What happened?
On September 4, the California Privacy Protection Agency, the agency responsible for enforcing the California Consumer Privacy Act (CCPA), issued an enforcement advisory on “dark patterns” and their inability to constitute valid consent.
Why does it matter?
Any business whose consent is considered invalid would likely face allegations that all processing activities subject to the CCPA (excluding data collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act, its implementing regulations, or the California Financial Information Privacy Act) and on which that consent is based are unlawful and subject to civil penalties of up to $2,500 per violation, and up to $7,500 for willful violations. Going further, consent is a near-ubiquitous concept, and California’s view of what constitutes valid consent is likely to shift the winds on what constitutes valid consent — and what is conversely considered invalid, deceptive, or unfair — more generally.
What is a dark pattern?
Dark patterns are “choice architectures that have the substantial effect of subverting or impairing a consumer’s autonomy, decision-making, or choice.” Like clouds, this can take many forms, particularly when interpreted by an aggressive regulator. The advisory stressed two important aspects for valid consent (i.e., not being a dark pattern): plain-language explanations and symmetrical choices. A “symmetrical choice” means that consumers can exercise more privacy-protective choices as easily as they can exercise less privacy-protective choices. The advisory provides some examples:
Ultimately, “dark patterns are about effect, not intent,” and identifying them can feel like searching for shapes in the clouds.
What should I consider doing?
- Keep an eye on the sky. These consent winds may sweep east.
- Review consent interfaces and processes for dark clouds the CPPA might call a “dark pattern.” Ask:
- Is the language easy to read, in plain language, and free of legal jargon?
- Is the path to the less privacy-protective choice longer or more difficult to reach than the more privacy-protective choice?
- Is it more time-consuming for a consumer to make a more privacy-protective choice?
Here’s hoping for sunny, cloud-free days ahead!
