Dries Cuijpers on How Regulators at Tackling Dark Patterns

Transcript

Marie Potel-Saville  00:24

Hi everyone, and welcome to this new episode of fighting dark patterns regain your freewill online. As you probably know, by now, so called Dark patterns or deceptive design are interfaces that deceive or manipulate users to make them behave either without realising or against their interests. They're also called as I said, deceptive designs and are found in 97% of European favourite e-commerce websites according to a study by the European Commission in 2022. Earlier this year, in 2023, the European Commission and national consumer protection authorities, the so called CPC network, actually screened 399 online shops. They focused on three specific types of dark patterns. The first type was fake countdown timers. The second type was interfaces designed to lead consumers to more purchases or more subscriptions. And the third type was hidden information. Even on such a narrow basis, you know, just three types of dark patterns when we know that there are several hundreds of different types of dark patterns, this investigation by the European Commission and the national consumer protection authorities showed that 148 sites contained at least one of these three dark patterns. So if we look a bit more into the details of that study, basically 42 websites use fake countdown timers with deadlines to purchase specific products. 54 websites directed consumers towards certain choices like subscriptions to more expensive products or more delivery options, or expensive delivery options, either through their visual design or choice of language. 70 websites were found to be hiding important information or making it less visible for consumers. For example, this included information related to delivery costs, the composition of products, or the availability of a cheaper option. So that's obviously you know, nothing really new. But it's really interesting to see the details of that study and on that basis, each national regulator was to contact offenders so that they would rectify their websites or the regulators would take legal action of a specific interest for today's discussion. We're very interested to see that the Dutch authority for consumers and markets, the ACM, conducted a sweep during which they automatically detected countdown timers. The ACM checked 1000s of sites and found that in 41 cases, deals were still available after that timer had reached zero, or that a new timer has started with the same or even a better offer. So this is clearly prohibited, as the audience probably knows by now. The ACM announced that it was reaching out to these companies to confront them with their practices. That's why we're particularly happy to welcome today Dries Cuijpers senior enforcement official at the Dutch authority for consumers and markets. Hello, Dries and welcome to this podcast.

Dries Cuijpers  04:20

Hello, Marie. And thank you very much for having me on ponder pods, and, you know, addressing this really important topic.

Marie Potel-Saville  04:30

Thanks a lot, Dries. So just to give a bit more background about yourself. You are a lawyer and coordinator of the digital economy at the consumer division of the Netherlands authority for consumers and markets. You've got 20 years of experience as an enforcement official in numerous economic sectors. You've actually set up a CMS Behavioural Insights Team, you need to tell us about that, and you managed the team, for the first five years. You have also worked for the OECD on Consumer Policy, and you're a co author of ACM guidelines on the protection of the online consumer. Earlier this year, I heard that you organised the Dutch authority for consumers in markets seminar on fair design in E commerce. Basically Dries, you've been working on dark patterns and deceptive design for long time and you've been collaborating with researchers that we happen to know well like Arianna Rossi who was also a guest of the of this podcast a couple of episodes ago. So Dries, let me start by the first question that comes to mind when seeing the result of the investigation by the CPC network that I was just describing. We’ve seen that there are plenty of dark patterns and deceptive design on retail sites and apps, from a regulators point of view. What are the main harms caused by dark patterns? According to you?

Dries Cuijpers  06:15

Yes, thank you very much very, an indeed a lot of different things that you touched upon that we will definitely, I think, revisit during the interview, but maybe just indeed, to start as sort of high level. I think, first of all, it's important to point out as you did, there, there are, I don't know, many depending on the taxonomy, that you look at many different types of dark patterns. And it's important to stress that not all of them, you know, cause the same kind of harm, some are more harmful, some are less harmful. And I think it's important to stress that we know that they all have an effect but they were all still looking at, you know, to what degree we can actually show the effects based on scientific evidence for all these different dark patterns. And that's still a lot of work in progress, which occupies us but also I know a lot of academics. So I think that's the first point I want to stress. But secondly, and more generically, yes, we do know a lot about the harms of dark patterns. We distinguish, I would say three kinds of harms. The first one is individual harm. So this is the harm caused to a one single consumer. And obviously, you can imagine that the first kind of obvious harm is that people start making decisions that they would have otherwise without a dark pattern not have made, so they're being manipulated, coerced, or steered into directions that they would otherwise not, if gone. So there is clearly potentially a monetary loss of someone buy something more expensive, or something that has a lesser quality. Now in the types of personal harms, you can think about emotional harms, for example, where children are being manipulated in social media. And there is of course, which is something we don't look at but which is important in relation to dark patterns, the privacy lost. So the data that you give away by, you know, being manipulated into handing it over.

