Dark patterns in e-commerce: a dataset and its baseline evaluations

Abstract

Dark patterns, which are user interface designs in online services, induce users to take unintended actions. Recently, dark patterns have been raised as an issue of privacy and fairness. Thus, a wide range of research on detecting dark patterns is eagerly awaited. In this work, we constructed a dataset for dark pattern detection and prepared its baseline detection performance with state-of-the-art machine learning methods. The original dataset was obtained from Mathur et al.'s study in 2019 [1], which consists of 1,818 dark pattern texts from shopping sites. Then, we added negative samples, i.e., non-dark pattern texts, by retrieving texts from the same websites as Mathur et al.'s dataset. We also applied state-of-the-art machine learning methods to show the automatic detection accuracy as baselines, including BERT, RoBERTa, ALBERT, and XLNet. As a result of 5-fold cross-validation, we achieved the highest accuracy of 0.975 with RoBERTa. The dataset and baseline source codes are available at https://github.com/yamanalab/ec-darkpattern.

I. Introduction A. Dark Patterns

Dark patterns are user interface designs on online services that make users behave in unintended ways. Dark patterns have been called into question in recent years.

In 2010, Harry [2] defined dark patterns as "tricks used in websites and apps that make a user do things that the user did not mean to, like buying or signing up for something." Fig. 1 shows an example of dark patterns, classified as Obstruction [1] . The obstruction makes it difficult for users to conduct a specific task, such as cancellation and withdrawal. For example, in Fig. 1 , the website only shows an "ADD TO CART" button but no cancel button. Instead, the website shows "If you would like to cancel your membership, please call ... or contact us via email at ...", which makes it difficult for the user to cancel by limiting the cancellation to telephone calls or email.

Prior studies [1] , [3] - [5] have reported that dark patterns exist everywhere on online services, including e-commerce sites, social networking services (SNS), consent to cookies, and apps.

B. Dark Patterns And Privacy

Dark patterns also pose problems to user privacy protection, including UX designs that induce users to provide personal data or consent to cookies in online services. Discussions on the impact of dark patterns to protect user privacy are not limited to academic research and have been widely discussed in various places.

In 2018, the California Legislature passed the Consumer Privacy Protection Act (CCPA) [6] to ban dark patterns on the Internet, which became effective in 2020 and had a critical impact on privacy-related choices. In 2019, the Commission Nationale de l'Informatique et des Libertés (CNIL) in France published a report [7] on the impact of UX design on privacy protection. The report argued that manipulative and/or misleading interfaces on online services could influence critical decisions related to user privacy. The report also raised awareness of such dark patterns and called on designers to collaborate for privacy-friendly designs. In 2020, the Organization for Economic Development and Cooperation (OECD) discussed the privacy and purchasing behavior risks that dark patterns pose to consumers [8] . During the meeting, the risk of dark patterns exposing personal information on online services without the consumer's genuine consent was mentioned. In 2021, the European Data Protection Board (EDPB) discussed dark patterns in social media that can negatively impact users' decisions regarding the handling of personal information [9] . The main objective was to discuss protecting users from dark patterns that may harm their privacy.

As ever-increasing dark patterns have become a social problem, as evidenced by the policies of various countries, urgent actions are required.

C. Study Contributions

Prior works [1] - [5] , [10] investigated and classified dark patterns on e-commerce sites, social networking services sites, news sites, apps, and cookie consent. However, to the best of our knowledge, auto-detection of dark patterns was outside their scope. Although a few studies [11] , [12] tackled autodetection, they relied on manual methods to extract features for auto-detection.

This work distributed a dataset of dark patterns consisting of positive and negative samples, which will help new research in this area to detect dark patterns automatically on websites by distributing a dataset of dark patterns consisting of positive and negative samples. Besides, we provide baseline results of auto-detection with state-of-the-art machine learning methods, including BERT [13] , RoBERTa [14] , ALBERT [15] , and XLNet [16] , for easy comparison with future algorithms.

D. Organization Of The Paper

Related work is introduced in Section II, followed by a description of the creation of the dark pattern dataset in Section III. Section IV investigates the performance of auto-detection with state-of-the-art machine learning algorithms as baselines. Finally, we conclude this paper in Section V.

