Takeaways For Digital Advertising Businesses from the FTC Staff Report on Dark Patterns

By Ryan Smith (ryan@thenai.org)

On September 15, 2022, the FTC released a staff report (“Staff Report”)¹ on dark patterns, based in part on a 2021 workshop for which the Network Advertising Initiative (“NAI”) submitted comments.² The Staff Report is largely in line with what the NAI has previously published on dark patterns.³ The NAI agrees with the FTC’s goals in bringing awareness to this practice and maximizing transparency in digital advertising through the implementation of effective notice and choice for consumers concerning the use of their personal data. Dark patterns relate to a set of business practices that impair or impede consumer decision-making and choice.

The Staff Report is neither a formal regulation nor a rule from the FTC, and as such it does not carry the force of law. Nor is it a settlement reached with the FTC over alleged wrongdoing–however it does explicitly refer to various related settlements the Commission has reached over the years. In some cases, the Staff Report offers recommendations for businesses that may not align exactly with previously established legal or regulatory requirements or settlements. Regardless, the NAI believes the Staff Report is instructive and should be seen as an outline of business practices the FTC may consider enforcing under Section 5 of the FTC Act (15 U.S.C. §§ 41 et seq.). While the Staff Report broadly pertains to dark patterns across the internet, in this blog we are focused primarily on those practices that pertain to consumer choices around collection of their personal information. 

The NAI’s Best Practices for User Choice and Transparency

The NAI takes its role as an advocate for privacy, trust, and accountability seriously. The rigorous annual compliance process all NAI members must go through helps ensure that NAI members are laying out privacy choices for consumers in clear, easy to understand methods, and that all disclosures are complete and accurate. Certain concerns the FTC shares, such as companies refusing to allow consumers to definitively reject data collection or use, are addressed by complying with the NAI Code.

The NAI Code does not specifically address the use of dark patterns. However, in promoting our mission of privacy, trust, and accountability, we believe members should maximize transparency and consumer choice; in doing so, they will avoid many of the dark patterns the FTC staff outlined in the Staff Report. The NAI consulted with industry partners and privacy attorneys, and carefully reviewed state law and regulations and available FTC settlements to outline the best

practices listed below that pertain to interfaces enabling transparency and choice for consumers. We caution that this does not constitute legal advice. All NAI members should consult with counsel to determine how the law applies to their specific business practices.

• Clearly include all material terms when obtaining user consent;

• State terms and conditions in ways that are easy to understand. Ensure that these terms and conditions include information on the collection of data, as well as its use and sharing;
  
• Avoid employing “negative options” where a consumer’s silence or failure to take an affirmative action is taken to be consent;
  
• Visually display choices in a way that clearly presents options and alternatives;
  
• Make opting out an easy process and provide consumers with complete information about the process.⁴

The FTC urges companies to refrain from “highlight[ing] the company’s preferred choice while graying out the disfavored option” in presenting consumer choice mechanisms.⁵ The NAI’s guidelines explicitly state that such design elements are out of line with the NAI Code.⁶ FTC staff say that choice should not be “illusory [or] presented in a way that nudges consumers towards increased data sharing.”⁷ The NAI Code and best practices do not permit the use of choice mechanisms by member companies that subvert user choices, but at the same time the NAI notes that member companies have a right to inform consumers about what their services do. A statement of fact, as opposed to a “nudge,” will state what data the NAI member collects, and why it collects it. NAI members are able to state that tailored advertising helps keep the internet free to use, and in fact are encouraged to do so, as long as the user’s opportunity to opt-out is not impeded.

Key Takeaways and Additional Considerations from the Staff Report

As noted above, the scope of the Staff Report is broader than the NAI’s focus on these practices, and in many cases broader than application to the digital advertising industry. The NAI is pleased to note that the Commission’s enforcement actions to date (and the bulk of this Staff Report) share a particular emphasis on business practices that cost consumers money. Nevertheless, many of the FTC’s concerns about user interfaces are instructive and should be taken into consideration by NAI members and others across the industry.

Also, more broadly, the Staff Report highlights the following practices as examples of what not to do in designing consumer-facing choice mechanisms:

• Design elements that obscure or subvert privacy choices. FTC staff address this issue in the fourth section of the Staff Report. In this section they outline concerns that, due to dark patterns, consumers may be unaware of the privacy choices they have online or what those privacy choices might mean.⁸ In this section, they discuss a series of related enforcement actions the Commission has brought regarding privacy choice interfaces, including Vizio.⁹ They also pose three recommendations that businesses should take to avoid subverting consumer privacy choices:

• First, companies should avoid default settings that lead to the collection, use, or disclosure of consumers’ information in a way that they did not expect (and collect information only when the business has a justified need for collecting the data).
  
• Second, companies should make consumer choices easy to access and understand.
  
• Third, choices about sensitive information, in particular, should be presented so that it is clear to the consumer what they are consenting to – as opposed to a blanket consent – and should be presented along with information that they need to make an informed decision (for example, that if the consumer consents to the collection of their information, that information will be shared with third parties). More generally, businesses should take a moment to assess their user interfaces from a consumer’s perspective and consider whether another option might increase the likelihood that a consumer’s choice will be respected and implemented. 

