Dark and Bright Patterns in Cookie Consent Requests

2025-09-21

AI Summary

This study investigates whether “dark patterns” in cookie consent interfaces undermine users’ substantive control over personal data—thereby violating core principles of EU privacy law—through manipulative interface design. Two preregistered online experiments employ randomized controlled designs, integrating behavioral logging and validated subjective scales to systematically assess the effects of default settings, aesthetic manipulations, and friction-based mechanisms. Introducing and empirically validating the novel concept of “light patterns”—privacy-preserving interface nudges—the study finds that while most users exhibit consent inertia, privacy-friendly defaults and moderate friction significantly increase selection of privacy-enhancing options. Contrary to expectations, friction also enhances perceived user control. These results reveal the nuanced, non-monotonic influence of interface design on autonomous consent, offering both conceptual innovation—namely, the formalization and validation of light patterns—and empirical foundations for regulatory frameworks governing privacy interfaces.

Technology Category

• Humans and AI: Intelligent User Interfaces
• Machine Learning: Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy

Application Category

• Responsible Web: Consent frameworks and practices on the web
• User Modeling, Personalization and Recommendation: Accountability, Transparency, and Ethics for personalization
• Economics, Online Markets and Human Computation: Fairness, privacy, and diversity in economic environments

Abstract

Dark patterns are (evil) design nudges that steer people's behaviour through persuasive interface design. Increasingly found in cookie consent requests, they possibly undermine principles of EU privacy law. In two preregistered online experiments we investigated the effects of three common design nudges (default, aesthetic manipulation, obstruction) on users' consent decisions and their perception of control over their personal data in these situations. In the first experiment (N = 228) we explored the effects of design nudges towards the privacy-unfriendly option (dark patterns). The experiment revealed that most participants agreed to all consent requests regardless of dark design nudges. Unexpectedly, despite generally low levels of perceived control, obstructing the privacy-friendly option led to more rather than less perceived control. In the second experiment (N = 255) we reversed the direction of the design nudges towards the privacy-friendly option, which we title "bright patterns". This time the obstruction and default nudges swayed people effectively towards the privacy-friendly option, while the result regarding perceived control stayed the same compared to Experiment 1. Overall, our findings suggest that many current implementations of cookie consent requests do not enable meaningful choices by internet users, and are thus not in line with the intention of the EU policymakers. We also explore how policymakers could address the problem.

Problem

• Investigating how dark patterns in cookie consent requests undermine EU privacy law principles
• Examining effects of design nudges on user consent decisions and perceived data control
• Exploring whether bright patterns can effectively promote privacy-friendly consent choices

Innovation

• Studied dark and bright patterns in cookie consent
• Tested nudges like default, aesthetic, obstruction
• Found obstruction increases perceived user control