Now that GDPR has been implemented across Europe, large digital service providers like Google, Facebook and Microsoft have adopted new methods to encourage users to relinquish their right to data privacy by providing them with the illusion of control.

A new study from a Norwegian watchdog group has branded these ‘dark pattern’ techniques as “an unethical attempt to push consumers toward choices that benefit the service provider.”

Since GDPR, privacy popups have become a prevalent feature on most websites, prompting the user to make choices about how their data is gathered and used. According to the study, this choice is merely an illusion of control as companies are using this digital point of contact as an opportunity to manipulate users to share their information.

Using ‘Dark Patterns’

The report found that companies use misleading words, lengthy and confusing opt-out processes, and take-it-or-leave-it options to nudge users to grant the company access to their data. The study noted that dark pattern techniques are most prominent in digital services such as Google and Facebook.

The study revealed that both had obscured their privacy friendly options and implemented intrusive default privacy settings, with the hope users would not go digging for these obscure settings. Furthermore, to opt-in ‘Agree and Continue,’ is always presented as the simpler and easiest choice.

Facebook and Google’s default privacy settings mean that users are automatically opted-in. Therefore, to opt-out, the user would have to embark on the lengthy process of opting out. The report states: “Users that do not wish to accept more data collection should not have to search for the default settings in order to turn them off.”

Companies Punishing Users for Opting-Out

If the user is determined to opt-out, for example, to disable Facebook’s facial recognition, they will then be met with a tailored set of consequences designed to scare them into allowing it: “we won’t be able to use this technology if a stranger uses your photo to impersonate you.”

However, if you do opt-in there are no details available as to how exactly your data will be used. If a user decides to disable Google ad targeting, they will be warned that going forward they may not be able to mute some ads. Essentially, companies try to punish users for choosing privacy over sharing their information.

The Norwegian Consumer Council and other consumer and privacy groups in Europe and the US are now asking the European data protection authorities to determine if this behaviour is compliant with GDPR.