I'm Arunesh Mathur this is joint work with Jonathan Mayer and Mihir Kshirsagar
So what is a dark pattern? Here is one example called trick questions
This interface is asking you for your consent to send your marketing material
and to share your data with third parties
Say you wanted to opt out of both practices
You'd be inclined to uncheck both these check boxes
If you were to uncheck the first box you would indeed opt out
but pay close attention to the second
If you were to uncheck it you would actually be opting in
This is not an isolated example
Researchers have created taxonomies that categorize various kinds of dark pattern user
interfaces and these taxonomies have helped us better understand what these interfaces look like
Yet many questions remain unanswered
How do we define a dark pattern user interface?
What makes a dark pattern normatively problematic?
How can researchers help policymakers decide
when to intervene against certain classes of user interfaces?
To answer these questions we first reviewed the dark patterns literature from the HCI community
the security and privacy communities as well as current legislation and
regulatory materials about dark patterns
Reviewing this literature we observed that there is a significant variation
among the facets of dark patterns that the definitions highlight
These definitions diverge along these facets and often contain
inconsistencies with the dark patterns that they then go on to list in the taxonomies
And that is why it is challenging to define a dark pattern
because there are different concepts at play here
Having reviewed this literature we argue that at their core
dark patterns are choice architecture modifications
They either modify the decision space
or they manipulate the information that is available to users
But more importantly both of these represent themes not a single definition
In fact this parallels Daniel Solove's now seminal observation that privacy is not a single concept
instead it is a family of related but distinct concepts
We argue that rather than focusing on a single definition we as a community
should focus on the normative considerations that motivate the underlying descriptive
themes to ultimately decide when a user interface is a dark pattern
Choice architecture research in other disciplines has already done this
we do this here for the dark patterns literature
And we described four normative lenses that can help us examine dark patterns
For example consider this cookie banner which is designed to induce users to allow tracking cookies
Under the individual consumer welfare lens we might consider the user interface a dark pattern
because it results in a loss of individual privacy
Under the collective welfare lens we might consider the user interface a dark pattern
because it benefits marketplace incumbents who can aggregate and
leverage a large volume of personal data leading to reduced market competition
Under the regulatory compliance lens we might consider the user interface
a dark pattern because it frustrates or violates the purposes of the GDPR
Finally under the individual autonomy lens we might consider the user interface the
dark pattern because users may be unaware of the choices that are available to them
thus depriving them of autonomy in their decision making
So these normative lenses offer us different perspectives to view dark patterns
We argue that HCI researchers can use well-established empirical
methods to analyze dark patterns through these normative lenses
Such an analysis can help us move beyond the ad hoc and descriptive
labels that we currently have for dark patterns
and instead focus on assessing how dark patterns raise specific normative concerns
So how can we use this framework to analyze dark patterns?
Well consider the trick questions user interface that I described at the beginning of this talk
We start by selecting a normative lens
Say we were to pick the individual welfare lens
We would then select a measurement method
Say we selected a lab experiment method
Under the individual welfare lens we would start by selecting a specific
kind of welfare that we may want to measure
Here that may be a loss of privacy
We next select a metric to study the loss of privacy and one such metric could be
examining users' privacy preferences
Finally we contextualize the metric by comparing it to a baseline
There are many ways to select a baseline
One baseline could be the trick questions dark pattern without the actual trick
We could then interpret a sufficient deviation from the baseline to conclude
that trick questions is in fact a dark pattern under the individual welfare lens
This is the kind of evidence that we could provide
a regulator to prove that trick questions is in fact unlawful
Over here we compared the trick questions interface to a baseline
but you could imagine other designs where we determine how much of an outlier
this user interface is in the space of consent interface designs more generally
But instead of the individual welfare lens say we were to pick a different lens
like the individual autonomy lens
Say we selected a measurement method again say a survey method
Under the individual autonomy lens we would again select a metric to study the loss of autonomy
and one such metric could be whether users notice the available options in the interface
But in this instance rather than contextualizing the metric by
comparing it to a baseline we could examine it in isolation
And we could interpret if only a small proportion of users recognize the full range of options
as evidence that requisitions is in fact a dark pattern under the autonomy lens
Of course there are a variety of different considerations that go into
designing such a user study
Our paper highlights several of these and I encourage you to check it out for more details
I'm happy to take any questions
Thank you so much