California Privacy Protection Agency Issues Dark Pattern Enforcement Advisory
On September 4, the California Privacy Protection Agency issued an enforcement advisory regarding “choice architectures that have the substantial effect of subverting or impairing a consumer’s autonomy, decision-making, or choice” which are, in other words, considered “dark patterns” pursuant to the California Consumer Privacy Act (CCPA) and its implementing regulations. This advisory indicates that the CPPA is closely scrutinizing consents for dark patterns and will consider such consents invalid. If the agency determines consumer consent is invalid due to a dark pattern, it could lead to allegations that all processing activities on which that consent is based are unlawful and subject to civil penalties of up to $2,500 per violation, and up to $7,500 for willful violations.
In its advisory, the agency reminds businesses and service providers to “carefully review and asses their user interfaces,” including consent management platforms, to ensure that consumers are offered “symmetrical” choices and that such choices are conveyed using plain language. A symmetrical choice refers to the ability of a consumer to exercise a more “privacy-protective” choice as easily as they may exercise a less privacy-protective choice. Essentially, “dark patterns are about effect, not intent.”
Examples of equal vs. problematic choices are included in the advisory:
The advisory encourages businesses assessing their user interfaces or consent flows to ask:
- Is the language easy to read, in plain language, and free of legal jargon?
- Is the consumer’s path to the less privacy-protective choice longer or more difficult to reach than the more privacy protective choice?
- Is it more time-consuming for a consumer to make a more privacy-protective choice?