• Design elements that induce false beliefs. The FTC staff urges companies to avoid design elements that mislead consumers to make choices they would not otherwise make. For NAI members, this could mean an opt out mechanism that incorrectly reflects when a consumer has opted out of tailored advertising. The FTC staff notes that “[c]ompanies are on the hook for the net impression conveyed by the various design elements of their websites, not just the veracity of certain words in isolation.”¹⁰
  
• Design elements that hide or delay disclosure of material information. The FTC staff encourage companies to avoid hiding or obscuring material information, including “burying key limitations of the product or service in dense Terms of Service documents that consumers don’t see.”¹¹ The NAI Code requires members to provide “prominent notice” for consumers, to ensure that consumers visiting NAI member websites are aware of their option to opt out of targeted advertising.¹²
  
• Design elements that lead to unauthorized charges. While the FTC specifically cites settlements with companies that make it hard for consumers to cancel recurring paid subscriptions, the NAI urges member companies to take a similar approach to designing opt-out interfaces. FTC staff urge companies to avoid “high friction experience[s]” that frustrate consumers and cause them to give up.¹³ The FTC staff says that, “at a minimum, companies looking to stay on the right side of the law should make sure their procedures for obtaining consent include an affirmative, unambiguous act by the consumer.”¹⁴

Dark Patterns and Location Data

One particular concern the FTC staff explicitly address in the Staff Report is the collection and use of location data, noting, “subverting a consumer’s privacy intentions with respect to location information would be highly problematic.”¹⁵ The NAI has been an industry leader in this space, recognizing the particular sensitive nature of Precise Location Information (PLI),– in contrast to coarse or broad location information such as neighborhood, city, or state-level information. The NAI compliance team actively works with members to ensure responsible stewardship and use of consumer PLI. In particular, NAI members collecting PLI are obligated to get consumers’ opt-in consent before collecting such information, and notice of its collection must be provided at the time of collection through just-in-time-notice.¹⁶

In June 2022, the NAI released a set of voluntary enhanced standards for the collection and use of certain sensitive locations, including places tied to religious worship, sensitive healthcare services (including reproductive healthcare services), military bases, and LGBTQ+ identity.¹⁷ These voluntary standards create restrictions on the use, sale, and transfer of location data around these sensitive points of interest. 

Conclusion

The NAI appreciates the FTC’s release of detailed recommendations for companies seeking to avoid interfaces that subvert consumer choice and decision making. Responsible companies in the digital advertising ecosystem will join NAI members and avoid deceiving, misleading, or obfuscating consumer choices about the collection and use of their consumers’ personal data. The NAI will continue to work with the FTC and other state and federal regulators as they strive to provide clarity around requirements for consumer choice, and we will continue working with member companies to implement notice and choice interfaces that adhere to these requirements.

Footnotes

1. See Fed. Trade Comm’n, Staff Report: Bringing Dark Patterns to Light (Sept. 2022), https://www.ftc.gov/system/files/ftc_gov/pdf/P214800%20Dark%20Patterns%20Report%209.14.2022%20-%20FINAL.pdf.
2. See Network Advertising Initiative, Comments from the NAI: Bringing Dark Patterns to Light (Mar. 15, 2021), https://thenai.org/wp-content/uploads/2021/07/nai_comments_ftc_dark_patterns_15march2021.pdf.
3. See Network Advertising Initiative, Best Practices for User Choice and Transparency (May 12, 2022) (hereinafter “Best Practices”), https://thenai.org/wp-content/uploads/2022/05/NAI-Dark-Patterns-Final-5.12.22.pdf.
4.  Id.
5.  Id.
6. See Best Practices, supra note 3, at 14.
7. See Staff Report, supra note 1, at 15.
8.  Id. at 15.
9. FTC v. VIZIO, Inc. and VIZIO Inscape Servs., LLC, (D. N.J.); FTC Press Release, Vizio to Pay $2.2 Million to FTC, State of New Jersey to Settle Charges It Collected Viewing Histories on 11 Million Smart Televisions Without Users’ Consent (Feb. 6, 2017), at https://www.ftc.gov/news-events/press-releases/2017/02/vizio-pay-22-million-ftcstate-new-jersey-settle-charges-it.
10. See Staff Report, supra note 1, at 6.
11. Id. at 7.
12. See Network Advertising Initiative, 2020 NAI Code of Conduct (hereinafter “NAI Code”) § II.B.1.
13. See Staff Report, supra note 1, at 14.
14.  Id.
15. Id. at 16.
16. See NAI Code at 8.
17. See Network Advertising Initiative, Precise Location Information Solution Provider Voluntary Enhanced Standards (June 22, 2022), https://thenai.org/wp-content/uploads/2022/06/Precise-Location-Information-Solution-Provider-Voluntary-Enhanced-Standards.pdf.