Circumvention by design -- dark patterns in cookie consents for online news outlets

1 Introduction

• Privacy regulations provide little or no guidance on the interfaces through which users exercise their data-control rights.The authors frame interface design as consequential because it can help or hinder users acting in their own interests.Source: §1 · p. 1
• All 300 surveyed notices showed some level of unethical practice, according to the authors’ analysis of Scandinavian- and English-language news outlets.The outlets were selected in part because news readers span demographics and the service is expected to serve society, although outlets also rely on online advertising.Source: §1 · p. 2
• The study manually analyzes consent-notice features that are difficult to detect automatically.The dataset contains 300 notices; the authors note that their dataset is smaller than prior work while addressing features difficult to detect automatically.Source: §1 · p. 2
• The authors refine existing consent-notice dark-pattern categories with eight new types specific to this interface context.They argue that regulation protecting user rights should also address interface design.Source: §1 · pp. 1–2

2 Background and related work

• Cookie-consent notices are website pop-ups, banners, or panels used to demonstrate GDPR and CCPA compliance, while those laws provide rights with limited interface guidance.The paper does not analyze the regulations’ legal requirements in detail.Source: §2 · p. 2
• The paper assesses “ease of consent” through dark-pattern use and interaction complexity, including opt-out effort and consistency of terminology.It also considers choice hierarchies and the words used for consent options and cookie categories.Source: §2 · p. 3
• Gray et al. (2018) distinguish five dark-pattern types: nagging, obstruction, sneaking, interface interference, and forced action.Table 1 presents their descriptions of these types.Source: §2 · p. 3, Table 1 · p. 4
• Utz et al. (2019) found that interface choices can affect interactions with cookie notices, while Matte et al. (2019b) detected suspected consent-related violations across European websites.Matte et al. (2019b) reported cases of positive consent being registered without a choice, preselected options, and consent stored after opt-out.Source: §2 · pp. 3–4
• In Nouwens et al. (2020b), only 80 of 680 notices met all three checks: explicit consent, equal ease of acceptance and rejection, and no pre-ticked boxes.Their study also found an approximately 22% increase in acceptance when opting out required at least two clicks.Source: §2 · p. 3

3 Collected data on Cookie notice implementations

• In July 2019, the authors manually collected notices from 300 outlets with Scandinavian-language or English content, then revisited the same pages in April 2020 to identify dark patterns.The collection included 250 online news outlets and 50 online magazines; only sites displaying a consent notice were included, and repeated third-party designs were represented once.Source: §3 · p. 5
• All surveyed outlets exhibited dark-pattern use in July 2019; by April 2020, three pages had no dark patterns, two geoblocked European visitors, and 16 had removed the notice.The collection focused on design features and the ease of refusing data collection consent.Source: §3 · p. 5
• The survey recorded notice position, alignment, size, and whether site content remained accessible while the notice was active or consent was denied.The notice’s vertical position, horizontal alignment, and height were classified into specified categories.Source: §3 · p. 5
• The authors assessed complexity using the clicks needed to withhold consent, the words used to explain data uses, and cookie-information links.They also collected screenshots and consent text, with cookie details and denial-related reconsideration prompts recorded when present.Source: §3 · pp. 5–6

4.1 Existence and examples

• Nagging appears when a site follows a denial with an “Are you sure” message urging the user to whitelist it for advertising.The example is from TV2.no, which links tracking to funding its free news content.Source: §4.1 · p. 6
• Obstruction often hides denial controls behind a separate page and vague links such as “find out more”; one example required browser adjustments to opt out.The authors describe obstruction as the most prevalent pattern and difficult to characterize precisely.Source: §4.1 · p. 6
• Sneaking can presume consent from continued use, making it difficult to distinguish from obstruction and conflicting with the rule that inactivity is not consent.The examples include notices stating that continued use means acceptance.Source: §4.1 · p. 6
• Interface interference includes hidden information, preselection, and aesthetic manipulation; one example reveals the denial option only after a “learn more” link.The initial display is a block of text, while the linked notice allows denial.Source: §4.1 · pp. 6–7
• Forced action includes pop-ups that block site access until users click, as well as geoblocking.Source: §4.1 · p. 7

