Privacy Commissioner of Canada Uncovers Dark Patterns on Majority of Websites and Apps in Recent Global Privacy Sweep

In a recent global sweep of over 1,000 websites and mobile apps, the Privacy Commissioner of Canada and 25 global privacy enforcement authorities found that 97% of reviewed websites and apps employed deceptive design patterns that compromised user privacy. The sweep found that the trend in dark patterns was often worse among platforms targeting children, with emotive language or nagging being employed to manipulate young users towards less privacy-friendly choices. This is yet another example of the increasing convergence of privacy, deceptive advertising and consumer protection legal risks, and an indicator that these issues continue to be a top enforcement priority across many regulators in Canada.

This year’s privacy sweep was a collaboration between the Global Privacy Enforcement Network (GPEN) and the International Consumer Protection and Enforcement Network (ICPEN), and highlighted the intersection of privacy and consumer protection concerns online. This collaborative initiative focused on how dark patterns can be used to steer users into sharing more personal information than necessary. The privacy sweep discovered that a majority of websites and apps used deceptive patterns such as overly complex privacy policies (89%), emotionally charged language (42%), making privacy-compromising options the easiest to select (57%), repeatedly asking users to reconsider intentions to delete their accounts (35%), obstructing users from making certain privacy choices or accessing privacy information (40%), and mandating excessive personal data disclosure for account deletion (9%).

The Privacy Commissioner of Canada emphasized the need for platforms to prioritize user privacy by adopting neutral language, emphasizing privacy options, ensuring easily accessible privacy controls, and making privacy-protective settings the default. In particular, Commissioner Dufresne noted that organizations should prioritize the best interest of young people when designing online platforms. Children’s privacy rights are one of the Privacy Commissioner of Canada’s three strategic privacy priorities that will guide the Office of the Privacy Commissioner’s work through 2027.

The reports published by GPEN, ICPEN, and the Office of the Privacy Commissioner of Canada provide comprehensive insights and recommendations aimed at strengthening online privacy protections and regulatory oversight, especially for vulnerable populations like children.