Defining dark patterns can feel like trying to catch your shadow in a bottle. Like shadows, dark patterns are ubiquitous, fuzzy and flighty.
They obscure and coopt the things they touch. They are unclear and often inconspicuous. You know them when you see them, but they aren’t always visible to everyone.
When you think about it, maybe shadows are the original dark patterns?
No, not really. Though policy lawyers continue to bemoan how the concept of dark patterns is ephemeral and subjective, in fact the emerging legal concept as applied in the consumer protection context is becoming increasingly solid.
Last week, a judge at the U.S. District Court for the Western District of Washington ruled against Amazon’s motion to dismiss a case brought by the U.S. Federal Trade Commission. The FTC alleges Amazon subverts consumer choice through the use of dark patterns in the consent flows for the company’s Prime service, both at sign-up and when subscribers go to cancel.
The FTC has taken steps to clarify its own approach to dark patterns through enforcement actions but also, most directly, in the 2022 staff report, "Bringing Dark Patterns to Light."
In this case, the FTC does not allege privacy-related dark patterns. It is not a case of consumers being tricked to reveal their personal information or abandon opt-out choices.
But of course, dark patterns can trick consumers out of their money just as well as their data. And how regulators and judges think about dark patterns in the marketing and subscription contexts can have important implications for how they will approach privacy dark patterns.
The lengthy court order rejects Amazon’s motion to dismiss. In U.S. civil proceedings, judges routinely are required to rule on these early motions, which ask them to peek behind the curtain of the facts alleged in the case to determine whether there is anything legally significant lurking back there. If not, the case can be dismissed before the expensive stage of discovery begins.
This step requires the judge to assume that everything the plaintiff alleged — the FTC in this case — is true. Is there enough substance alleged that it would appear possible for the FTC to win on the merits?
This time, the judge ruled in the FTC’s favor. Yes, the allegations meet the minimum standard to proceed with the case. In doing so, the judge gives us a peek into how courts will consider consumer consent and “clear and conspicuous” disclosures in dark patterns cases. Importantly, the finding signals that these cases are likely to turn on a very fact-specific analysis of the context of each case.
Let’s start with the clear and conspicuous standard. The judge examines whether Amazon’s disclosures about its Prime product were clear and conspicuous, not because of general consumer protection requirements, but because of a specific statute that applies to negative option subscriptions like Prime.
Though the Restore Online Shoppers’ Confidence Act does not create the same requirements in the privacy context, the need for clear and conspicuous disclosures is a common privacy requirement with bearing on privacy dark patterns too.
Because ROSCA does not define the clear and conspicuous standard, the judge reviews state and federal laws, other court actions and FTC precedent for better insight into what is required. In short, the judge determines that such a test is based on a reasonable consumer’s understanding of the disclosures.
Amazon’s argument that this is a question of law which can be easily dismissed at the initial stage is rejected. The judge maintains that defendants would only win at this stage if the facts alleged in the complaint compel the conclusion as a matter of law that consumers are not likely to be deceived.”
In peeking at what this analysis looks like in practice, the judge shows that it will depend on the “context of the transaction” and the “visual aspects of the notice” including the formatting of relevant text and buttons as well as the surrounding visual aspects of the page in which they appear. If a reasonable consumer is likely to be deceived by the disclosure, it may not meet the clear and conspicuous standard.
The current federal comprehensive privacy proposal, the American Privacy Rights Act, has its own definition of clear and conspicuous, a phrase that is repeated many times in the draft bill. A disclosure is clear and conspicuous if it is difficult to miss and easily understandable by ordinary consumers. This seems to track closely with the judge’s analysis here.
The judge also analyzes a question of whether Amazon’s Prime sign-up flow obtains users’ “express informed consent.”
This requirement also ultimately derives from ROSCA, though the FTC independently alleges in its complaint that a lack of express consent also violates the FTC Act. In the privacy context, the FTC has not generally expected this level of consent — with the important exception of sharing sensitive data. How courts conceive of express informed consent could have bearing in the privacy dark patterns context, in certain circumstances.
For one thing, express informed consent requires the clear and conspicuous disclosure of all material terms. Materiality in the consumer protection context always indicates whether something could have changed the consumer’s mind. So consent, too, turns on the clarity and obviousness of design elements on the page.
But even if disclosures were clear and conspicuous, consent may not be express and informed. Other factors are particularly important in cases, like the Prime sign-up context, where customers are entering into a contract with the company. But the way the court analyzes this could have implications in other contexts too.
In diving deeper on express informed consent, the judge highlights two aspects: whether the prominent disclosure on the button the customers click disclose the action that is taking place and whether the customer has a sense of choice in proceeding with a transaction.
The first of these may be hard to generalize outside of this case. Here, the button labeled “Get FREE Two-Day Delivery,” as the judge describes, does not make clear that by clicking it "the customer completes the sign up process." Given all of the context of the disclosures, with particular attention on the sign-up button itself, a reasonable consumer may not know that clicking the button constitutes consent to sign up for an auto-renewing subscription.
More relevant to many privacy consent flows, the judge takes initial issue with the discrepancy between how choices are presented to the user.
Though it is, in fact, possible to proceed with the transaction whether or not the customer signs up for Prime, the court expresses concern that the large disparity in design between the choices could lead a reasonable customer to believe the only way to proceed is by signing up. Similar implied lack of agency can be relevant in contexts where consent is sought for personal data and consumers could believe their consent is required to finalize a transaction.
There is still much to decide in this case. Many headlines covering the case focus on the individual liability that Amazon executives may face, which the court has allowed the FTC to continue alleging.
The specific liability flows from ROSCA, not from the FTC Act. But the facts alleged by the FTC include a damning portrayal of the choices the company made about maintaining a format for obtaining consent that was known to cause accidental sign-ups. Allegedly, design changes that increased clarity were even “rolled back” after they were found to reduce subscriber rates.
Such allegations should remind privacy pros that regulators will look to what a company knows when analyzing the deceptiveness of a dark pattern.
If your customers are telling you they feel deceived and manipulated in material ways and you fail to act or, instead, make business choices that explicitly maintain ambiguity, enforcers will take this into account. Dark patterns may be a subjective concept, but as with many aspects of consumer protection the subject who matters is always the actual consumer themselves.
The consumer’s gaze is even more important than the eye of the regulatory beholder.
The contours of dark patterns will continue to become more clear in both the state and federal context. For one, the proposed APRA would ban dark patterns in the privacy context. It may be worth reflecting on whether the preemption provisions of the bill would apply to state laws that cover a broader array of dark patterns. That is, would the APRA as currently drafted limit the ability of states to ban dark patterns that are not related to personal data?
But that’s a question for another day.
Please send feedback, updates and free shipping offers to cobun@iapp.org.
