California bans website 'dark patterns', confusing language when opting out of having your personal info sold
(2021/03/17)
- Reference: 1615945151
- News link: https://www.theregister.co.uk/2021/03/17/dark_patterns_ban/
- Source link:
California has expanded its consumer privacy law to include a prohibition on the use of deceptive messaging and presentation, or " [1]dark patterns ," in the limited context of opting out of the sale of personal information.
"These protections ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights," said California Attorney General Xavier Becerra in [2]a statement on Monday.
[3]
The rule amendments
The CCPA amendments:
[8]
Clarify that businesses operating offline need to provide a way to opt-out of data sales.
Establish a standard Opt-Out Icon for notice and consent of data sales.
Prohibit designs that impair or subvert a consumer's choice to opt-out.
Require that opting out takes no more steps or clicks than opting in.
Ban confusing language, like the double negative "Don't not sell my information," when presenting an opt-out choice.
Forbid asking for personal information not necessary to carry out an opt-out request.
Disallow forcing people to scroll through a privacy policy if they've opted out or to review reasons not to opt-out.
The dark pattern rules went through a public comment period and additional adjustment after California voters approved Proposition 24, the California Privacy Rights Act (CPRA), last November..
The CPRA expands the CCPA by adding a consumer right to limit information usage and disclosure and by establishing a consumer right to request the correction to incorrect data about them that companies have stored. It also shifts privacy enforcement from the State Attorney General, Becerra, to the new California Privacy Protection Agency, while retaining the private right to action put in place by the CCPA. Enforcement of the CPRA begins in 2023.
Unless...
Industry groups during the comment period objected to many of the proposed CCPA changes
"Prohibiting an undefined category of language thus raises due process concerns," the group argued. "Similarly, prohibiting an undefined category of speech also raises serious First Amendment concerns."
Another industry group, MPA – the Association of Magazine Media, expressed concern that requiring an equal number of opt-out and opt-in steps would incentivize designs that achieve parity by adding unnecessary steps purely for the sake of legal compliance.
California outlaws wording, webpage buttons designed to hoodwink people into handing over their personal data [10]READ MORE
Industry reluctance to accept tighter privacy rules coincides with industry affinity for behavior-influencing design.
Research [11]published in 2019 found 22 companies selling manipulative interface design or dark patterns as a service and found 1,841 examples on 1,267 websites employing these dubious techniques out of 11,000 surveyed.
Earlier that year, federal lawmakers from both sides of the aisle proposed the Deceptive Experiences To Online Users Reduction ( [12]DETOUR ) Act to prohibit large online service providers like Facebook and Google from employing dark patterns to coax online behavior. But [13]the bill languished in committee and hasn't gone anywhere.
In Europe, the Consumer Rights Directive limits some dark patterns. But the practice of steering user behavior through manipulative interface design remains alive and well. Last month, the Electronic Privacy Information Center [14]filed a complaint with the Washington DC Attorney General arguing that "Amazon unlawfully employs manipulative 'dark patterns' in the Amazon Prime subscription cancellation process."
Next month, the US Federal Trade Commission plans to hold [15]a workshop on dark patterns.
[16]
In response to Becerra's announcement, US Senator Mark Warner (D-VA), one of the two sponsors of the DETOUR Act, on Tuesday via Twitter urged his colleagues to address the issue on a federal level. ®
Get our [17]Tech Resources
[1] https://www.darkpatterns.org/
[2] https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-additional-regulations-empower-data
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-add-adm.pdf
[5] https://www.theregister.com/2020/10/13/california_updates_privacy/
[6] https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-final-regulations-under-california
[7] https://www.theregister.com/2020/07/01/happy_privacy_enforcement_day_if/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-written-comm-3rd-15-day-period.pdf
[10] https://www.theregister.com/2020/10/13/california_updates_privacy/
[11] https://www.theregister.com/2019/06/26/marketing_manipulation_dark_patterns/
[12] https://www.scribd.com/document/405606873/Detour-Act-Final
[13] https://www.congress.gov/bill/116th-congress/senate-bill/1084/all-actions?overview=closed#tabs
[14] https://epic.org/2021/02/epic-files-dc-consumer-protect-1.html
[15] https://www.ftc.gov/news-events/events-calendar/bringing-dark-patterns-light-ftc-workshop
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
"These protections ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights," said California Attorney General Xavier Becerra in [2]a statement on Monday.
[3]
The rule amendments
[4]PDF
, just approved by the American state’s Office of Administrative Law, were proposed [5]last October after a set of initial rules for enforcing the California Consumer Privacy Act (CCPA) were adopted [6]last August , a month after [7]CCPA enforcement began .The CCPA amendments:
[8]
Clarify that businesses operating offline need to provide a way to opt-out of data sales.
