‘Dark patterns’ are steering many internet users into making bad decisions
latimes.com
latimes.com
There are some objective criteria that can be applied (don't have addons like trip insurance selected by default), but other things are more subjective than this.
Is legislation going to make this better without having unintended consequences that make life difficult for startups who aren't necessarily trying to be sneaky (the quoted language refers to things that are either intended to produce a certain result or have the effect of doing so — even if there was no intention).
I would also note that dark patterns even exist in the legal/governmental sphere. For example, the California Bar website, which lawyers use to pay their annual dues, has optional fees added on by default, and they obscure this fact by making it seem like the default is the barebones cost. It was only after a year or two of paying my fees that I realized how they had hidden these tacked-on fees.
Perhaps the testing ground for anti-dark patterns laws can be governmental websites like calbar.ca.gov!
I think after about 30 years of deregulation and "I'm not sure that putting the government in charge of policing them is a good idea", it's time for the pendulum to swing the other way.
Yes that means there may be bad regulations and/or enforcement, but nothing is written in stone. Those things can be fixed as they come up.
Relevant: https://twitter.com/camerondare/status/1143538064402157568
But maybe I’m a bit bias in my incredulity residing in a state where legislative sessions happen every two years resulting in sometimes two year waits to come back and address a bit of policy that probably could have been deliberated on more in committee.
Furthermore I’m not even sure if I agree that regulating UI patterns of web application even falls or should fall to the delegated powers of the FCC; this agency primarily concerns itself with interconnected communications systems like the Public Telephone Switching Network, not social networking sites.
We have a consumer financial protection bureau, if a solution should exist at the Federal level, I’d be far less dubious of a bureau that follows a similar framework as the CFPB to establish guidelines and frameworks for handling user data and disseminating data to the user respectively.
The bill is 13 pages long. There are affordances for small businesses, this bill would only apply to "large online services" with 100 million users or more within a 30 day period. It seems to be a very thoughtfully written piece of legislation.
Taking a gander at your link before responding further.
Edit: Alright I’ve read the first half, because I’m at lunch and would like to take the time this evening to really sit and pour over it:
I concur with your assessment. This does seem to be well designed and thought out policy, and I could see myself actively supporting it versus my previous position of “no Federal involvement”.
Point, humbly conceded. Thank you for the point of view change.
everyone is biased this or that way, what irks me about the "I don't like legislation" comments is that I rarely see a proposed equivalent alternative.
Because just praying that the dark patterns are going away is probably not going to work.
I’m open to your response to that suggestion.
Sometimes solutions create direct tradeoffs between freedom and security and we need to understand the valuing security can mean a loss of freedom - the PATRIOT act is a prime example.
The best solution is occasionally to just accept that there is no solution, that the tradeoffs aren't worth it and that we should just educate as best we can but accept these things as problems we can't avoid without significant costs.
Doing nothing takes us from having "a less than ideal solution" to having "no solution at all".
I think we can try for sensible regulation that strikes a good balance between freedom and security while also acknowledging it might not be a perfect solution in every situation.
The patriot act is a terrible example to use because even before it passed it was clearly going too far in the wrong direction and people concerned with privacy and civil liberties were very vocal in opposing it. The flaws were obvious but included by design and so objections were simply ignored. It simply wasn't an example of government making a good faith effort at sound regulation. It was a blatant power grab which they manipulated frightened people into accepting while ignoring all other objections.
Some of these dark patters are essentially fraud and there absolutely should be a process for reporting them to a governing body for review.
No, doing nothing takes us from having a completely harmful and destructive solution that's very difficult to change to having no solution at all.
Sometimes, you need to be willing to accept no solution at all is the least harmful choice.
To give a snide description - just because you have an infected toenail doesn't mean shooting yourself in the foot would help.
This isn't a "do nothing ever" but "be reasonably sure it would help and be worth the costs".
It is also easier to tell when something would make things far worse than to tell when it could help things.
The assumption is that introducing a bill to regulate dark patterns is the same as "moving fast". This bill hasn't even made it to committee [1] and darkpatterns.org was started in 2010 [2]. I think an argument could be made that the US government is actually moving pretty slowly on this topic. GDPR has been in place for over a year, so there is significant data to understand the implications of this type of regulation.
==and fix broken regulations later.==
How is this different from a software product releasing an updated version? Microsoft Excel is on v16 and I don't think anyone is accusing that product of moving fast and breaking things. I wish we spent more time adding features and fixing bugs from past legislation.
