HackerPapers

arXiv:2001.02479cs.HC

Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence

Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, Lalana Kagal

Abstract

New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.

arXiv comments
13 pages, 3 figures. To appear in the Proceedings of CHI '20 CHI Conference on Human Factors in Computing Systems, April 25--30, 2020, Honolulu, HI, USA
Journal reference
DOI
doi:10.1145/3313831.3376321
Subjects
cs.HCHuman-Computer Interaction cs.CYComputers and Society

On Hacker News

Linked by 6 identifiable commenters in 6 comments across 3 threads, from Jul 2020 to Jun 2024. Found in 4 HN submissions from Jan 2020 to Jul 2020. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments3 threads

  1. Apple found in breach of EU competition rules 1 comment

    • Guess all of the companies doing that must have missed the memo, though I guess how dire the situation is was more or less known pretty early on: https://arxiv.org/abs/2001.02479

      KronisLVView on HNParent context

  2. Dark patterns after the GDPR: consent pop-ups and their influence 3 comments

    • This is the PDF: https://arxiv.org/pdf/2001.02479.pdf I couldn't understand how to find it on the linked site. Maybe the submission URL should be changed?

      K0nservView on HNParent context

    • This is just a regular journal page. Not surprised they're tracking their users. A better place to link would probably have been the arXiv: https://arxiv.org/abs/2001.02479v1.

      sandgiantView on HNParent context

    • The paper is paywalled. Is it freely available anywhere? edit arxiv's preprint: https://arxiv.org/pdf/2001.02479.pdf Also, off-topic: it's annoying that acm.org has now added a horizontal progress bar, similar to QuantaMagazine.org. I already know how far through the article I…

      MaxBarracloughView on HNParent context

  3. Only 9% of visitors give GDPR consent to be tracked 2 comments

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.