Regulating Dark Patterns; A Step to Fortify Consumer Autonomy?

An average consumer would have come across that red-blinking line saying, “hurry up! only few left” or downloaded at an app thinking it was free only to know later that the free version is expiring in seven days. In other words, in today's world every consumer would have fallen into the trap of dark patterns at least once. Hence, the dire need to protect user autonomy and consumer privacy paved way for the current guidelines.

What are dark patterns and how is it unfair?

Dark pattern is the blanket term defining manipulative techniques used to deceive consumers to take choices they would not have taken otherwise. According to the Guidelines, dark patterns are practices or designs that subvert or impair the consumer autonomy. The seemingly innocent nature of dark patterns often abuses consumer interests without even them knowing it, leaving them essentially remediless.

The Consumer Protection Act, 2019 (“CPA”) defines unfair trade practices, including manipulating consumers and exploiting consumers' interest. The Act upholds consumers' rights by prescribing a redressal mechanism against such unfair trade practices. In addition, the CCPA can inquire into violations of consumer rights or unfair trade practices, either suo moto or upon receiving a complaint. Section 18 (2) of the CPA empowers CCPA to issue necessary guidelines to prevent unfair trade practices. Hence, the regulation of dark patterns, which is a quintessential modern-day problem, is set in the background of unfair trade practices and the CCPA's effort to curb it.

The current Indian legal framework to curb dark patterns.

The guidelines set out a list of 13 dark patterns covering a multitude of avenues where consumer autonomy is compromised. It includes the practice of showing “False Urgency” where consumers' choice is forced due to the limited opportunity portrayed by the platform. “Basket Sneaking” is another defined dark pattern where additional items are added to the final check out bill without the consumer's consent. Manipulating consumers by inducing a sense of guilt or fear that compel them to make buying decisions is defined as “Confirm shaming”.

“Subscription trap” is a common dark pattern that includes complicated cancellation process complicated or mandating auto debit authorisations. “Drip Pricing” is another sweet trap where a product or service is advertised to be free initially while the continued usage would require in app-purchasing. “Nagging” is a dark pattern where the consumer is prompted again and again leaving the consumer with less choice.

Other dark patterns are “Forced action”, “Interface interference”, “Bait and switch” and “Disguised advertisements”. Notably, the Guidelines included three more dark patterns, “Trick questions”, “SaaS billing” and “Rouge malware”.

The Guidelines are applicable to all sellers, advertisers and platforms 'systematically' offering goods and services in India. It prohibits every person, including any platform, from engaging in dark patterns. It shall be noted that even foreign businesses that target Indian consumers for the sale of goods or services can be brought under the ambit of the guidelines. Consumers can report usage of dark patterns in the National Consumer Helpline or reach them on Whatsapp.

The Guidelines add to an existing legislative framework that protects different facets of consumer rights. The Consumer Protection Act, 2019 has a set of arching provisions that prohibits unfair trade practices through deception. The same is extended to e-commerce platforms, particularly by the Consumer Protection (E-Commerce) Rules, 2020.

Further, the CCPA introduced a more targeted approach to prevent misleading consumers with the Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022. The guideline particularly addressed the concern of “bait advertisements”. In addition, the Advertising Standards Council of India also set voluntary industry standards in the Guidelines for Online Deceptive Design Patterns in Advertising, 2023. It prevented common online deceptive practices such as disguised ads, bait and switch, drip pricing and false urgency.

Dark patterns and the privacy regime.

The use of dark patterns to mislead consumers implicitly violates an individual's free consent. Dark patterns are often used to collect vast amount of user data by seeking information from an individual that is unnecessary for a particular transaction. The collected data and users' profile are further shared to third parties. The consent for the same is sought by camouflaging it into the means of the transaction. Hence, the compromised consumer's decisional autonomy invokes the data protection regime.

India buckled up its data protection policies with the recent Digital Personal Data Protection Act, 2023. It established a clear stance that a user's free and unambiguous consent is required before processing their personal data. The user's consent shall be obtained only after providing a notice explaining the purpose for which the data is sought. Further, the user shall always be vested with the right to withdraw the consent as easily as it was given. The Data Fiduciary shall not in any way “hold hostage” the user's consent and shall use the data only for the purpose it was sought.

The Guidelines certainly take a step further to protect consumer privacy on internet. The product user interface designers shall now exercise extreme caution while drafting the users' consent requests. The guideline majorly impacts e-commerce platforms, online ticket booking websites and hotel reservation portals that use dark patterns in their routine marketing tactics.

Global stance on dark patterns

The threat posed by dark patterns are regulated by a combination of legislations on consumer and privacy rights across the world. In the USA, the California Consumer Privacy Rights Act, 2020 recognised dark patterns. Consent secured by the use of dark patterns is invalidated under this regime. Recently, the US Federal Trade Commission charged Amazon Inc. for tricking consumer to subscribe the 'Prime' version without explicit consent and leaving them with a cumbersome cancellation process.

The European Union adopted a slightly different approach by preventing dark patterns within the existing regulations without introducing a particular regulation for the same. The General Data Protection Regulation (GDPR) defines consent to be free, unambiguous, informed and specific. Hence, unfair means of obtaining the users' consent by means of dark pattern are ruled out. In addition to it, the Digital Services Act, the Digital Markets Act, and Unfair Commercial Practices Directive set out the legislative framework to curb the use of dark patterns.

The said jurisprudence is set out in the recent case of Meta Platforms Inc. v. Bundeskartellamt. It was held that users' explicit consent is essential for Meta to track their data. The users shall not face unreasonable setbacks or offered subpar services if data tracking consent is not given.

The Italian Data Protection Authority issued a resolution on 23^rd February, 2023 stating that using dark patterns shall amount to a breach of the GDPR. Subsequently, it fined a company, Ediscom for using misleading graphic patterns and deceiving procedure for submission. The fine stemmed from violation of certain provisions of the GDPR. The French Data Protection Act penalized deceptive practices and fined Apple Distribution International for including default settings to obtain consumer data without consent and making the changing process lengthy.

Can the guidelines be counterproductive?

While the regulation is widely accepted as a positive step, the Asia Internet Coalition expressed certain apprehensions. A self-regulatory framework was advocated over the current approach. It highlighted the dynamic nature of current online advertising strategies that demands a dynamic self-regulatory approach. The increasing set of compliances may raise the cost of advertising and in turn might not meet with the cost of the business. Hence, the current approach may impede the ease of doing business and stagnate India's growth of digital economy.

Additionally, there is potential overlap of multiple existing regulations on various facets of dark patterns that increase the burden on advertisers. Hence, an approach similar to the European Union where dark patterns are regulated within the existing framework would avoid any additional burden.

In addition, the definition of “platforms” in the regulation as according to Consumer Protection (E-Commerce) Rules 2020 also includes intermediaries. However, intermediaries are provided safe harbour protection under Section 70 of the IT Act which is not reflected in the current Guidelines. Such protection is provided for intermediaries as they are not expected to closely scrutinise the published content. The absence of such a carve out in the Guidelines would hamper the purpose of the existing protection.

Conclusion

The guidelines are certainly a welcome step from a consumer protection perspective. The subtle, yet mainstream use of dark patterns calls for a higher level of scrutiny for the same. By listing specific set of dark patterns, the guidelines not only made the stakeholders more accountable but also the consumers more vigilant. However, the CCPA shall exercise extreme caution in differentiating persuasive advertisements from manipulative ones. The thin line between the advertiser's creativity and the consumer's right must be carefully identified and delineated.