As to your second point, I also wish we spent more time adding features and fixing bugs from past legislation. I don't think that happens nearly enough, which is a major reason I don't trust our ability to just fix shoddy regulation after the fact.
The idea people seem to be repeating is that this will be ineffective. It seems to me that GDPR provides a pretty strong framework to learn from and build off. Europe effectively launched version 1.0, so now we can implement the best parts and eliminate or improve the weakest parts. We aren't starting from scratch or searching in the dark.
That’s terrible form. I’m sorry. No.
But to your point yes I did propose a similarly frameworked agency like the CFPB, but I’ll also offer that in another comment I had my mind changed on the affair after further discussion with another commenter here about policies already established and powers delegated to already existing Federal agencies.
I am suggesting that the perfect bill which requires no future fixes is non-existent. Thus, advocating for this solution is the equivalent of advocating for nothing. Just as building a product and showing it to nobody is functionally the same as not building a product from the rest-of-the-world's perspective.
Yes. But again, I've already conceded and abandoned this argument after being shown what I thought was good, well crafted policy with definitions, provisions and executions that I am willing to support in the context of this discussion. I happen to believe that all other things being established, context is important. Therefore I don't see the point in trying to refute your assertion of what I've said there, I did take that position, but I've since abandoned it, and conceded the point to a much better position than the one I had previously, therefore what I said earlier about "legislate first, fix later" holds no further relevance to this debate on policy, at least not IMO[1]
I am suggesting that the perfect bill which requires no future fixes is non-existent. Thus, advocating for this solution is the equivalent of advocating for nothing.
You still seem to be arguing against a position of "pass a perfect bill or no bill at all" that no one has made, and has not presented itself in the discussion, so to that note I'm not really sure how to respond.
[1] caveat lector: That being said, I do have strong opinions at large about incrementalism in policy design, but that's for another time and probably another forum.
The problem is when you move fast, break things, and then don't fix them. Hell, I'm even OK with being slow to roll things out to make sure you don't break things, just make sure your iteration time period is on the order of weeks or months, not years or decades.
Unfortunately, this is not true. For example, a right that is taken away will be EXTREMELY difficult to restore again. It's not like a switch that you can flip back and forth until enough evidence is gathered from both states that you know the "correct" way forward... Software has A/B tests for this, law most definitely does not.
I think if we had almost all laws passed with expiration time it would hopefully result in better/more up to date legislation although the only "temporary" legislation I remember (Patriot Act?) was just passed every time it expired...
>Those things can be fixed as they come up.
I assume "as they come up" means decades later? The government is like a supertanker, changing course is a sloooow process.
That should be straight up illegal, hands down. When we are talking about user privacy these details matter and should be regulated. We don't need to regulate presentation elements but we need to regulate equivalency of options and what some defaults should be.
When iOS 7 removed skeumorphism, they made it harder to see controls. Sometimes the controls were white on a white website. Like on Google Chrome address bar! And in YouTube also.
To configure car settings on the main display, there is a sidebar on the left, and settings to the right.
For example, select "Driving" on the left, and in the pane to the right you can switch the acceleration mode, or steering wheel effort, or regenerative braking level.
If you select "Safety and Security" in the sidebar, there are a number of settings in the pane to the right. The trick? the right pane is scrollable. Like realplayer. Move your finger upwards to reveal a [Data Sharing] button to disable sharing of car data/video clips with Tesla.
Other panes in that settings screen require scrolling too.
I just checked. There are many options and it's obvious you can scroll on that pane.
The only deceptive thing might be having it at the bottom of the list.
edit: It may be a weird place for that option too thinking about it.
Here's a picture of how it looks by default. I think the sentry mode text and how it's grayed out implies you can scroll.
On the model S, with the v9 update no other screens were scrollable. I knew you could disable it, and I hunted for quite some time before I found the trick.
I recently got a 2019.x update which added language options to the "Display" pane, and that became the second pane to be scrollable.
(There's also the obvious thought that NO setting should require scrolling to find because you're driving a car)
There are a bunch of little UI issues. Backseat warmers hidden in menus. No physical gloveblock button. You can't press and slide the volume up all the way because you slide off the edge of the screen. Honestly the behind the wheel display on the S was nice. I liked the W/mi gauge better than the white line on the 3 and the full bleed map looks nice.
I've made so many mistakes because I couldn't tell something overflowed. The scrollbar doesn't have to be big and ugly but it should still be present. At a minimum give a visual indicator that there's more content and then I know to try scrolling to see if it works.