Ii. Related Work

This section introduces related work from three categories: dark pattern taxonomies, dark patterns at scale, and automated dark pattern detection.

A. Dark Pattern Taxonomies

The taxonomies of dark patterns have been defined in various ways, including the research aiming to define the taxonomies of dark patterns and the research classifying dark patterns from the gathered large-scale web pages.

The term "dark patterns" was first defined on Harry's website [2] in 2010. He classified dark patterns into 12 types and introduced examples of each type. In 2018, Gray et al. [10] gathered examples of dark patterns through searches with the keyword "dark patterns" and its derivatives on Google, Bing, and social networking sites, such as Facebook and Instagram. Gray et al. analyzed the contents to classify dark patterns into 5 types. Table I lists the types of dark patterns defined by Gray et al. In 2021, Mathur et al. [17] conducted a comprehensive study to summarize the various definitions of dark patterns, which included 84 types of dark patterns defined by 11 studies in the fields of human-computer interaction, security and privacy, law, and psychology.

As described above, the taxonomies of dark patterns have been defined based on various criteria in several studies.

B. Dark Patterns At Scale

Many researchers have conducted studies on dark patterns at a large scale across online content to determine the extent to which dark patterns exist on online services.

In 2018, Mathur et al. [3] conducted a large-scale study to determine whether influencers disclose that their content is advertising when they promote specific products. The Federal Trade Commission (FTC) prohibits creators from promoting specific products without disclosing the fact to users. Mathur et al. found that approximately 10% of the affiliate advertisements content did not disclose that they were advertisements. In 2019, Mathur et al. [1] extensively studied dark patterns on shopping websites. They obtained 11,286 shopping sites by extracting English shopping sites from 361,102 websites with the highest number of accesses obtained by Alexa Traffic Rank. As a result, they found 7 types of 1,818 dark patterns from 1,254 shopping sites, which is approximately 11.1% of the total, and they published the dark pattern text data 1 .

In 2020, Di Geronimo et al. [4] studied 240 popular Android applications. Two researchers performed a set of common activities, including user registration and configuration changes, to investigate whether dark patterns existed in the applications. Di Geronimo et al. analyzed the dark patterns found and classified them into the five types of dark patterns defined by Gray et al. [10] .

In 2020, Soe et al. [5] conducted a large-scale study of dark patterns in cookie consent notifications. The work targeted the consent notices for cookies on 300 news sites written in Nordic and English. Two researchers asked the following questions: "Are there dark patterns in the consent notices?", If so, "what is the type of dark pattern (of the five types of dark patterns defined by Gray et al.)?", "Is it possible to refuse cookies?", and "Where does the cookie consent notice appear?". As a result, they identified 297 dark patterns for inducing consent to cookies. [10] Types of Dark Patterns Description

Nagging

Redirection of expected functionality that persists beyond one or more interactions.

Obstruction

Making a process more difficult than it needs to be, with the intent of dissuading certain action(s)

Sneaking

Attempting to hide, disguise, or delay the divulging of information that is relevant to the user.

Interface Interference Manipulation of the user interface that privileges certain actions over others.

Forced Action

Requiring the user to perform a certain action to access (or continue to access) certain functionality

C. Automated Detection For Dark Patterns

A few studies have addressed the automatic detection of dark patterns as follows.

In 2021, Andrea et al. [11] proposed a detection framework for dark patterns with a combination of manual and automatic methods. They targeted the 12 dark pattern types defined by Harry [2] . The weakness of the framework is that only simple keyword matching is adopted for automated detection methods. For example, the automated detection is based on whether the keywords opt-in or opt-out are included or not. Other features to detect dark patterns rely on manual methods, so the framework cannot detect dark patterns automatically.

In 2022, Soe et al. [12] conducted automatic dark pattern detection in cookie banners. They experimented using machine learning techniques on a manually collected dataset of cookie consents on 300 news websites [5] . They used manually extracted features, such as text in banners, location of the pop-up, number of clicks to reject all consent, purpose of the cookies' inclusion, and the existence of any third-party cookies. The automatic detection targeted categorizing 5 types of dark and non-dark patterns by adopting 10 features, where the 5 types of dark patterns were those defined by Gray et al. [7] . The experimental results with gradient-boosted tree classifiers showed accuracies of 0.50 (obstruction) to 0.72 (nagging). The weaknesses of this research are 1) only targeting cookie banners, 2) features were extracted manually, and 3) the obtained accuracies were low.

