Dark Patterns, the Ratchet

Re:Dark Patterns, the Ratchet by steve_gh on Tuesday March 27, 2018 @01:38PM (#16690891)

I'm wondering whether GDPR is going to make this worse.

It used to be that the GWR train Wifi would automatically log me in. But now that has changed, and it takes me to a pre-populated log-in screen, which requires me to untick the "Add me to the mailing list" button, and tick the "T&Cs" and "Privacy statement" buttons.

I suspect that this is a GDPR hoop to show they have consent for every bit of data they use. But all I have to do is forget to untick the "Add me to your mailing list" button once...

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Someone on Tuesday March 27, 2018 @06:24PM (#16693344)

The GDPR doesn’t allow default-checked opt-in checkboxes. They aren’t “clear affirmative actions”.

Article 4.11: ”'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Silhouette on Tuesday March 27, 2018 @09:35PM (#16694447)

So now we have to go back to every site/service/app including unchecked but mandatory tick boxes about agreeing to their terms and privacy policy in the checkout process, thus both annoying just about everyone and potentially reducing conversion rates while making no practical difference to anything whatsoever? I guess we can file that with the "cookie" law and the consumer protection rules that say if you want to download any digital content you just bought immediately instead of waiting 14 days first then <insert scary legalese about losing a right to cancel under some law you never heard of here>. I think they're under "well intentioned but utterly lacking in practical understanding".

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by icebraining on Wednesday March 28, 2018 @09:35AM (#16697499)

Those tick boxes can only be mandatory if the data is actually needed to provide the service - the user can't be forced to allow his data to be used for marketing purposes, for example. Also, if it's obvious for what purpose the data will be used (e.g. filling in your address for delivering a package), you don't need a tick box.

So there should be little need for mandatory boxes.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Silhouette on Wednesday March 28, 2018 @02:15PM (#16700265)

As ever with the GDPR, things are going to get subjective and you take your chances until the picture is clearer. A strict interpretation appears to be that, for example, a business that uses a customer's email address as an account ID on its web site and sends only essential messages to that email address doesn't need consent, because the legal basis for the processing is performance of a contract, but if the email address is also used for other form of communication (even if the message is genuinely relevant and something the customer would almost certainly want to receive) then that may require active consent. That could lead to a lot of places adding those checkboxes back in just to make sure they're covered, even if they aren't strictly necessary.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by icebraining on Wednesday March 28, 2018 @03:01PM (#16700717)

Actually, they can't add those checkmarks, because consent must be specific (use this data for this purpose), so a generic tick box about agreeing to their terms and privacy policy won't fly.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Silhouette on Wednesday March 28, 2018 @03:15PM (#16700886)

Well, at that point, all semblance of reality would have been lost anyway. It seems highly unlikely that any businesses, even huge ones that have data-hoarding business models, are going to start itemising opt-in consents in their sign-up process rather than just having a compliant privacy policy and a single active consent to processing under it.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by icebraining on Wednesday March 28, 2018 @05:40PM (#16702233)

If they don't, I'm sure my national data protection commission will be happy to remind them.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Silhouette on Wednesday March 28, 2018 @07:45PM (#16703169)

Unless they really want to play chicken over something that is clearly an unreasonable interpretation of the rules, I doubt it.

Using the GDPR to go after one big player that seriously screwed up is one thing. I certainly wouldn't be comfortable if I held Facebook stock right now.

But going after all the big players, just for not complying with something that is probably impractical for any of them to comply with, is something else entirely. How long do you think public sentiment is going to support government regulators and the GDPR if the likes of Facebook, Google Mail, WhatsApp, Instagram and SnapChat all go dark across the EU for an hour, or a day, or a week?

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by icebraining on Thursday March 29, 2018 @01:19AM (#16704661)

unreasonable interpretation of the rules

There's nothing unreasonable about it, it's the plain reading of Article 7 (2).

Regarding the big sites, I don't see how is that relevant to your initial point about whether "every site" will have mandatory checkboxes, and so I'll let someone else read the magic 8 ball.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by lmkg on Tuesday March 27, 2018 @01:45PM (#16690963)

But GDPR also means you have the right to revoke consent that was previously given.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by IMTDb on Tuesday March 27, 2018 @01:48PM (#16690999)

Ain't nobody got time for that.

Like the article says, there might be a way, somewhere deeply hidden in the website to revoke the consent, but do you really want to spend half an hour for that (if the button really, exists, and if it actually does anything)

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by lmkg on Tuesday March 27, 2018 @03:03PM (#16691725)

If the link is buried, that is a violation of the GDPR. Contact details for the controller and the Data Protection Officer must be given at the point where data is collected: https://gdpr-info.eu/art-13-gdpr/. There's also something else about an affirmative duty to facilitate exercise of rights, but that's less clear-cut.

A non-functional link is also a GDPR violation.

That said, I agree in general: it's a burden on me to make these websites respect my rights, and that's kinda bullshit. I either have to go through the hoops the site sets up, or I have to go through the bureaucratic hoops of the organization that judges the hoopiness of the website's hoops. But if I do care enough, there is now a stick to wield, which is an improvement.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by Silhouette on Tuesday March 27, 2018 @09:38PM (#16694460)

Not all organisations are required to have a DPO under the GDPR.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by icebraining on Wednesday March 28, 2018 @09:39AM (#16697522)

As anvandare pointed out in another comment,

"It shall be as easy to withdraw as to give consent."

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by rdiddly on Tuesday March 27, 2018 @01:54PM (#16691040)

GWR is to blame for that. They're seizing the opportunity presented by having one more interaction (among many) with you, to saddle that interaction with this ratchet pattern. There's nothing special about GDPR that leads inexorably to that.

[ Parent | on HN ]

Re:Dark Patterns, the Ratchet by dwighttk on Tuesday March 27, 2018 @01:43PM (#16690944)

most certainly. In the way you imagine and in ways we can't even imagine now. (Things may get better in some ways, but they will get worse in others)

[ Parent | on HN ]