the UK in the coming months.

B. Data Protection Law
The "fair processing" principle in Article 5(1)(a) of the General Data Protection Regulation ("GDPR") 28 requires that data be © 2023 Competition Policy International ® All Rights Reserved processed "fairly and in a transparent manner." 29The EDPB has also stated that "fairness is an overarching principle which requires that personal data shall not be processed in a way that is unjustifiably detrimental, discriminatory, unexpected or misleading to the data subject." 30Arguably, therefore, if a UI uses dark patterns to facilitate insufficient or misleading information in respect of the processing of data for the user, this will necessarily amount to unfair processing.Additionally, where consent is the lawful basis for the processing of personal data, the GDPR requires this to be "given freely, informed and unambiguous" 31 .Dark patterns employed to push users to agree to give away more personal data than necessary (such as nagging and continuous prompting -forms of "Pressure" dark pattern) may render such consent invalid.
Article 25 of the GDPR additionally imposes an obligation on data controllers to practice data protection by design and default. 32EDPB guidance explains that the fairness elements of design and default include an absence of deception, specifically "[d]ata processing information and options should be provided in an objective and neutral way, avoiding any deceptive or manipulative language or design." 33It is again likely that using dark patterns, such as a false hierarchy (for example a green "reject" button and red "accept" button) or confirmshaming, could undermine the Article 25 requirements.
Enforcement action has already been taken under the GDPR to regulate dark patterns.For example, the Court of Justice of the European Union held that the automatic pre-selection of checkboxes, a form of "Obstacles" dark pattern, by an online lottery service did not provide valid consent for the use of cookies or similar technologies. 34This practice was held to be in breach of the GDPR as consent was not freely given.
Recent guidance by the EDPB on dark patterns in social media platform interfaces 35 is another example of the increased attention in this area on the part of regulators, and sheds some further light on the relationship between use of dark patterns and GDPR compliance.It calls for national regulators to sanction dark patterns that breach the GDPR and provides examples of best practice for various parts of the social media interface in contrast to illustrations of potentially illegal use of dark patterns.While the guidelines focus on social media platforms -a perennial target of European data protection regulators -its principles would generally seem to be equally applicable to other online UIs.

WHEN ARE DARK PATTERNS UNLAWFUL? -A LACK OF CERTAINTY UNDER THE LAW
As the concept crystalizes, it is becoming easier to understand which features of the UI raise concerns and might amount to a dark pattern.However, what remains less clear is exactly when a dark pattern will cross the line into being unlawful.There is now no doubt that dark patterns can amount to a breach of consumer and data protection laws, but the grey area over when exactly this threshold is crossed is problematic for businesses seeking to achieve compliance.

A. Principles-Based Laws and an Absence of Clear Guidance and Case Law
The issue legally is that Europe's principles-based consumer protection and privacy laws are only lightly tested in relation to dark patterns.The principal sources of dark patterns regulation, the UCPD, CPUT and the GDPR, have a wealth of case law and guidance in relation to unfair commercial practices and what is required for data protection respectively but these are largely not directly relevant to dark patterns or apply only by analogy.
There is some guidance, for example, as discussed above the EDPB released guidelines on dark patterns in social media platform interfaces. 36The European Commission's guidance on the UCPD 37 also makes express reference to dark patterns and the CMA has published research (but not guidance) into Online Choice Architecture. 38The European Commission's guidance notes the ability of businesses to use data to create persuasive practices that are personalized to the consumer and to continually adjust such practices to improve their effectiveness, observing that often such practices are employed without consumers' full knowledge. 39It also raises concerns about A/B testing.However, this is all expressed in terms of generalities and concerns generally about "opaqueness," 40 which in practice means that it is still hard to apply in a way that allows businesses to distinguish persuasive advertising or sales techniques from potentially manipulative commercial practices that are unfair under consumer law.
To illustrate the issues, take the example of an offer presented to a consumer attempting to cancel their subscription that provides 50 percent off the next 3 months if they choose to abandon cancellation.There are relatively strong arguments to support that this could be a dark pattern.It could be caught under the headings of Obstacles (for example as part of a roach motel) or Hindering (by prolonging the cancellation process by questioning the user's choice).There is, however, very little guidance or case law that provides a steer on whether this dark pattern (if it is such) is also contrary to the UCPD or CPUT or any other laws.There is nothing in the law that prescribes how cancellation of a subscription is to be achieved.

There is some guidance, for example, as discussed above the EDPB released guidelines on dark patterns in social media platform interfaces
Certainly, preventing a consumer from exercising their legal rights to cancel a contract is highly problematic but what about presenting the consumer with an offer to keep the subscription at a discount?This is clearly a barrier to cancellation but is it a sufficient barrier such that it is tantamount to preventing the consumer from exercising their rights of cancellation under the contract or their statutory right of withdrawal?Much will ultimately depend on how it is presented to the consumer and how easy it is in practice for that consumer to navigate around the offer and finally cancel their contract.The offer to keep the subscription might also be an unfair commercial practice or misleading under the UCPD or CPUT, but this is likely to hinge on how comparatively prominent the option to cancel is and how easy it would be for the consumer to exercise their cancellation rights.While some of the commentary in this area creates the impression that symmetry between the ease of sign up and cancellation is required in relation to subscriptions, there is at the time of writing no obvious basis for this in law.
Undoubtedly, case law and guidance will develop over time, but in the meantime, businesses are faced with difficult decisions in weighing up the risk of enforcement action, which may have the potential to cause serious reputational damage alongside potential fines and/or criminal law sanctions, against the advantages of designing their platforms so as to optimize sales and the communication of offers and deals to customers.

