It’s Not Just Your Imagination. Apps And Websites Use Deceptive Design Patterns To Collect Personal Information

On July 9, 2024, the Office of the Privacy Commissioner of Canada (OPC), along with 25 privacy enforcement authorities around the world, published their findings following a global privacy sweep conducted earlier this year on more than 1,000 websites and mobile apps.

The global privacy sweep, conducted by the Global Privacy Enforcement Network (GPEN), focused on how online deceptive design patterns may be used to steer users towards options that result in the unnecessary collection of their personal information. Forms of deceptive design include making individuals take multiple steps to find a privacy policy and presenting users with repetitive prompts that may frustrate them into providing more personal information.

The GPEN’s privacy sweep report (the GPEN Report) found that 97% of the reviewed websites and apps use one or more deceptive design patterns.  Additional observations within the GPEN Report include:

• More than 89% of privacy policies were excessively long or used complex language.
• 57% of websites and apps made the less privacy-protective choices easier to select by displaying a “false hierarchy” (i.e., emphasizing certain visual elements and obscuring others).
• 48% of websites and apps preselected the less privacy-protective options when asking users to make privacy choices.
• 29% of websites and apps tried to dissuade users from deleting their accounts by using “confirm-shaming” (i.e., using emotive language such that users gravitate towards options favoured by the organization).
• 35% of websites and apps with an account creation option engaged in “nagging” by repeatedly asking users to reconsider their intention to delete their account.
• 9% of websites and apps forced users to disclose more personal information to delete their account than they had to provide when they created it.

In addition, the OPC published its own sweep report, examining 145 websites and apps accessible in Canada across various sectors, as well as websites and apps that appear to be targeted towards children.

For more information, the GPEN Report can be accessed here, and the OPC’s sweep report can be accessed here.

Summary By: Steffi Tran