It's a stupid UX fad.
Maybe my newer android phone has the same unethical behavior ... with that setup it was just a matter of time before I (or someone I handed the phone too) accidentally forever-authorized it.
I think you can find some good enough rules on how things should be without forcing the use of the exact font family and color.
A little bit of lobbying to fix the worst of the problems and shining daylight on the rest might be enough to change the course of enough companies to improve the situation.
My wife is tech literate, and has put up with my complaining of countless patterns and tech developments over the years, but still managed to get signed up for a subscription when she thought she'd just bought a pair of shoes. A little search showed it a very common issue a few years ago. Maybe it is still.
It's all very well not wanting to make life difficult for startups, but what of the flipping public? I don't think it reasonable to expect people examine every pixel of every page just to avoid getting scammed. The startups, even large ones, are often as bad as the worst snake oil selling SEO and internet marketers.
It's those startups who made regulation increasingly inevitable. We've had 40 years since Thatcher and Reagan started working to make regulation unacceptable and unfashionable. The first 10 years probably did improve things, the next 30 has been too much and caused countless scandals, banking crises and what not.
That said, there should be SOME incentive for fewer dark patterns.
There would undoubtedly be loopholes like separate bundles and display order priorities - but those likely impose their own "expenses" through website interfaces being more encumbered.
It would add some compliance costs but such a limitation would be fair and not overreaching.
Enabling javscript in your browser (which is what almost all browsers do by default) opens you up to all sorts of tracking, hacking, spying, and advertising (which itself is a significant vector of malware, once again through javascript).
This is why I surf the web either through a browser that doesn't support javascript at all (like emacs-w3m), or in Firefox with the uMatrix extension set to deny javascript from all sites by default.
Unfortunately, the vast majority of users are neither computer-savvy enough to know how to do that, nor to even know how or why they're vulnerable, and probably wouldn't go to the trouble even if they knew how and cared. So they get hacked, and sometimes the rest of us pay the price for it through things like major data leaks of our personal information from organizations where employees browsed the web with javscript enabled.
Reddit runs fine without it (again with the exception of voting). Most news sites run fine or even better without javascript, as without it you're not subject to all the bloat that advertising heavy sites burden you with.
Recently there was some post on HN that linked to a Forbes article, and there were a bunch of complaints in the HN thread about how nightmarish the Forbes website was, with all the ads it foisted on the user. But in emacs-w3m, which does not understand javascript, the site was perfectly readable. There are plenty of other sites which implement anti-ad-blocking code via javascript which are completely bypassed by simply using a browser that doesn't run javascript.
Overall, I find that maybe 90% of the sites I visit run fine or well enough without javascript. Sometimes a website will have a legitimate need for the interaction or live updates that javascript facilitates (thout maybe some or all of that could be done via HTML 5.. I haven't done web development in decades, so I don't know, but I suspect it could), like finance sites which run stock tickers, or some art or games sites. I mostly don't use any of those, though, so very rarely run across a site I need that actually legitimately needs something like javascript.
Much more frequently I run in to sites that don't need javascript (because they're just delivering static content), but which choose to use javascript anyway -- either because it's more convenient for them, because a lot of web frameworks make use of it, and/or because they want to deliver ads and track their users through javascript. When I run across such sites, I either try to circumvent them somehow (maybe by manually reading the source and extracting the content), or when that fails I just avoid them. In the very rare cases when I can't avoid them, can't circumvent them, and absolutely need them, I'll grudgingly enable javascript. This case accounts for maybe 5% or less of my web use.
You can still sign in and vote with JS disabled on HN.
[1] - https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...
"javascript is a dark pattern" is as much a meaningless statement as "emacs is a dark pattern" or "you're a dark pattern"
In my opinion, this shouldn't be about allowing users to.make better informed decisions. As a user, I don't want the burden to analyze, reason, evaluate and determine the right choices to protect myself everytime I engage with an app or website. I'd like a bill where the government or some other agency made that choice already and had good privacy choices enforced. At least as a default or a strong recommendation.
This is one scenario where I'd like to outsource the decision making, because I just don't have the time.
"Citizens may sue at up to $2000 plus incidental fees or costs carried due to dark patterns in a user interface. A lawsuit of this manner is not subject, and supersedes any prior agreements of 'Arbitration' or other means intending a deviation from a court."
It'll never happen but it's fun to think about.