DARK DESIGN
The concept of dark pattern (“dark design”), which is frequently mentioned with the development of information technology resources, is, in the simplest terms, design tricks. These fraudulent interfaces, which are used to manipulate users by focusing their attention in different places on websites and applications, have become one of the most common practices that companies operate in favour of their own interests and benefits.
Considering the personal data collected through dark design activities on websites and applications, it is concluded that the relevant activity is in close contact with personal data protection legislation as well as consumer legislation. In this respect, it will be necessary to underline the definition of explicit consent regulated under the European General Data Protection Regulation (“GDPR”), which introduces regulations for the protection of personal data across EU countries. Pursuant to the GDPR, explicit consent is defined as a freely given, specific, informed and unambiguous expression of the data subject’s wishes for the processing of personal data by means of a declaration or an active will. The purpose of this provision is to prevent attempts to ensure that data subjects accept data processing activities by default. Therefore, dark design activities that cripple the free will of users are also unlawful under personal data protection legislation.
In the press release published by the European Commission on 30 January 2023, it was stated that the research carried out by the European Commission and the national consumer protection authorities of the 23 EU Member States reached important numerical findings regarding dark designs on websites, which are known to push users to make choices that are not in their best interests.[1]
In the Turkish Law legislation, dark design regulated in subparagraph 22 of Article A – Deceptive Commercial Practices in the Annex of the Commercial Advertisement and Unfair Commercial Practices Regulation’s Sample Practices Accepted as Unfair Commercial Practices is defined as using methods that adversely affect consumers’ will to make a decision or choice by means of tools such as guiding interface designs, options or expressions regarding a good or service on the internet, or aiming to cause changes in favour of the seller or provider in the decision to be made under normal conditions.
08.08.2023 Dated Advertisement Board Decisions
Until 08.08.2023, dark design activities, which were not subject to Turkish judicial and/or independent administrative authority decisions until 08.08.2023, became the basis of the sanction of stopping the aforementioned advertisements, which was imposed on many media in the meeting numbered 336 of the Advertisement Board.[2]
File No: 2023/229:
…when consumers want to purchase special packages for telephone lines offered for sale on the website, it has been determined that the consumers are offered the “Become a Turkcell” button in the “Annual Subscription” section of the same package and the “Detailed Information” button in the “Monthly Subscription” section, and when the “Become a Turkcell” button in the annual subscription section is selected, it is directed to the page where the purchase transactions are made, and when the “Detailed Information” button in the monthly subscription section is selected, it is directed to the information section.
Therefore, while the annual subscription process for the same line is easily carried out, this is not the case for the monthly subscription, this situation leads to consumers being forced to become a party to a contract that they would not be a party to under normal conditions, and the will of consumers to make a decision or choice is adversely affected, …
File No: 2023/230:
…when the payment page to subscribe to the platform to watch the content on the platform on the company’s website www.blutv.com.tr, the annual subscription section with the statement “If you choose an annual subscription, instead of ₺69.9 per month, ₺39. 9 43% discount”, the pre-selection of the subscription period leads consumers to be forced to become a party to a contract that they would not be a party to under normal circumstances and to subscribe to the platform for a long time, therefore, the consumers’ will to make a decision or choice is negatively affected by offering a pre-selected membership period to consumers by the company that broadcasts on online platforms with a subscription system, …
File No: 2023/233:
…company’s advertisements titled “Unlocked Now: You Can Take Advantage of Free Upgrade to Windows 11”, the advertisements titled “Buy” in the blue box and “Plan” in the white box, which are prominently placed side by side on the screen, include the phrase “Keep Windows 10” at the bottom of the screen in a way that is difficult to distinguish compared to the “Buy” and “Plan” buttons, making it difficult for consumers to continue using the existing operating system of their computers without upgrading the operating system, causing them to be forced to become a party to a contract to which they would not be a party under normal conditions and to update the operating system, …
File No: 2023/5986:
…when the payment page to subscribe to the magazine packages offered for sale on the company’s website www.444dergi.com.tr, the subscription period section, which includes “1 Month”, “3 Months”, “6 Months” and “12 Months” options, is currently offered with the “6 Months” subscription section selected, and the pre-selection of the subscription period leads to consumers being forced to become a party to a contract that they would not be a party to under normal conditions and to subscribe to magazine packages for a long time,
File No: 2023/5991:
…when consumers want to purchase the products offered for sale on the company’s website www.vivense.com.tr, the “Discounted Installation” fee is already selected on the payment page, the pre-selection of the paid installation service leads consumers to be forced to become a party to a contract that they would not be a party to under normal conditions, …
Dark Design within the Scope of the Law on the Protection of Personal Data (“KVKK”)
As mentioned above, as dark design activities are directly related to personal data processing activities, they are also subject to personal data protection legislation. It is considered highly probable that dark design activities will be on the radar of the Personal Data Protection Board (“Board”) after the Advertisement Board. In this context, it is important that all websites, especially e-commerce websites, operate their processes in accordance with the legislation.
