California Bans “Dark Patterns” Under Landmark Privacy Law

New regulations were approved under California’s Consumer Privacy Act on Monday that will prohibit the use of so-called dark patterns — tricks deployed by websites or apps that seek to frustrate or bamboozle users into doing things they wouldn’t normally do.

In a Monday press release, California Attorney General Xavier Becerra announced the new regulations, approved by the state’s Office of Administrative Law, and said that the updated restrictions will strengthen the landmark CCPA legislation approved in August 2020.

“California is at the cutting edge of online privacy protection, and this newest approval by OAL clears even more hurdles in empowering consumers to exercise their rights under the California Consumer Privacy Act,” Becerra said. “These protections ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights.”

Imagine you’re navigating a website or watching an in-app ad when you’re suddenly redirected to a subscription page, even though you have no interest in whatever product is being marketed at you. Such tactics are what’s known as “dark patterns” — underhanded strategies that rely on “confusing language or unnecessary steps such as forced clicking or scrolling through multiple screens or listening to why you shouldn’t opt out of their data sale,” according to an infographic provided by the California AG’s office. The tactics are more widespread than you’d imagine, and banning them under the CCPA is a step towards ensuring that consumers are protected from deceptive business practices.

The new regulations will also institute the use of a new Privacy Options icon, which internet consumers can use as a visual cue to opt-out of the sale of their personal information.

Passed in 2018. the California Consumer Privacy Act is one of the most robust data privacy laws in the United States. As it’s written, the legislation currently grants consumers greater control over how the personal information that businesses collect about them is used and shared, and also allows them to delete or opt out of the sale of their personal information in most instances.