On September 4, 2024, the California Privacy Protection Agency (CPPA) issued Enforcement Advisory 2024-02 which addresses the use of “dark patterns” in user interfaces under the California Consumer Privacy Act (CCPA). This advisory emphasizes the importance of clear language and symmetrical choices in privacy-related user interfaces to ensure compliance with the CCPA.

Key Points of the Advisory

Definition and Impact of Dark Patterns

• Dark Patterns: The advisory defines dark patterns as user interfaces designed to subvert or impair user autonomy, decision-making, or choice.
• Effect Over Intent: The focus is on the effect of these interfaces rather than the intent behind them. Even if a business does not intend to deceive users, if the interface has the substantial effect of impairing user autonomy, it is considered a dark pattern.
• Simplicity: All communications to consumers should be “easy to read and understandable to consumer,” and avoid technical or legal jargon, per Civil Code § 7003(a).
• Consent: Consent must be freely given, specific, informed, and unambiguous. Any agreement obtained through dark patterns does not constitute valid consent, per Civil Code § 1798.140(h).
• Symmetry in Choice: The regulations mandate that methods for submitting CCPA requests and obtaining consumer consent must use easy-to-understand language and incorporate symmetry in choice, per 11 CCR § 7004(a)(1)-(2).

Regulatory Suggestions

The advisory provides examples to illustrate what constitutes symmetrical and asymmetrical choices:

• Not Symmetrical: A process for opting out of the sale/sharing of personal information that takes more steps than opting back in. the imbalance between what is required
• Symmetrical: A website banner offering choices like "Accept All" and "Decline All" for consent to use personal information.

Next Steps

1. Review User Interfaces: Businesses should carefully review their user interfaces, including those provided by service providers, to ensure they do not employ dark patterns.
2. Ensure Symmetry in Choices: Design interfaces that offer symmetrical choices, making it equally easy for consumers to opt-in or opt-out.
3. Use Clear Language: Ensure all communications are easy to read and understand, avoiding technical or legal jargon.
4. Consult Legal Resources: Businesses should consult the CCPA statute, regulations, and possibly an attorney to ensure full compliance with the law.

To help implementing these “next steps," the advisory provides a list of questions which a business should ask itself:

• Is the language used easy to read and understandable?
• Does it avoid technical or legal jargon?
• Is the path to saying "no" longer than the path to saying "yes"?
• Does the interface make it more difficult to say "no" rather than "yes"?
• Is it more time-consuming for the consumer to make the more privacy-protective choice?

Takeaways for Businesses

• Consumer Autonomy: Protecting consumer autonomy is paramount. Interfaces should empower users to make informed decisions without undue influence.
• Compliance Focus: The CPPA will scrutinize interfaces for compliance with CCPA requirements, focusing on the effect of the design on consumer choice.
• Proactive Measures: Businesses should proactively assess and adjust their user interfaces to avoid potential violations and ensure they are providing clear, symmetrical choices.

By adhering to these guidelines, businesses can better align with CCPA requirements and avoid enforcement actions related to dark patterns.

User interfaces or choice architectures that have the substantial effect of subverting or impairing a consumer’s autonomy, decision making, or choice are “dark patterns” under the California Consumer Privacy Act

cppa.ca.gov/...