Then there is the collective harm. I'm trying to be brief here, but it's first of all, of course, lost consumer trust, which in the end will backfire to the business community, right. Because if people don't trust sellers online, they will eventually buy less, which is not good for our economy. And I think also in also important to stress that there is a potential for dark patterns to have a competitive and negative competitive effect, which obviously, I don't have to tell you as a as a competition lawyer.

Marie Potel-Saville  08:48

In one of my prior lives, yes.

Dries Cuijpers  08:51

Exactly, Yes. So you know, dark patterns potentially create a situation in which the market ends up in a race to the bottom in terms of who is the best one to keep their customers under false pretenses. And I don't think that's a market outcome that we would desire. And I think thirdly, before I go back to you, again, is, you know, we don't know a lot of what the effects in the long term are on people. And then I'm not specifically speaking consumers, but how are people going to behave when exposed to these kinds of influencing techniques over a longer period? And are we going to see a corrosion of autonomous decision making? I don't think we have the answers yet. But we've seen that a pattern is being used, for example, in the scandal around the voting in the American elections with Cambridge Analytica, and we don't know what the long term effects are of people being exposed to these kinds of things. So that's really where I wanted to start.

Marie Potel-Saville  09:57

Thanks a lot Dries for highlighting these three types of harms the individual harm, the collective structural harm, and then the unknown, potential effect on democracy, I have to say that, you know, on democracy specifically where we're actually very concerned at fair patterns about this issue, and to be honest, we're actually working pro bono currently on trying to better understand the effects, for example, on the US elections that are coming in a couple of months. So currently, you know, it's in our r&d lab we're researching, but we're more than happy to help as much as we can on a pro bono basis, because we're like you, we’re concerned that, you know, who knows how people will behave? How much you can manipulate people? And how we all know that our democracies are fragile. We're reminded every single day, sadly. And, yeah, it's definitely a key area of concern for everyone, citizens, regulators. Everyone, really, so thanks. Thanks a lot for raising that.

Dries Cuijpers  11:15

That sounds great. And just to add one thing, maybe because we spoke about the harm, but I think when speaking about harm, you also need to look at prevalence rate. And we know that our patterns are very prevalent you set so in your introduction, and there's many studies that this, you know, confirm this. And even in in E commerce, I'm not even sure if we've seen the tipping point ye, there's actually becoming more dark patterns towards less. So if you add that to the harm, it is a really worrisome development.

Marie Potel-Saville  11:46

Absolutely. Which brings me very nicely, thanks for the transition, to my next question. How much of a priority are dark patterns for your authority? Basically, you know, many laws have been prohibiting deception and manipulation for a long time. We know that, for example, that UCPD is prohibiting them GDPR competition law that you mentioned as well, especially for abuse of dominance. But what basically what's new today with dark patterns fighting and how much of a priority is that for your authority? ,

Dries Cuijpers  12:21

Thank you, Marie. And I think that there's really two questions in one, so let me start with the first one in terms of, you know, how important is this for the ACM. I want to take a step back and tell you very briefly what it is that we envisage as an enforcement agency operating and keeping oversight on digital markets.

So really, what we try and aim to do, is to have open and reliable digital economy in which consumers can make purchasing decisions in freedom. And, you know, that requires a balance between consumers and businesses, we see already is upset. But we see that this you know, the risks and the harms that we see, are actually further being assassinated by dark patterns in the digital economy. So, so that's our starting point of thinking, right. And we have a lot of things that we can do within the digital economy. But clearly, a couple of years ago, we saw the risks that we just discussed during the first part of the interview. And we thought, right, this is something that we need to focus on, this will be a priority for us in the next few years. Let's first of all write down where we think we draw the line per practice and make sure that the business community understands what we expect from them, but that we also convey to consumers what they can rely on.

