Excerpt
Google faced liability for processing user data across services without affording users adequate choice options through its selection dialogue interfaces.
Our analysis
- Google from utilizing data processing terms that allowed the processing of user data across services without providing users with sufficient choice options.
- The key violation pertains to Google conditioning the use of its services on users' agreement to data processing terms, thereby restricting their ability to negotiate or exercise sufficient choices. Google's unilateral imposition of data processing terms, coupled with a lack of granularity in setting options, led to a scenario where users faced a "take it or leave it" situation. Users were compelled to accept cross-service data processing without the ability to opt out or tailor the processing to specific services, violating the requirement for freely given and informed consent.
-The absence of clear indications and comprehensive information on how data are processed across services, coupled with imprecise terminology, contributed to users' inability to make informed decisions.
- The ruling emphasized the inadequacy of Google's approach, highlighting the absence of equivalence between consent and rejection during account creation, particularly in the context of "Express personalization," where users were effectively steered towards accepting data processing options.
Outcome
The Bundeskartellamt ruled that Google must enable users to provide free, specific, informed, and unambiguous consent for cross-service data processing. Google is required to offer transparent choice options for data combinations, ensuring that selection dialogues are not manipulative and avoiding the use of dark patterns.
Parties
Alphabet Inc, Google Ireland Limited, Google Germany GmbH, Oracle Corporation, and Bundeskartellamt (Federal Cartel Office Germany)
Case number
B7-70/21
Decision
Related deceptive patterns
Forced action involves a provider offering users something they want - but requiring them to do something in return. It may be combined with other deceptive patterns like sneaking (so users don't notice it happening) or trick wording (to make the action seem more desirable than it is). Sometimes an optional action is presented as a forced action, through the use of visual interference or trick wording. In cookie consent interfaces, forced action is sometimes carried out through "bundled consent". This involves combining multiple agreements into a single action, and making it hard or impossible for a user to selectively grant consent.
Preselection employs the default effect cognitive bias – a psychological phenomenon where people tend to go with the option that is already chosen for them, even if there are other choices available. Providers know this and often use it to take advantage of consumers. A common approach is to show a pre-ticked checkbox, though there are various other ways of doing this, including putting items in the user's shopping cart, or pre-selecting items in a series of steps. There are lots of reasons why this is a powerful deceptive pattern. Firstly, there’s simply the matter of awareness - users have to notice it, read it and work out what it all means. If the user doesn't, they'll scroll past completely unaware of the implications. There are other cognitive biases that may be employed in his deceptive pattern. For example, the content may be written to make the user feel that people to feel other people like them would accept the default so they should too (targeting the social proof bias). Alternatively, the content may use an authority figure to pressure users into accepting the default (targeting the authority bias).
Related laws
Empowers the Bundeskartellamt to designate influential undertakings vital for competition across markets, enforcing regulations to prevent unfair practices and periodically reviewing its impact.