To elaborate the contact of dark design with the LPPD with examples;
Websites process personal data such as performance, analytical and functional etc. of website visitors through cookies. However, as it is known, with various decisions published by the Board, the Board subjects the types of cookies other than the cookies that are mandatory for the execution of website activities to the explicit consent of the users.[3]
Therefore, it is necessary to create a control panel on the relevant websites in order to enable users to make preferences regarding the cookies that they will be subject to during their website experience and to obtain consent from users through the opt-in[4] system.
In this context, a cookie pop-up should be presented at the first opening of the website that will direct users to the relevant control panel. In most websites, it is observed that there are two options in the cookie pop-up: accept and set. However, the relevant practice will cripple free will within the scope of the explicit consent elements stipulated by the LPPD.[5]
In this direction, it would be the best practice to include a reject button in addition to the accept and set options in the cookie pop-up and not to carry out activities that affect the users’ will to make decisions and choices, such as presenting the accept button in green and the other buttons in a faded manner.
Another example regarding the theme of KVKK can be given based on the decisions of the Advertisement Board. We observe that most of the relevant decisions are related to subscription activities. Within the scope of the subscription agreement, certain personal data are obtained from the members. Although the provision of the relevant personal data may be based on processing conditions other than explicit consent, activities that direct users to a certain type of subscription and thus affect their will to make decisions and choices will be contrary to the law and the rule of honesty, which are among the basic principles specified in Article 4 of the LPPD. Because; even if explicit consent is obtained from the persons, an unlawful data processing activity will come to the agenda in case of data processing contrary to the basic principles.
Conclusion
In the light of all these evaluations, the most basic principle to be reached is that law is a set of rules. It is necessary to approach each process where personal data is in contact in a multidisciplinary manner and to act by taking into account other relevant legislation. Obtaining explicit consent from users within the scope of KVKK in order to circumvent conflicting legislation or violating the basic principles stipulated by KVKK will result in unlawful data processing activity.
[1] https://ec.europa.eu/commission/presscorner/detail/en/ip_23_418
[2] https://ticaret.gov.tr/tuketici/ticari-reklamlar/reklam-kurulu-kararlari
[3] Summary of the Decision of the Personal Data Protection Board dated 23/12/2022 and numbered 2022/1358 on “Failure to provide clarification and explicit consent texts regarding cookies on a website” Last Access Date: 12.09.2023
Summary of the Decision of the Personal Data Protection Board dated 10/03/2022 and numbered 2022/229 on “Unlawful processing of personal data through cookies used on the website/mobile applications by the data controller company operating in the e-commerce sector” Last Access Date: 12.09.2023
[4] Opt-in System: It is a system in which the individual gives consent to the processing of personal data with his/her conscious action.
[5] Explicit consent: It refers to the consent regarding a specific subject, based on information and expressed with free will.
