Exploring the intersection of deceptive designs and user perceptions in the data economy

Abstract: When users in the EU visits a website, they will face a cookie consent banner because of the current regulations. A framework called “notice-and-consent” is in place to inform users about cookies and their intentions and to receive consent from the user. Websites have been shown to apply deceptive designs in their cookie notice in order to trick the user into consenting to more cookies than they are aware of, and these deceptive designs are referred to as dark patterns. The framework used today for regulating data collection has met some criticism. It enables businesses to do what they choose with the information they gather as long as they inform the user of their intention. In addition, previous research has shown that businesses can apply dark patterns on the cookie consent notice to gain an economic advantage by making users consent to more cookies than they understand when faced with the decision. This study investigates how websites targeting visitors in Sweden are using dark patterns in their cookie consent notices and how this affects the online experience. Further, this study sought to investigate the end-user’s perception and experience of the data collection climate online by answering the following question: Which dark patterns can be found in the most visited websites in Sweden and how do these affect the users' online experience and perceptions? The research strategy used in this study was a survey strategy. The data collection method was a manual data collection on websites targeting a visitor from Sweden followed by a qualitative online questionnaire, and the data analysis method was a thematic analysis. The study resulted in finding out that 82% of the websites used at least one dark pattern in their cookie and consent interface. The most utilised patterns were Interface interference and Obstruction, found on 62% and 58% of the websites. Most respondents showed signs of irritation or fatigue towards the cookie consent notices or an overall negative perception of the current data collection climate. The respondents also described experiences with the most utilised dark patterns. Further, this study concludes that dark patterns are used as extensively in Sweden as it is in other domains. The regulation that is supposed to protect users might not be the immediate problem but can sometimes be seen as non-existent. A lack of enforcement leads to a market that is free to function on its own. Therefore the responsibility should be removed from the user and instead regulate what is allowed to do with personal data.