So in 2020, we published guidelines, which do exactly this. We identified 11, various types of dark patterns very broadly, we drew a line and we've updated those guidelines last year. We’ve also had an extensive campaign, towards the business community of speaking to branch organizations and individual businesses and conferences, to convey those messages. And then at the same time, and I guess we'll probably come back to that at a later stage, we also started enforcing and you already mentioned, the countdown timer, a case that we have, and I'm happy to elaborate on that a little bit later on. But this is the work that we're currently doing. And yes, it has a very high priority within our authority.

Marie Potel-Saville  

It's great to hear thank you so much. Can I ask you, what was the response of businesses, you know, when you publish the guidelines, and obviously, you know, clarity is usually very much welcome. Because you know, what you hear very often on the business's side is that they need legal safety, they need clarity, so that they can behave accordingly. So what was the response basically ?

Dries Cuijpers  

Yeah. So I think the call for legal certainty was probably a little higher prior to the guidelines than after the guidelines. And I think that may be related to the fact that, you know, the clarity that we thought we gave was actually quite restrictive in some ways, and not everybody was ready for that. But generically, I would have to say that I think that the overall response was pretty positive. And it seems like there is a large group of businesses that wants to do the right thing. However, I think it's also become clear over time for us that we still have a serious compliance problem in relation to dark patterns. In other words, to be very concrete, I think many of the legal departments or compliance departments of E commerce businesses have way too little a grip on what is happening in marketing. And there is also still a severe lack of ethical understanding within marketing communities as such, and I know that sounds pretty harsh, but I think it's the truth.

Marie Potel-Saville  16:10

Absolutely. You know, what Dries I couldn't agree more. And, you know, as a lawyer, it pains me to say that, but I've come to the conclusion, after all these years working on compliance and fighting dark patterns, that probably the efficient solution is not to position this as a legal or ethics or compliance issue, it's probably to position it as a brand issue, talking directly to marketing, talking directly to digital teams, and actually showing them that that trust is actually way more efficient, you know, purely in terms of business efficiency. Trust is more efficient than deception and manipulation in terms of avoiding churn in terms of increasing customer lifetime value. I think that's how we need to play it. Otherwise the risk we're taking is basically keeping the topic lawyer to lawyer or lawyer to judges or lawyer to regulators, but missing out on the very people who are actually part of the problem, but also the solution, you know, marketing, digital sales, even. Does that make sense at all?

Dries Cuijpers  17:32

It makes total sense to me. Yes, absolutely. And I think it really taps into what you referred to, as you know, the sustainability, sustainable consumer, a customer business relationship, I think my only worry is that most bonafide businesses will absolutely value that connection. But there is, of course, also businesses that think really short term and short term gains, and then move, you know, to another market or vanish completely. And those will be less susceptible, I would expect, to this kind of reasoning. But I totally agree with you, for the vast majority of businesses. And I think it's also very important, and there is some work being done that I know of, to show you that it's actually long term beneficial to not engage in these techniques.

Marie Potel-Saville  18:18

Exactly. We're working exactly on demonstrating that. And the good news is that, based on our current studies, you don't need to wait that long, actually, when we say long term, you know, people usually roll their eyes. And actually, what we're seeing is that after only six months, dark patterns and fair patterns are revenue equivalent, which means that you haven't lost and you've avoided fines, so you're already getting something. And then after six months, it's really clear that fair patterns are more profitable. So even just you know, putting the issue in purely business and economic terms.

Now, turning to a different question, it may be a bit more, a bit more technical, but still quite interesting. Under the Digital Services Act, the DSA which is by the way, and as we've said many times the first piece of legislation at EU level to expressly prohibit dark patterns and deceptive design as such, each member state has to name a national authority to implement it, without going too much into the technical stuff. Can you share with us? How does that work in the Netherlands?

