The Federal Trade Commission (FTC) has released a staff report, Bringing Dark Patterns to Light, which discusses misleading and manipulative design practices—dark patterns—in web and mobile apps. These design choices take advantage of users’ cognitive biases to influence their behavior and prevent them from making fully informed decisions about their data and purchases. Dark patterns are employed to get users to surrender their personal information, unwittingly sign up for services, and purchase products they do not intend to purchase. The consequences of dark patterns have been increasingly noticed in the regulatory and legislative sphere, both in the United States and Europe.
Dark patterns are found in many industries, including children’s apps and websites. For example, dark patterns resulting in unauthorized charges have been used in children’s gaming apps, where a button to advance to the next level will unexpectedly change to a “buy” button or an app advertised as “free” will bury hidden charges within the game and in fine print that is difficult to read. These practices have led to unaware players and their parents racking up anywhere from a dollar to hundreds of dollars in charges from a single app or website. The FTC has brought enforcement actions against various companies engaging in these practices.
California has also taken an interest in this issue. Last week, Governor Gavin Newsom signed a landmark California bill aimed at protecting children’s digital welfare. The bill, titled the California Age-Appropriate Design Code Act, prohibits the tracking of children’s geolocation unless absolutely necessary for providing the website or app’s service and requires websites to default to the most privacy-protective settings for underage users. A child is “a consumer . . . under 18 years of age.” Cal. Civ. Code Section 1798.99.30(b)(1). This is a notable and expansive departure from the under the age of 13 standards used by the Children’s Online Privacy Protection Act of 1998 (COPPA). 15 U.S.C. 6501, et seq. As a result, businesses with consumers over 13 but under 18 should take another look at their privacy practices to ensure that they are compliant with the new California law. The California Age-Appropriate Design Code Act also explicitly bans the use of dark patterns “to lead or encourage children to provide personal information beyond what is reasonably expected” to provide the service. This Act will go into effect in 2024 and covers the same companies that are already regulated by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Whether other states will follow suit remains unknown, but it is evident that dark patterns are gaining public attention.
For more information, please contact the authors or your usual point of contact at Squire Patton Boggs.