Iii. E-Commerce Dark Pattern Dataset

The purpose of the proposed dataset is to enable a wide range of research for automatic dark pattern detection on ecommerce sites. Although we may prepare various features that Soe et al. [12] adopted, we only prepare texts that could be automatically extracted from web pages because we target automatic detection without manually extracted features. Our dataset is inspired by Mathur et al.'s work in 2019 [1] , which consisted of 1,818 dark pattern texts from shopping sites. We added non-dark pattern texts to Mathur et al.'s dataset to prepare a dataset with a balanced number of dark and non-dark pattern texts.

A. Dark Pattern Texts In E-Commerce Sites

We modified the dataset of dark patterns manually constructed by Mathur et al. [1] , where 1,818 dark pattern texts from 1,254 shopping sites, approximately 11.1% of the 11,000 shopping sites they studied, were included. The original Mathur et al. dataset consists of the manually tagged features listed in Table II . As our goal is to prepare a dark pattern text dataset, we excluded missing, i.e., null in the "Pattern String" field in Table II , or duplicate text data from the original dataset, followed by tagging them as dark patterns, i.e., positive examples. Finally, we have 1,178 text data.

B. Non-Dark Pattern Texts In E-Commerce Site

The collection of negative samples, i.e., non-dark pattern texts, is described in this section. The following two steps were conducted to create non-dark pattern texts:

1) Collect the web pages on e-commerce sites.

2) Extract texts from the collected web pages to segment.

3) Exclude dark patterns from the segmented texts. 1) Collecting web pages: The negative samples were retrieved from the same websites, i.e., e-commerce sites, where the dark patterns prepared in Section III-A are included, using headless Chrome. If a website was unreachable, encountering "not found" or "access denied," we ignored the website. The content was gathered after executing JavaScript when accessing each web page because most websites adopt JavaScript to create the web page.

2) Extracting texts: After collecting web pages, we adopted a Puppeteer 2 library to scrape each content, followed by collecting its screenshot and text. Mathur et al. targeted the text inside the UI components, not the whole web page, as the [1] restricts the target HTML element to be 1) a UI element that occupies more than 30% of the page and 2) a specific block element to obtain dark pattern candidates efficiently. On the contrary, our goal is to extract non-dark pattern texts widely from the page so that we target all the block elements to extract the text. Specifically, we target the block elements containing at least one TextNode as their child element but not containing block-level elements 3 . Because the only difference from the work of Mathur et al. is target elements, we can use the same segmented texts. The detailed segmentation algorithm is given as Algorithm 1, which is modified from Mathur et al.'s algorithm. We applied Algorithm 1 to the body element of each web page.

3) Excluding dark patterns: The collected texts in the previous step may contain dark patterns, so we filtered out the texts collected by Mathur et al. that contain dark pattern texts. Then, we manually confirmed the filtered texts were non-dark patterns. Note that we ignored numerical values, capitalization, and punctuation in the text when applying the filtering.

Through the above process, 14,208 non-dark pattern texts were collected. From these, 1,178 texts were extracted randomly and used as negative samples of the dataset.

C. Validation Of The Segmentation Algorithm

To validate the segmentation by the implemented Algorithm 1, we segmented the same web pages included in Mathur et al.'s dataset into texts. Then, we manually checked whether the segmented texts contained the same units of dark pattern texts. annthegran.com "No thanks, I don't like free stuff" "No thanks, I don't like free stuff" savethebeesproject.com "9 people are viewing this." "24 People are viewing this!" Negative (non-dark pattern) "3,081 people have viewed this item" "Unique and personalized products to go as yourself."

"In Stock only 3 left" "newsletter signup (privacy policy)."

"No thanks. I don't like free things..." "International Shipping Policy" "894 Claimed! Hurry, only a few left!" "Clothes, Shoes & Accessories"

"Your order is reserved for 08:48 minutes!" "READY FOR YOUR NEXT AUTHENTIC NHL JERSEY?"

1. As shown in Table III

D. Summary

The final dataset consists of 1,178 positive (dark pattern) and 1,178 negative (non-dark pattern) texts, totaling 2,356 texts from e-commerce websites.

