§4.2.7 Data-driven practices and dark patterns

The digital environment is increasingly characterised by the generation, accumulation and control of an enormous amount of data about consumers, which can be combined with the use of algorithms and AI to turn this into usable information for commercial purposes. Among other purposes, this data can give valuable insights to socio-demographic characteristics, such as age, gender or financial situation, as well as personal or psychological characteristics, such as interests, preferences, psychological profile and mood. This enables traders to learn more about consumers, including about their vulnerabilities. Data-driven personalisation practices in the business-to-consumer relationship include personalisation of advertising, recommender systems, pricing, ranking of offers in search results, etc. The principle-based provisions and prohibitions in the UCPD can be used to address unfair data-driven business-to-consumer commercial practices in addition to other instruments in the EU legal framework, such as the ePrivacy Directive, the GDPR or sector-specific legislation applicable to online platforms. Existing decisions by data protection authorities concerning a trader’s compliance or non-compliance with data protection rules should be taken into account when assessing the overall fairness of the practice under the UCPD. The UCPD covers the advertising, sales and contract performance stages, including the agreement to the processing of personal data and the use of personal data for delivering personalised content, and the termination of a contractual relationship. Moreover, the Directive has a broad scope of application: it covers all business-to-consumer commercial practices and does not require the existence of a contractual relationship or the purchase of a product. For example, the Directive would also cover commercial practices such as capturing the consumer’s attention, which results in transactional decisions such as continuing to using the service (e.g. scrolling through a feed), to view advertising content or to click on a link. Persuading consumers to engage with the trader’s content is an essential part of commercial practices and of advertising in particular, both in the online and offline world. However, the digital environment enables traders to employ their practices more effectively on the basis of consumer data, with high scalability and even dynamically in real time. Traders can develop personalised persuasion practices because they benefit from superior knowledge based on aggregated data about consumer behaviour and preferences, for example by linking data from different sources. Traders can also have the possibility to make adjustments to improve the effectiveness of their practices, as they continuously test the effects of their practices on consumers and thereby learn more about their behaviour (e.g. through A/B testing). Furthermore, such practices could often be employed without the full knowledge of the consumer. It is the presence of these factors and their opaqueness that distinguishes, on the one hand, highly persuasive advertising or sales techniques from, on the other hand, commercial practices that may be manipulative and, hence, unfair under consumer law. In addition, they may be in breach of transparency obligations under GDPR or the ePrivacy Directive. Any business-to-consumer practice that materially distorts or is likely to distort the economic behaviour of an average or vulnerable consumer could breach the trader’s professional diligence requirements (Article 5), amount to a misleading practice (Articles 6-7) or an aggressive practice (Articles 8-9), depending on the specific circumstances of the case. For the purposes of this assessment, the benchmark of an average or vulnerable consumer can be modulated to the target group and, if the practice is highly personalised, even formulated from the perspective of a single person who was subject to the specific personalisation. These practices may also have a more significant effect on vulnerable consumers. As explained in section 2.6, the characteristics that define vulnerability in Article 5(3) are indicative and non-exhaustive. The concept of vulnerability in the UCPD is dynamic and situational, meaning, for instance, that a consumer can be vulnerable in one situation but not in others. For example, certain consumers may be particularly susceptible to personalised persuasion practices in the digital environment, while less so in brick-and-mortar shops and other offline environments. The use of information about the vulnerabilities of specific consumers or a group of consumers for commercial purposes is likely to have an effect on the consumers’ transactional decision. Depending on the circumstances of the case, such practices could amount to a form of manipulation in which the trader exercises ‘undue influence’ over the consumer, resulting in an aggressive commercial practice prohibited under Articles 8 and 9 of the UCPD. When assessing the presence of undue influence, according to Article 9(c) one should take into account the exploitation of any specific misfortune or circumstance of such gravity as to impair the consumer's judgement, of which the trader is aware. Moreover, if the practice is targeting children, then point No 28 of Annex I is particularly relevant as it prohibits direct exhortations to children. The potential adverse impacts of targeting children also warrant specific protection under the GDPR (365). For example: — A trader is able to identify that a teenager is in a vulnerable mood due to events in their personal life. This information is subsequently used to target the teenager with emotion-based advertisements at a specific time. — A trader is aware of a consumer’s history with financial services and the fact that they have been banned by a credit institution due to the inability to pay. The consumer is subsequently targeted with specific offers by a credit institution, with the aim of exploiting their financial situation. — A trader is aware of a consumer’s purchase history with respect to games of chance and random content in a video game. The consumer is subsequently targeted with personalised