Dries Cuijpers  19:40

Yes, absolutely. So the answer is actually fairly simple. The ACM that I work for is going to be the digital service coordinator in the Netherlands. And we're also at the same time going to be the competent authority for most of that regulation. So we're going to get a very important role for which we are currently very hard preparing. We've hired people, we're looking into new expertise of course, because we're going to cover things that we haven't done in the past, you know, such as appointing trusted flaggers, or looking into things that go beyond the realm of a of a traditional markets authority, such things as fake news. So, yeah, it is going to be us. And we're, we're making sure that we're ready on the 17th of February next year.

Marie Potel-Saville  20:31

Working hard, I'm sure. This is really exciting and great to know, precisely on all these efforts that your authority is making on dark patterns. Obviously, a key issue with dark patterns is how do we detect them? Because we know they're, as we said, very prevalent, they're pretty much everywhere, but as a regulator, you need to spot them precisely. Can you share a bit more about this automated detection tool that you created? And how do you collaborate with other authorities to perhaps, you know, neutralize detection?

Dries Cuijpers  21:13

Yeah, sure. And this is one of the other challenges, but also very exciting pieces of way that we're currently doing.

I think, first of all, you know, dark patterns can be detected manually, as we have done for ages, right within most of the enforcement communities. And we can still do that. And it's still needed for some dark patterns, because they may be pretty hard to detect in an automated way as technology stands today, which doesn't mean that we probably couldn't do it tomorrow, because things are moving very fast. But I think there's, there's a couple of things to say here.

So first of all, we're very much using an interdisciplinary approach within the authority. We have had a behavioural team for 10 years now, and you said in the introduction, that I started it, but it's fortunately being led by people that really know what they're talking about, because I'm a lawyer, and certainly not a psychologist. And this team is, is consistently of 11 people that serve the entire authority, they have been very much instrumental to our thinking around dark patterns, and understanding the harms and understanding the way these techniques work.

In addition to the last five years or so, we've had a task force for data in AI, which is basically a team of around 25, technicians, people that can do things as I absolutely do not understand still, and they are building in house tooling that we actually use to detect dark patterns, such as the tool that detected those countdown timers that you just mentioned. So it is a real collaboration internally, within, you know, traditional lawyers, economists, but also behavioural people, and technical people, I think that's first and foremost, probably, I would say, the most important development in terms of our capacity to detect and enforce.

And then of course, there is the international cooperation both in a European and worldwide level. But I think very important to mention that the European Commission has been running a project for, I think, a year and a half now, where they have built a digital lab which can be used by law enforcement agencies or consumer enforcement agencies within Europe. It also provides technical tools and assistance to do this kind of work. And then, of course, you know, nationally, we're not we're not the only enforcement agency that deals in the internet with a digital realm. So we are also cooperating with other national enforcement agencies, like the authority for financial markets, or the Data Protection Authority. We also set up a Cooperation Platform for digital enforcement agencies, and one of the focuses of that platform is the cooperation on these kinds of issues. So I think there's a very broad plethora of things that we're doing to make sure that we stay on top of things.

Marie Potel-Saville  24:15

This is absolutely great to hear. And that's music to my ears, really, because, as you know, we are also working on automated detection of dark patterns. By the way, we're using Gray's ontology. We've been collaborating with Colin grey, to match basically his ontology and our fair patterns and we'll be releasing that work very, very soon. But yeah, well it's really important for us to praise Collin’s work as well, because as you know, he has been involved in a number of enforcement proceedings on the other side of the Atlantic, and one of the frustrations was that on his side was that precisely, you know, some offenders could get away because of the current lack of clarity as to the types of dark patterns and the taxonomies. So I think that there's a lot of progress here in the ontology, thanks to his ontology. Anyway, we're working hard on automating the detection. And exactly as you said, the key is multidisciplinary team in our r&d lab. So as you said, you know, it's human computer interaction, it's neurosciences, it's obviously behavioural sciences as well, data engineers, software engineers, that's what it takes to tackle one of the most pressing issues of our digital times. Now, you know, zooming slightly outside of the EU, precisely crossing the Atlantic again, how do you see the FTC's enforcement in the US? Have they been looking at what you've been doing before? Maybe and trying to replicate that in a way in their own jurisdiction? Do you think you've influenced their enforcement in some ways?