4.2 Further Dark Pattern Observations

• 45,3% of notices containing dark patterns were classified as Interface Interference (136 out of 300), versus 43% as Obstruction (129 out of 300).Figure 6 summarizes the classifications.Source: §4.2 · p. 7, Figure 6 · p. 8
• Reviewers agreed on pattern presence or absence in 67% of classifications; overlapping categories and different reviewer focuses contributed to discrepancies.Some disagreements reflected reviewers noticing different problems in the same notice, not necessarily conceptual disagreement.Source: §4.2 · pp. 7–8
• Figure 6 shows that some websites now have no dark pattern in their cookie consent notices, unlike July 2019, when all surveyed websites exhibited one; some websites changed their consent design.Source: §4.2 · p. 8

• 297 of 300 websites offered a way to deny consent, but 77 hid it in a scrollable or expandable area and 220 gave denial a different UI hierarchy from acceptance.Source: §5 · p. 8
• Half of the websites required 10–12 clicks to deny all cookies, while all had one-click acceptance; denial effort ranged from 1 to 17 clicks.Only 15 websites offered a direct one-click denial button.Source: §5 · pp. 8–9, Figure 7 · p. 8
• After translating all words into English, researchers found 121 different words used in the clickable area of deny consent; privacy-friendly framing words were not widely used.Source: §5 · p. 9
• Only 125 of 300 websites listed cookie purposes; the study found 201 distinct purpose wordings and an average of 4.7 listed purposes per website.The authors consider it unreasonable to expect users to learn the varied terms.Source: §5 · p. 9
• Exactly 60% of notices appeared at the bottom of the screen, while cited studies differed on whether placement affected consent choices.The authors say more research is needed to understand placement’s possible impact.Source: §5 · p. 9, Table 3 · p. 9
• Scrolling was disabled on 37 sites while the notice was active, 11 used “Are you sure?” messages after consent was denied, and nine stopped providing services after denial.Source: §5 · pp. 9–10
• Third-party privacy handling appeared on only five of the 300 websites, despite its potential to let users configure cookie preferences once for use across sites.The authors acknowledge technical challenges in adding configurable privacy settings to existing websites.Source: §5 · pp. 9–10

6 Discussion - refining dark pattern types in cookie consents

• Cookie descriptions lack common terminology, which burdens users; the authors call for a readable standard and balanced access to explanations for acceptance and denial.They suggest that either both choices lead to an explanation or neither does.Source: §6 · pp. 10, 12
• Consent acceptance and denial should use the same widget at the same level, but checking compliance across more than 1.5 billion webpages must be automatable.The authors note that dark-pattern detection is not currently automatable.Source: §6 · p. 10
• Dark-pattern criteria should be clearly identifiable and computer-detectable, although human reviewers disagree on labels and existing definitions overlap.The authors describe their refined patterns as contributions toward those criteria.Source: §6 · pp. 10–11
• Other patterns include collecting data before consent, unlabeled sliders, an unexplained close button, and consent labels without clear antonyms for denial.The paper notes that detecting data collection before consent requires computational analysis of browser behavior.Source: §6 · pp. 11–12
• The described patterns include no choice, multiple consent panels, cascaded paths to denial, and unequal acceptance and rejection widgets.A choice cascade can require several clicks through information panels before an opt-out appears.Source: §6 · pp. 11–12
• The proposed notice displays categories and choices upfront, uses equally styled buttons, and avoids forcing a choice while explaining how to change settings later.Only necessary cookies are preselected; users can accept or deny all with one click or choose categories individually.Source: §6 · pp. 12–13

7 Summary

• 297 of 300 analyzed notices used dark patterns, and the authors described eight patterns for evaluating whether cookie notices circumvent privacy regulations.The dataset consists of notices from selected online news outlets.Source: §7 · pp. 13–14
• Manual collection produced a smaller, richer dataset and enabled analysis of interaction-design features that are difficult to detect automatically.Source: §7 · p. 14
• The study did not test how dark patterns affect users’ consent decisions; it analyzed implemented designs and opt-out effort instead.Source: §7 · p. 14
• The analysis used laptop browsers and first-visit perspectives, leaving mobile scaling, repeated visits, post-choice behavior, and geographic variation unexamined.The authors also did not compare processing time for accepting versus rejecting consent.Source: §7 · p. 14
• The eight patterns are a non-exhaustive first step, with future work proposed to test automatic identification using crawlers and machine learning.Source: §7 · p. 14