Getting privacy right in a consumer-facing business is not just about having a privacy policy and getting your marketing consents right. It's also about how you design websites and apps in a way that engenders privacy by default. Privacy choices and consumer protection are intrinsically related, as evidenced by a joint collaboration between the Global Privacy Enforcement Network (GPEN) and the International Consumer Protection and Enforcement Network (CPEB). 

GPEN, which comprises a network of global supervisory authorities issued its annual report of findings with a sweep of over 1000 apps and found that nearly all of them (!) used one or more deceptive design patterns that make it difficult for users to make privacy-protective decisions and therefore interfered with user ability to make choices that better protect their privacy and / or consumer rights. 

Key findings include:

• 86% of apps had complex privacy policies that were too long and / or confusing;
• “Confirm shaming” is a popular technique with a number of apps “nagging” users to reconsider their intention to delete their account / opt for pro-privacy settings;
• In 40% of cases, users faced obstacles in making privacy choices, such as finding privacy settings or deleting their account;
• Use of forced actions is common, whereby users are hoodwinked into thinking it is necessary to provide their personal information in order to access a service, when this is not the case. 

So what?

Whilst there may be a tendency to follow the herd, (if our competitors are doing it, why shouldn't we?), businesses should be mindful of the findings of this report and take stock of your own consumer journeys:

• Whilst not a formal investigation, the GPEN report has historically led to follow-up work with organisations and initiatives of enforcement action by some supervisory authorities;
• to directly quote GPEN itself: “by offering users online experiences that are free from influence, manipulation and coercion, organisations can build user trust and make privacy a competitive advantage.”
• Do you want to read a lengthy legalistic privacy notice? No, neither do I. There are ways to strike a balance between legal requirements and good customer outcomes. 

Feel free to get in touch to discuss further.