Tech giants manipulating users into choosing privacy intrusive options: Report

Representative Image

The Norwegian Consumer Council (NCC) has accused tech giants Google, Facebook and Microsoft of using dark patterns to nudge users to select the privacy-intrusive option.

On May 25, the European Union had implemented a new law called General Data Protection Regulation (GDPR) wherein companies are required to be transparent about the data they collect from the users and who they share it with.

Failure to comply with the law meant that the companies could end up paying steep fines.

In a report titled 'Deceived By Design', the Norwegian Consumer Council said that Facebook and Google had privacy intrusive default settings.

"The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users," the council said.

The report included an example of face recognition in Facebook, in which the user would need four extra clicks to choose the most privacy-friendly option than they would to choose the least privacy-friendly option.

Users are asked whether they consent to the use of facial recognition. Then Facebook states that "if you keep face recognition turned off, we won't be able to use this technology if a stranger uses your photo to impersonate you. If someone uses a screen reader, they won't be told when you're in a photo unless you’re tagged".

This framing and wording nudged users towards a particular choice by presenting the alternative as ethically-questionable or risky, the council said.

"Our approach complies with the law, follows recommendations from privacy and design experts, and are designed to help people understand how the technology works and their choices," a Facebook spokesperson told Fortune.

"We build privacy and security into our products from the very earliest stages. Over the last 18 months, in preparation for the implementation of the EU's new data protection regulation, we have taken steps to update our products, policies and processes to provide all our users with meaningful data transparency and straightforward controls across all our services," a Google spokesperson told the magazine.

The NCC has written a letter to the Norwegian Data Protection Authority, Datatilsynet, asking them to investigate these issues in depth.