July 2024

A global privacy sweep that examined more than 1,000 websites and mobile applications (apps) has found that nearly all of them employed one or more deceptive design patterns that made it difficult for users to make privacy-protective decisions.

Deceptive design patterns use features that steer users towards options that may result in the collection of more of their personal data. These patterns may also force users to take multiple steps to find a privacy policy, log out, or delete their account, or present them with repetitive prompts aimed at frustrating them and ultimately pushing them to give up more of their personal data than they would like.

This year’s annual Global Privacy Enforcement Network (GPEN) Sweep took place between January 29 and February 2, 2024. It involved participants, or “sweepers,” from 26 privacy enforcement authorities, from around the world.

The IDPC has participated in this exercise and evaluated websites of banks operating in Malta.
Those involved in the privacy sweep replicated the user experience by engaging with websites and apps to assess the ease with which they could make privacy choices, obtain privacy information, and log out of or delete an account.

Sweepers evaluated the sites and apps based on five indicators identified by the Organisation for Economic Co-operation and Development (OECD), as being characteristic of deceptive design patterns.

For each indicator, the GPEN report found:

• Complex and confusing language: More than 89% of privacy policies were found to be long or use complex language suited for those with a university education.
• Interface interference: When asking users to make privacy choices, 42% of websites and apps swept used emotionally charged language to influence user decisions, while 56% made the least privacy protective option the most obvious and easiest for users to select.
• Nagging: 35% of websites and apps repeatedly asked users to reconsider their intention to delete their account.
• Obstruction: In nearly 40% of cases, sweepers faced obstacles in making privacy choices or accessing privacy information, such as trying to find privacy settings or delete their account.
• Forced action: 9% of websites and apps forced users to disclose more personal information when trying to delete their account than they had to provide when they opened it.

What is next?

GPEN, together with the IDPC, encourage organisations to design their platforms, including associated privacy communications and choices, in a manner that support users in making informed privacy choices that reflect their preferences. Organisations are encouraged to offer users online experiences that are free from influence, manipulation, and coercion, and to adopt these best practices:

• to apply default settings that best protect the right to the protection of personal data;
• to adopt neutral language and design to present privacy choices in a fair and transparent manner;
• to apply fewer clicks to find privacy information, log out or delete an account; and
• to provide ‘just-in-time’ contextually relevant consent options.

Link to the GPEN press release:

https://www.privacyenforcement.net/content/2024-gpen-sweep-deceptive-design-patterns

Link to the GPEN report:

https://www.privacyenforcement.net/content/2024-gpen-sweep-deceptive-design-patterns-reports-english-and-french