2 P rinciples Applicable What to keep in m ind?

Stirring: affects the cho ice users wo uld m ake by appealing to their emo tio ns o r using visual nudges.

Hindering: an o bstructio n o r blocking o f users in their pro cess o f getting info rmed o r m anaging their data by m aking the actio n hard o r im po ssible to achieve.

Fickle: the design o f the interface is inco nsistent and no t clear, m aking it hard fo r users to navigate the different data pro tectio n co ntro l to o ls and to understand the purpo se of the processing.

Left in the dark: an interface is designed in a way to hide info rm atio n o r data protectio n co ntro l to o ls o r to leave users unsure o f ho w their data is processed and what kind o f co ntro l they m ight have o ver it regarding the exercise o f their rights.

In additio n to regro uping dark patterns in these catego ries acco rding to their effects o n users behavio ur, dark patterns can also be divided into co ntent-based patterns and interface-based patterns to mo re specifically address aspects o f the user interface o r user experience. Co ntentbased patterns refer to the actual co ntent and therefo re also to the wo rding and co ntext o f the sentences and info rm atio n com po nents. In additio n, ho wever, there are also compo nents that have a direct influence o n the perceptio n o f these facto rs. These interface-based patterns are related to the ways o f displaying the co ntent, navigating thro ugh it o r interacting with it.

It is essential to keep in m ind that dark patterns raise additio nal co ncerns regarding po tential im pact o n children, registering with the so cial media pro vider. The GDP R pro vides fo r additio nal safeguards when the processing is abo ut children s perso nal data, as the latter may be less aware o f the risks and co nsequences co ncerned their rights to the pro cessing.7 It is explicitly pro vided that, co nsidering the specific pro tectio n required fo r pro cessing o f their data, any inform atio n pro vided to children when their perso nal data are being pro cessed, sho uld be given in a clear and plain language so to m ake children understand.8 In additio n, the GDPR explicitly includes the pro cessing o f individuals data, particularly tho se o f children, to be am o ng the situatio ns where the risk to the rights and freedom s o f individuals o f varying likeliho o d and severity, m ay result from data pro cessing that co uld lead to physical, m aterial o r no n-m aterial damage.9

2 PRINCIPLES APPLIC ABLE WHA T T O K EEP IN MIND?

Regarding the data protectio n co m pliance o f user interfaces o f o nline applicatio ns within the so cial m edia secto r, the data pro tectio n principles applicable are set o ut within Article 5 GDP R. The principle o f fair pro cessing laid do wn in Article 5 (1) (a) GDP R is a starting po int fo r an assessment o f existence o f dark patterns. As the EDP B already stated, fairness is an overarching principle which requires that perso nal data shall no t be pro cessed in a way that is detrim ental, discrim inato ry, unexpected o r m isleading to the data subject.10 If the interface has insufficient o r m isleading info rm atio n fo r the user and fulfils the characteristics o f dark patterns, it can be classified as unfair

7 GDPR, Re cital 38. 8 GDPR, Re cital 58. 9 GDPR, Re cital 75; se e also ED PB Guideline s 8/ 2020 on targ eting of socia l media us er s, para. 16 https://edpb.europa.eu/ syste m/fil e s/202 104/edpb_guide lines _08 2020 _ on_the_targ eting_of _ social_ media_u ser s_ en.pdf. 10 EDPB Guideline s 4/2 0219 on Article 25 Data Protection by Desi gn and by Default, versio n 2.0, adopted on 20 October 2020, p. 16; https ://e dpb.europa.eu/our-work-tool s/our-docum ents/ guideline s/ guidelines-42 019article-25-data-prot ection-de sign-and_ en.