Some business practices on the internet may not be against the law, but they undermine or manipulate consumer choice. Legal advocates have coined a new name for this practice: dark patterns.
Difficult subscription cancellation processes, dishonest pricing models and even opt-in buttons that are more attractive than their opt-out counterparts are all examples of dark patterns.
These tricks have been around since the dawn of the internet, but now legal advocates are naming and earmarking them for federal and state online protection policies, including where data privacy is concerned. And the FTC’s recent cases indicate it’s ready to take action against deceptive dark patterns.
“‘Dark patterns’ is a term that’s come in vogue over the last couple of years,” said Mary Engle, EVP of policy at BBB National Programs, an independent organization that helps set business standards for self-regulation. (It split from the Better Business Bureau in 2019.)
Now, the term “dark patterns” is generally applied to “any user interfaces that impair or impede consumer decision-making and choice,” Engle said.
Life’s unfair
In the US, enforcement against dark patterns will mostly lie with the Federal Trade Commission (FTC), similar to other types of consumer welfare protection. Some state AGs will also enforce dark patterns where data misuse is involved.
Organizations like the BBB National Programs’ National Advertising Division (NAD) help cover ground by creating self-regulatory guidelines for businesses and referring cases to the FTC when that guidance isn’t followed.
For the FTC to bring a case, it has to tie allegations to its definition of “unfair or deceptive” under Section 5 of the FTC Act, said Engle, who previously worked in the agency’s Division of Advertising Practices for 30 years.
The challenge is determining to what extent dark patterns overlap with illegal business practices specifically defined as “unfair or deceptive.”
“Dark patterns listed in the FTC’s staff report aren’t defined in the context of Section 5, but that doesn’t [necessarily] limit the ability to enforce behavior that’s shown to be unfair or deceptive,” said Raqiyyah Pippins, partner at Arnold & Porter LLP.
Early days
The most common example of dark patterns is automatic subscription renewals, when customers are billed cyclically without their knowledge or consent.
Restore Online Shoppers’ Confidence Act (ROSCA) was passed in 2010 specifically to protect consumers from illegal billing, including post-transaction charges, and is actively enforced by the FTC.
ABCmouse, for example, is an educational site for young kids that was sued by the FTC in 2020 for illegally billing many thousands of confused and agitated parents.
The site obfuscated the fact that billing would be continuous. And when parents tried to cancel their subscriptions, the absence of a contact forum and convoluted agreement terms that spanned several webpages made canceling almost impossible. “It was like a trap,” Engle said.
This case is a good example of what a dark pattern looks like, Engle added, because it undermines consumer choice. Parents didn’t intend to pay months’ worth of subscription fees.
And, as of late, ROSCA enforcement is expanding to include more manipulations of user choice, including misleading advertising.
Fake news
The FTC actually did enforce ROSCA in a case of false advertising recently.
In 2021, the FTC sued the company MoviePass for charging customers without delivering on what it advertised before going bankrupt in 2019.
MoviePass, a subscription-based app service, launched in 2011 and covered the cost of virtually unlimited movie passes for as little as $10 a month. Predictably, paying customers took advantage of the movie buffet, and the company tried less-than-honest means of making back the money it was losing.
“MoviePass started erecting barriers to cut people off,” Engle said, including requiring customers to upload ticket receipts for reimbursement and feigning security incidents to make customers change their password (and hopefully annoy them out of using the service).
Because MoviePass made it so difficult for customers to use the subscription they paid for through these deceptive tactics, the FTC alleged misleading advertising, an example of a dark pattern.
New horizons
The FTC’s ability to apply ROSCA beyond subscription traps “really expands the application of ROSCA against dark patterns,” Engle said.
An “accept all cookies” button appearing brighter and more visually compelling than the “reject all” button could constitute a dark pattern, for example, because the practice is designed to interfere with users’ choice.
ROSCA enforcement likely will eventually include cookie notifications, Engle added.
More immediately, though, regulators are scrutinizing something called drip pricing, when companies advertise one price but then surreptitiously pile on service fees that don’t appear until the end of checkout.
It’s an extremely common practice on third-party travel and ticket booking sites, said Laura Brett, VP of the NAD.
The NAD doesn’t enforce policy directly, but it advises businesses on complying with federal laws like ROSCA and refers noncompliant business cases to the FTC.
The NAD recently referred a case to the FTC involving the popular online ticket purveyor StubHub, for example, for charging ticket prices that were as much as 20%-30% higher than the price originally advertised, Brett said.
Redressing ROSCA
Even when the FTC readily identifies a dark pattern, enforcement still isn’t straightforward.
The FTC uses ROSCA to compensate victims of business schemes. But months before the FTC sued MoviePass, the Supreme Court ruled that the FTC couldn’t seek financial restitution for cases brought under the FTC Act.
“The FTC is scrambling for other ways to [give] its warrantors some real teeth,” Engle said.
The FTC can, however, seek redress through civil penalties, Engle added, but in the case of MoviePass, it was bankrupt, anyway.
Still, the Court’s decision has been a serious issue because the Commission has relied on customer compensation to help serve justice for decades, Engle said.
It takes a village
For the most part, enforcement against dark patterns will lie with the FTC.
The agency is actively exploring rulemaking possibilities on the data privacy front, which, to an extent, includes dark patterns. Businesses can use dark patterns to collect data improperly by tricking consumers into making certain choices online.
That risk is why state laws will help regulate dark patterns from the privacy side.
The FTC is also still figuring out how it feels about the ad industry governing itself when it comes to consumer protection.
Self-regulation is an important component of compliance because of the FTC’s limited resources and the time-consuming process of gathering public information about cases that garner the agency’s interest.
It’s helpful for businesses to have decisions from self-regulatory bodies that show clear examples of dark patterns at a more rapid pace than the FTC, Pippins said, “provided those bodies are applying the same rubric as the FTC.”
Companies will likely adopt those decisions to avoid engaging in practices that the FTC considers deceptive, Brett said.
One way or another, dark patterns spell out new ways to hold businesses accountable for taking advantage of consumers online.