An example of the data is shown in Table V . In this example, the dark pattern taxonomy of the first positive example "3,081 people have viewed this item" is Social Proof, which misleads users to purchase by displaying information as if other users have purchased the product. It exploits the bandwagon effect [1] . We published the dataset on Github 4 with the code used to collect non-dark pattern texts.

A. Selection Of Baseline Methods

In recent years, many machine learning-based text classification methods have been proposed. In the security and privacy field, fake news and phishing detection are representative text classification tasks. Various machine learning-based methods have been proposed for text-based fake news and phishing detection, including classical machine learning and deep learning-based methods.

In natural language processing, deep learning-based models have surpassed the accuracy of classical machine learning models in various text classification tasks. Among deep learning-based models, models adopting transformer-based pre-trained language models like BERT [13] have attracted the most attention and are the current state-of-the-art.

Thus, we chose the following two types of machine learning methods as the baseline methods:

• Classical NLP methods: logistic regression, SVM, random forest, and gradient boosting (LightGBM [18] ). • Transformer-based pre-trained language models: BERT [13] , RoBERTa [14] , ALBERT [15] , and XLNet [16] .

B. Metrics

Automatic detection for dark patterns is a binary classification that predicts whether a given text is a dark or non-dark pattern. We adopted accuracy, precision, recall, F1-score, and AUC to evaluate the models over 5-fold cross-validation.

C. Experimental Evaluations Using Classical Nlp Methods

We adopted the following two-step procedure for classical NLP methods: (i) Extract features of the texts using bag-of-words (BoW), followed by feeding each classifier. (ii) Train each dark pattern classifier.

We used scikit-learn 5 to implement the logistic regression, SVM, and random forest classifiers. For gradient boosting (LightGBM), we used lightgbm 6 . We tuned hyper-parameters by using Optuna [19] . Table VIII in the Appendix shows the best hyper-parameters for the classical NLP methods we adopted.

The experimental evaluation results are listed in Table VI , showing accuracies of 0.954 to 0.962.

D. Experimental Evaluations Using Transformer-Based Pretrained Language Models

BERT is a model with multiple layers of transformer encoders. BERT acquires knowledge about languages and domains through pre-training with a masked language model (MLM) and next sentence prediction (NSP) using a large-scale text corpus.

When applying BERT to text classification, it is common to perform transfer learning and fine-tuning on a task-specific dataset based on BERT that has been pre-trained on the language corpus targeted by the task. An overview of the BERT-based model for automatic dark pattern detection used in this study is shown in Fig. 2 . "[CLS]" and "[SEP]" are " is used for separating segments. The model was trained so that the classification result is output from the classification layer that linearly transforms the "[CLS]" representation output by BERT. We used the transformers 7 to develop and train the BERTbased models. We used AdamW [20] optimizer and linear learning-rate scheduler. When training deep learning models, we tuned hyper-parameters by grid search. Table IX in the Appendix lists the best hyper-parameters for the transformerbased pre-trained language models we adopted.

The experimental results of transformer-based pre-trained language models are listed in Table VII , which shows the best accuracy of 0.975 using RoBERTa large .

V. Conclusion

This study constructed a dark pattern dataset for ecommerce sites with baseline automatic detection perfor- mance. We hope the dataset will help researchers to pursue various research on the automatic detection of dark patterns. As for the baseline performance, we experimented with automatic dark pattern detection using a set of machine learning methods, including classical NLP-based models and transformer-based pre-trained language models. The results show that the RoBERTa-large model achieved a maximum accuracy of 0.975. Our future work will include 1) enhancing the dataset to include other websites, not just e-commerce sites, and 2) expanding the dataset to include other UX-related features besides texts, such as images and scripts because UX-related features are also helpful in detecting dark patterns.

SECTION

https://github.com/aruneshmathur/dark-patterns

https://github.com/puppeteer/puppeteer

https://developer.mozilla.org/en-US/docs/Web/HTML/Block-level ele ments

https://github.com/yamanalab/ec-darkpattern

https://github.com/scikit-learn/scikit-learn6 https://github.com/microsoft/LightGBM

https://huggingface.co/transformers/

SECTION