Establish a standard Opt-Out Icon for notice and consent of data sales.
Prohibit designs that impair or subvert a consumer's choice to opt-out.
Require that opting out takes no more steps or clicks than opting in.
Ban confusing language, like the double negative "Don't not sell my information," when presenting an opt-out choice.
Forbid asking for personal information not necessary to carry out an opt-out request.
Disallow forcing people to scroll through a privacy policy if they've opted out or to review reasons not to opt-out.
The dark pattern rules went through a public comment period and additional adjustment after California voters approved Proposition 24, the California Privacy Rights Act (CPRA), last November..
The CPRA expands the CCPA by adding a consumer right to limit information usage and disclosure and by establishing a consumer right to request the correction to incorrect data about them that companies have stored. It also shifts privacy enforcement from the State Attorney General, Becerra, to the new California Privacy Protection Agency, while retaining the private right to action put in place by the CCPA. Enforcement of the CPRA begins in 2023.
Unless...
Industry groups during the comment period objected to many of the proposed CCPA changes
[9]PDF
. For example, the Consumer Data Industry Association, which represents credit reporting companies, asked that the ban on confusing language be dropped because it's not clear what constitutes confusing language."Prohibiting an undefined category of language thus raises due process concerns," the group argued. "Similarly, prohibiting an undefined category of speech also raises serious First Amendment concerns."
Another industry group, MPA – the Association of Magazine Media, expressed concern that requiring an equal number of opt-out and opt-in steps would incentivize designs that achieve parity by adding unnecessary steps purely for the sake of legal compliance.
California outlaws wording, webpage buttons designed to hoodwink people into handing over their personal data [10]READ MORE
Industry reluctance to accept tighter privacy rules coincides with industry affinity for behavior-influencing design.
Research [11]published in 2019 found 22 companies selling manipulative interface design or dark patterns as a service and found 1,841 examples on 1,267 websites employing these dubious techniques out of 11,000 surveyed.
Earlier that year, federal lawmakers from both sides of the aisle proposed the Deceptive Experiences To Online Users Reduction ( [12]DETOUR ) Act to prohibit large online service providers like Facebook and Google from employing dark patterns to coax online behavior. But [13]the bill languished in committee and hasn't gone anywhere.
In Europe, the Consumer Rights Directive limits some dark patterns. But the practice of steering user behavior through manipulative interface design remains alive and well. Last month, the Electronic Privacy Information Center [14]filed a complaint with the Washington DC Attorney General arguing that "Amazon unlawfully employs manipulative 'dark patterns' in the Amazon Prime subscription cancellation process."
Next month, the US Federal Trade Commission plans to hold [15]a workshop on dark patterns.
[16]
In response to Becerra's announcement, US Senator Mark Warner (D-VA), one of the two sponsors of the DETOUR Act, on Tuesday via Twitter urged his colleagues to address the issue on a federal level. ®
Get our [17]Tech Resources
[1] https://www.darkpatterns.org/
[2] https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-additional-regulations-empower-data
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-add-adm.pdf
[5] https://www.theregister.com/2020/10/13/california_updates_privacy/
[6] https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-approval-final-regulations-under-california
[7] https://www.theregister.com/2020/07/01/happy_privacy_enforcement_day_if/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-written-comm-3rd-15-day-period.pdf
[10] https://www.theregister.com/2020/10/13/california_updates_privacy/
[11] https://www.theregister.com/2019/06/26/marketing_manipulation_dark_patterns/
[12] https://www.scribd.com/document/405606873/Detour-Act-Final
[13] https://www.congress.gov/bill/116th-congress/senate-bill/1084/all-actions?overview=closed#tabs
[14] https://epic.org/2021/02/epic-files-dc-consumer-protect-1.html
[15] https://www.ftc.gov/news-events/events-calendar/bringing-dark-patterns-light-ftc-workshop
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFGM71qDzwg5MVOsY@kdiQAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
Confusing Language
RM Myers
Maybe the next target could be confusing language in laws and regulations, including the tax codes. Oh wait, that might hurt the "full employment for lawyers and accountants" initiative. Legislatures and regulators wouldn't want to do that, since most are lawyers. Never bite the hand that feeds you.
Besides, if you make them simple to understand, your fat cat political donors, who can afford the lawyers and accountants, will lose their advantage over the rest of us. Worse yet, the voters may realize how many loopholes favor those donors. Again, never bite the hand that feeds you.
Ready, Shot, Aim - It's My Foot
Privacy rules and laws have come about because many companies have abused their power to detriment of users. They may win this round. As the more become aware of the absolutely despicable of many in Silly Valley and those that ape them they risk getting much worse later. But manglement is not often known for competence, intelligence, and long term planning.