B. Incoming Legislation Doesn't Quite Add Enough Color
The DSA, which will apply to online platforms, will be the first piece of EU legislation that expressly bans dark patterns.However, the ban will only operate where existing laws on unfair commercial practices and the GDPR do not apply.It gives non-exhaustive examples of specific practices, such as subscription traps and giving more prominence to certain choices when asking a recipient of the service for a decision. 41The DSA's explicit ban on dark patterns, on its face, should close a loop as it catches any use of dark patterns that is not in breach of the UCPD and the GDPR.However, two key challenges exist.The first is establishing whether the dark patterns in question are caught by one or other of these pieces of legislation.The second is applying the DSA's test of something that "deceives, manipulates or otherwise materially distorts a user's ability to make an informed decision." 42This will be challenging without further guidance on how this is expected to be applied in practice.The DSA threatens © 2023 Competition Policy International ® All Rights Reserved large fines 43 which are surely intended to incentivize compliance, yet their deterrent effects may be hindered by a lack of clarity in respect of the DSA's jurisdiction over dark patterns.
That said, although we do not anticipate much actual enforcement under the DSA, it is significant that the EU considers dark patterns to be worthy of an express prohibition and this perhaps sets the tone for future enforcement and bans under the UCPD, CPUT or the GDPR given that the European Commission's stated view that these pieces of legislation are capable of capturing most dark patterns. 44e DSA is not the only place where we are seeing proposals to outlaw dark patterns in Europe.The EU's recently presented Data Act proposal 45 explicitly prohibits dark patterns.The most recent draft accepted by the Parliament applies to the manufacturers of connected products and providers of related services which are placed on the market in the EU and governs rights and obligations regarding the data generated by the use of the products and services.It sets out that data holders or third parties who receive the data of the user of the products or recipient of services from a data holder at the request of that user, are not to subvert or impair the autonomy of users to "coerce, deceive or manipulate" them in any way and therefore they should not use dark patterns in the design of the digital interface. 46The Data Act proposal also states "[c]ommon and legitimate commercial practices that are in compliance with Union law should not in themselves be regarded as constituting dark patterns." 47Also proposed by the European Commission is the Artificial Intelligence (AI) Act 48 which incorporates what may be read as a limited prohibition on certain kinds of dark patterns.Under this draft legislation, "Prohibited Artificial Intelligence Practices" include AI systems that "deploy subliminal techniques" 49 or that exploit the vulnerabilities of a "specific group of persons due to their age, physical or mental disability" 50 with the intention to materially distort their behavior and in a manner that causes or 43 Ibid.at Article 53.44 https://op.europa.eu/en/publication-detail/-/publication/606365bc-d58b-11ec-a95f-01aa75ed71a1/language-en/format-PDF/source-257599418.52 Department for Business, Energy and Industrial Strategy, Consultation outcome -Reforming competition and consumer policy: government response (CP 656, April 20, 2022) https://www.gov.uk/government/consultations/reforming-competition-and-consumer-policy/outcome/reforming-competition-and-consumer-policy-government-response.
is likely to cause physical or psychological harm to that person or another. 51This prohibition appears to have a relatively high threshold in order to be engaged as a result of the requirement that the distortion of behavior must be intended and "material," and the need for harm to be "physical or psychological harm."The UK has also looked at this issue as part of the UK consumer law refresh 52 which, at the time of writing, is still in progress and the draft Digital Markets Competition and Consumer Bill which is expected imminently.The UK government's approach appears to be that they will mirror the EU by commissioning further research and are contemplating an express ban -although this is not expected in the Bill.
In summary, dark patterns are high on the legislative and enforcement agenda in Europe.However, the law continues to be difficult to apply in the absence of practical guidance or a body of case law.It is also likely that deviations in the application of these laws will emerge across Europe as regulators attempt to utilize them to regulate dark patterns, which could result in certain forms of dark pattern being regarded as nothing more than a marketing technique in one jurisdiction but unlawful in another.

CONCLUSION
Recent activity such as the CPC sweep, the wave of letters from the Norwegian Consumer Council and the CMA's Online Choice Architecture Programme confirm that dark patterns are attracting considerable regulatory attention in Europe.No doubt enforcement will result and with this will come with publicized decisions that provide some clarity on where the legal lines are drawn.As new legislation outlawing dark patterns is introduced we can hope to see accompanying guidance or test cases that offer better insight into what this means for businesses who operate online interfaces and want to market effectively, but compliantly, to their customers.
The DSA is not the only place where we are seeing proposals to outlaw dark patterns in Europe