Dries Cuijpers  26:26

It's always hard to tell so I won't respond to that directly. But I think it's first of all, very important to point out that we need the US and the FTC in this respect because there are so many big tech companies that fall within their jurisdiction, and that are much easier to address by them than by us. So I think that's all alone. This is a corporation that we value and need. I think, frankly, the US, certainly, in terms of enforcement has been a bit slow at first to look at these issues of dark patterns. But they have certainly caught up over the last I would say maybe three to three years.

Marie Potel-Saville  27:08

Yeah, they're full speed, right? Absolutely.

Dries Cuijpers  27:10

Yes. So we're very happy about that. And I think, like I said, it is vital that they are part of this fight. It's also very encouraging to see that around the globe also, in other jurisdictions, for example, like India, which is a big country that has a vast number of businesses that engage in E commerce. They are also embracing these ideas, and also incorporating these norms into their legislation. So it's not just the US, but of course the US is, is a very important one. I think for the US, it was an important development which I think is inherent to the way enforcement is organized. In the US there is a very close collaboration between data protection, and consumer protection, because it's all combined in one authority : the FTC, which of course, we in the Netherlands do not have, and I don't think it's the case in most European jurisdictions. So definitely, we need to work a little harder to tie the two together, we're certainly doing that.

Marie Potel-Saville  28:16

That's great to hear. And actually, it makes me think of a conversation we were having a couple of weeks ago with one of the largest law firms in the US. They were sharing with us that a couple of years ago, maybe four or five years ago, when their clients would come to them on their digital assets to have an audit and a risk assessment for example, there would not necessarily say that dark patterns were a very pressing issue, basically. But interestingly, because of the FTC is catching up on enforcement, and we've seen that very clearly with Epic Games, Amazon, etc, over the past three years, that major US law firm, was explaining to us that they actually moved dark patterns up their risk assessment pyramid. And I think, you know, it's also very encouraging to see that, you know, everybody is contributing to the fight in a way. And you were mentioning India which brings me very nicely to my next question. So thanks. Thanks again for easing the transition. Obviously, we're seeing an increasing number of new laws, banning dark patterns and deceptive design around the world. So you've mentioned India, but we know that there's also Australia Japan, New Zealand, you name it, many, many other countries are working on it. So how do you see the future of regulation on deception and manipulation online ?

Dries Cuijpers  30:00

I can only speak for the European setting, right. But just to mention that I think this is also where the US and the FTC may be struggling a bit because of the deadlock in US Congress, there is not being any new legislation, drafted as far as I know, or maybe it is being drafted but not adopted so they're actually using other rulemaking powers that they have now to circumvent this issue, which is, of course, a very different situation than the one in the EU, where we are overwhelmed by new legislation in this respect, and I mean that in a good sense. There is a lot happening indeed, and, and I think we could probably fill another podcast on all the different proposals that we have, and the ins and outs in relation to deceptive design or dark patterns, just to name a few off the cuff. You already mentioned that we spoke about the DSA which is, of course important, because it's the first piece of legislation that really prohibits dark patterns by name. But there is obviously something in the data act in relation to IoT products, we have the AI act coming up which prohibits the use of some subliminal techniques and also has a prohibition on abusing vulnerabilities of groups. Then, of course, we have the DMA that speaks about dark patterns in relation to gatekeepers. That I think these are all sort of piecemeal references to dark patterns. What I am really looking at and what I have my hopes up for really is a legislative development which is discussed a little less, which is called the fitness check on digital fairness.

Marie Potel-Saville  

Thanks for mentioning it. I was hoping you would !

Dries Cuijpers  

Absolutely. Because that basically what he does it is it revised revisits the regime, the entire regime of consumer protection in the EU, I it actually assesses whether those those pieces of legislation, you know, the ones that we use on a daily basis, whether they are still relevant in terms of the new digital reality. And I think and I've good hopes that, you know, this is going to change some of the fundamentals of this legislation, so that we can actually address the patterns more easily saying that I think we can already do a lot based on the current legislation, as we've shown in our guidelines. But you know, I'm really looking forward to valuable additions and we can go into more detail because as as ACM, we submitted a list of things that we think should be adopted into the guideline. So I'm happy to mention those. But I'm also happy to, you know, go any way you want. But I think this piece of legislation is something to keep your eye out for, because it's going to is going to be very important in this respect.

