Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
复制标题
DOI：
10.1145/3313831.3376321
复制
发表时间：
2020-01
期刊：
影响因子：
--
通讯作者：
Midas Nouwens;Ilaria Liccardi;Michael Veale;David R Karger;Lalana Kagal
中科院分区：
文献类型：
--
作者：
Midas Nouwens;Ilaria Liccardi;Michael Veale;David R Karger;Lalana Kagal
新的同意管理平台（cmp）已经被引入网络，以符合欧盟的一般数据保护条例，特别是当公司收集和处理用户的个人数据时需要同意的要求。这项工作分析了最流行的CMP设计如何影响人们的同意选择。我们从英国排名前1万的网站（n=680）中挑选了5个最受欢迎的cmp的设计。我们发现黑暗模式和隐含同意无处不在；只有11.8%符合我们基于欧洲法律的最低要求。其次，我们对40名参与者进行了现场实验，以调查八种最常见的设计如何影响同意选择。我们发现通知样式（横幅或障碍）没有效果；从第一页移除“退出”按钮会增加22-23个百分点的同意度；在第一页提供更细粒度的控制会减少8-20个百分点的同意度。本研究为实施GDPR的必要监管行动提供了经验基础，特别是关注集中式第三方CMP服务作为提高合规性的有效方法的可能性。
New consent management platforms (CMPs) have been introduced to the web to conform with the EU's General Data Protection Regulation, particularly its requirements for consent when companies collect and process users' personal data. This work analyses how the most prevalent CMP designs affect people's consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). We found that dark patterns and implied consent are ubiquitous; only 11.8% meet our minimal requirements based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22-23 percentage points; and providing more granular controls on the first page decreases consent by 8-20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.