commercial communications that feature similar elements, with the aim of exploiting their higher likelihood of engaging with such products. Within the category of manipulative practices, the term ‘dark pattern’ is used to refer to a type of malicious nudging, generally incorporated into digital design interfaces. Dark patterns could be data-driven and personalised, or implemented on a more general basis, tapping into heuristics and behavioural biases, such as default effects or scarcity biases (366). The term ‘dark pattern’ does not have a legal definition in the Directive. The UCPD applies to any ‘unfair commercial practice’ that meets the requirements of the material scope of the Directive, regardless of their classification. If dark patterns are applied in the context of business-to-consumer commercial relationships, then the Directive can be used to challenge the fairness of such practices, in addition to other instruments in the EU legal framework, such as the GDPR. As explained above, any manipulative practice that materially distorts or is likely to distort the economic behaviour of an average or vulnerable consumer could breach the trader’s professional diligence requirements (Article 5), amount to a misleading practice (Articles 6-7) or an aggressive practice (Articles 8-9), depending on the specific dark pattern applied. The UCPD does not require intention for the deployment of the dark pattern. The standard of professional diligence in Article 5 UCPD in the area of interface design may include principles derived from international standards and codes of conduct for ethical design. As a general principle under the requirements of professional diligence in Article 5 UCPD, traders should take appropriate measures to ensure that the design of their interface does not distort the transactional decisions of consumers. Manipulative practices may include visually obscuring important information or ordering it in a way to promote a specific option (e.g. one button very visible, another hidden; one path very long, another shorter), as well as using trick questions and ambiguous language (e.g. double negatives) to confuse the consumer. Such practices are likely to qualify as a misleading action under Article 6 UCPD or as a misleading omission under Article 7 UCPD by making the information unintelligible or ambiguous. Furthermore, using emotion to steer users away from making a certain choice (e.g. ‘confirmshaming’ the consumer into feeling guilty) could amount to an aggressive practice under Article 8 UCPD for using undue influence to impair the consumer’s decision-making. For example: During the ordering process in an online marketplace, the consumer is asked several times to choose ‘yes’ and ‘no’: ‘Would you like to be kept informed about similar offers? Would you like to subscribe to the newsletter? Can we use your details to personalise our offer?’ Halfway through the click sequence, the buttons ‘yes’ and ‘no’ are reversed intentionally. The consumer has clicked ‘no’ several times, but now clicks ‘yes’ and accidentally subscribed to a newsletter. Default interface settings have a significant impact on the transactional decision of an average consumer. Traders could not only influence consumers to take certain actions, but also take specific actions in their place, for example by using pre-ticked boxes, including to charge for additional services, which is prohibited under Article 22 of the CRD. Such practices can also breach the UCPD as well as data protection and privacy rules (367). Certain practices that are often labelled as ‘dark patterns’ are already expressly prohibited in all circumstances in the Annex I to the UCPD: — So-called ‘bait and switch’ practices, which include offering products at a specified price while not disclosing the existence of reasonable grounds for not being able to provide the product or offering the product and then refusing to take orders for it or deliver it within a reasonable time, with the intention of promoting a different product instead (No 5 and 6 Annex I); — Creating urgency by falsely stating that a product will only be available for a very limited time, or that it will only be available on particular terms for a very limited time (No 7 Annex I). For example, this includes fake timers and limited stock claims on websites; — Giving inaccurate information on market conditions or on the possibility of finding the product with the intention of inducing the consumer to buy the product at less favourable conditions (No 18 Annex I); — Claiming that the consumer has won a prize, without awarding the prizes described or a reasonable equivalent (No 19 and 31 Annex I) or falsely describing a product as ‘free’ (No 20 Annex I); — Making repeated intrusions during normal interactions in order to get the consumer to do or accept something (i.e. nagging) could amount to a persistent and unwanted solicitation (No 26 Annex I) (368). Furthermore, various misleading practices that breach Articles 6 and 7 UCPD are also labelled as ‘dark patterns’, such as misleading free trials and subscription traps which were further discussed in section 2.9.6. In designing their interfaces, traders should follow the principle that unsubscribing from a service should be as easy as subscribing to the service, for example by using the same methods previously used to subscribe to the service or differing methods, as long as the consumers are presented with clear and free choices, proportionate and specific to the decisions they are being asked to make. For example: In order to unsubscribe from a digital service, the consumer is forced to take numerous non-intuitive steps in order to arrive at the cancellation link. These steps include ‘confirmshaming’, whereby the consumer is prompted, without reasoned justification, to reconsider their choice through emotional messages several times (‘We’re sorry to see you go’, ‘Here are the benefits you will lose’) and ‘visual interference’, such as prominent images that encourage the user to continue with the subscription instead of cancelling (369). Such practices could breach Article 7 and Article 9(d) UCPD.

← 4.2.6 · All articles · 4.2.8 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07