Marie Potel-Saville  33:06

Definitely. And for our listeners, we're actually talking to the European Commission on the ongoing sanity check on digital fairness that you just mentioned, as you know, the public information is that the results will be published in 2024. We're hoping that we can have someone from the European Commission coming to the podcast at that time to share the results once they're fully public. But yes, I think that digital fairness is really the new trend right and that's what we're seeing also in outside of the EU. So digital fairness is there to stay and that's probably the way forward. Now, this is unfortunately, the time for our last question, but it's a traditional one and very important one that we ask to all of our guests in this podcast. Dries today share very practical advice to companies to avoid dark patterns.

Dries Cuijpers  34:13

Yes absolutely and I thank you for you taking me on board in a tradition now. Yeah. I think first and foremost, you know, you actually just mentioned it and I think that was going to be my recap as well. What we need in E commerce is fairness by design, we can no longer live in a world, where companies are allowed to manipulate consumers into making decisions. It's not what you want as a society. I think it's not what we need. And it certainly doesn't justify the short term gain. So this is a system that needs to change. And I think the thinking that we need to have from now on is : how do we create designs that are fair to consumers?

Now, I think there's two things that I would advise to businesses to do and I think we discussed the first one already implicitly is : investing compliance, invest in trust. Consumers can sometimes trust, but there's actually nothing to trust there. So what we need is justified trust or reliable trust. So I think that needs to be done in terms of substance and process, right? So substances, make sure that you know where the red lines are, what you can and can't do within the legislation, hire advice, if you have to. Understanding that compliance departments still have many more competition and GDPR lawyers than they have consumer lawyers, that should change. I think also as to terms of process, so how do you make sure that everything that happens in this very volatile quick marketing department does actually get a sanity check ? does get a check whether people are potentially being misled, even if that happens subconsciously ? So there needs to be a process which guarantees that and I think one way of doing that, and I get to my second piece of advice, and we've been seeing this ever from the start that we published our guidelines is : Test, test and test them.

Businesses are absolutely testing full on all the time to see whether something sells or not. They have all the data and the capabilities to do exactly the same in terms of comprehension. How do consumers respond to my selling techniques? And am I actually persuading someone to buy something? Or do I happen to be manipulating someone into buying something ? And this you can find out as a business, you don't have to wait for us to step in, you may probably not even want to wait for us to step in and frankly, we don't want to step in if we if we don't have to do. So, you know, this is and there are some encouraging signs also in terms of collaboration on this in the Netherlands, where businesses are thinking of doing this more or less jointly. So I think that would be my second piece of advice.

Marie Potel-Saville  37:25

Absolutely love this piece of advice. Testing is key. We've been doing that for a long time, we've got a user testing lab, specifically dedicated to that. And I guess to end on a positive note, we're seeing an increasing number of clients coming to us because they've identified an issue. They don't necessarily know how to fix it, they don't know how to transform dark patterns into fair patterns, but they're willing to try and they're willing to test. Basically what we do is AB testing also to reassure them on the fact that they're not going to affect their business goals in the middle term. So that's probably a positive note to end this episode. Stay tuned for the next episode of the fair patterns podcast, because we're going to have as a guest, Harry Brignull, almost in the flesh, at least, virtually on the podcast, but Harry Brignull on his book, obviously, deceptive design, and we can't wait for that episode. Thanks, a million Dries, it's been an amazing conversation. Thanks a lot for sharing all these insights. I actually learned a lot today. So thanks a million.

Dries Cuijpers  38:52

Thank you very much Marie for having me on the pod. It was also really interesting for me and to learn what you were doing. And I wish you a lot of fun with Harry because I know that's another person who's very knowledgeable on this topic.

Marie Potel-Saville  39:06

Brilliant. Stay tuned and stay fair. Fighting dark patterns, a podcast by Amurabi. For further information, you can go to fair patterns.com

‍