Chapter 20: Forced action

Forced action is a category of deceptive pattern in which a business offers users something they want – but forces them to do something in return. This is a problem when the forced action runs contrary to a reasonable user’s expectations, or when it contradicts laws or regulations.

One of the most well-known and amusingly named types of forced action is ‘privacy zuckering’, named, of course, after Mark Zuckerberg.¹ The user is tantalised by a service or product and in the process of trying to get it, they are tricked into sharing personal data with the business, and also tricked into giving the business permission to use that data for profit-making endeavours – like selling it, sharing it or using it for targeted advertising.

The issue here isn’t that data sharing, data sales or targeted advertising are necessarily bad – because they are legitimate business models when done correctly. The issue is the lack of the user’s consent for this to happen. It doesn’t count as consent if the user has been tricked or coerced. Consent must be ‘freely given, specific, informed and unambiguous’ – the exact language used, in fact, in the EU’s GDPR.

Here’s an example of forced action, observed by security researcher Brian Krebs.² When a user installs Skype on their iPad, they are taken through a series of log-in steps. One of the steps requires the user to upload their personal address book from their iPad to Skype (a division of Microsoft). There is no option to decline (shown below), and the page does not explain that the next step (the iOS permissions dialog) will actually give them the choice to decline, and that declining will not have an effect on their ability to use Skype.³

If we look at a subsequent step (below), we can see that the designers certainly know how to design a clear opt-out when they want to.⁴ The options ‘Yes, contribute’ and ‘No, do not contribute’ are equally weighted, obvious and easy to understand. This further highlights the forced action and coercive wording on the ‘Find Contacts Easily’ step (above).

So why is contact sharing something that users may want to opt out of? This is essentially a question about the right to privacy. The book Privacy’s Blueprint by Woodrow Hartzog (2018) covers this,⁵ including...