Have you ever received unsolicited emails from a web site you visited briefly and struggled to exit? Have you ever grown frustrated because you could not find the “Close my account” option on an online vendor’s website you no longer wished to patronize? Chances are, you fell victim to Internet Dark Patterns. Dark Patterns are ergonomic ruses on web sites and apps intended to trick users into accepting services, making choices, or, worse, surrendering personal data against the users’ intentions.1 These ruses or tricks can be drawn from advanced behavioral psychological studies and are designed to favor the entity behind the web site. Recently, Senators Mark Warner (D-Va.) and Deb Fischer (R-Neb.) introduced a bi-partisan bill, the Deceptive Experiences To Online Users Reduction (DETOUR) Act, to partially ban these clever but arguably controversial practices.2
The Act would apply to “large online operators,” which it defines as any person that “provides an online service” to “more than 100,000,000 authenticated users . . . in any 30 day period” and that is subject to the jurisdiction of the Federal Trade Commission (“FTC”). An “online service” is a service made available to the public over the Internet, such as a search engine, an email service, or a social media site, but not an Internet access service. The Act’s flagship prohibition bars the creation of user interfaces that have “the purpose or substantial effect of obscuring, subverting, or impairing user autonomy, decision-making, or choice to obtain consent or user data.” Additionally, in a nod to the fact that Dark Patterns are usually the end result of behavioral research by Internet users, the Act bans large online operators from segmenting their consumers “into groups for the purposes of behavioral or psychological experiments or studies, except with the informed consent of each user involved.” Finally, in an attempt to address the addictive nature of some Internet activities, especially among children, the Act prohibits large online operators from creating online interfaces directed to children “under the age of 13, with the purpose or substantial effect of cultivating compulsive usage, including video auto-play functions initiated without the consent of a user.”
Apparently mindful that behavioral or psychological studies provide the methodology behind Dark Patterns, the bill would create duties for large online operators that engage in research in this area based on their users’ activity or data. The operators would be required to disclose to their users and to the public “any experiments or studies” conducted “with the purpose of promoting engagement or product conversion.” The disclosures must occur routinely, but not less than every three months, and must be “clear, conspicuous, . . . and [] not deceptively obscured.” Moreover, large online operators must launch an Independent Review Board to police this research, with authority to approve, force modifications, or disapprove the experiments. The Board must register with the FTC and disclose how it will operate and whether its board members might be conflicted.
Additionally, the proposed Act authorizes large online operators to form an association registered with the FTC as a professional standards body, subject to the FTC’s approval and authority. The association must have the authority to compel its members to comply with the Act and to impose sanctions of increasing severity up to and including expulsion for non-complying members. The association must welcome within its membership any large online operator and must assure a fair representation of its members through its governing bodies. At least one of its director must represent users and be independent of large online operator. The goals of the association would be
to prevent exploitative and manipulative acts or practices, to promote transparent and fair principles of technology development and design, to promote research in keeping with best practices of study design and informed consent, and to continually evaluate industry practices and issue binding guidance consistent with the objectives of th[e DETOUR] Act.
Finally, the proposed Act grants rule-making and enforcement authority to the FTC. The FTC shall determine an act or practice is unfair or deceptive if the act or practice—(A) has the purpose, or substantial effect, of subverting or impairing user autonomy, decision-making, or choice to obtain consent or user data; or (B) has the purpose, or substantial effect, of cultivating compulsive usage by a child under 13.
The FTC would be further tasked with developing and promulgating regulations for securing users’ informed consent and for overseeing review boards and the standards bodies. This first requirement is significant because it represents the first legislative attempt to regulate online consent, which most users currently grant by click-through without ever giving a moment’s thought to the corresponding use terms and conditions.
Senators Warner and Fisher introduced the DETOUR Act on April 9, 2019, and it might be years before this bill, or some variation thereof, becomes law. In any event, the bill’s reach is relatively limited because it would apply only to large online operators with more than 100,000,000 users. But, it is arguably a step in the right direction to balance the rights of users and large Internet operators.