Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them

• Jurisdiction: European Union
• Date: 24 February 2023
• Year: 2023
• Type of Document: Guidance

Adopted 1

Guidelines 03/2022 on

Deceptive design patterns in social media platform

interfaces:

how to recognise and avoid them

Version 2.0

Adopted on 14 February 2023

Adopted 2

Version history

Version 2.0

14 February 2023

Adoption of the Guidelines after public consultation

Version 1.0

14 March 2022

Adoption of the Guidelines for public consultation

Adopted 3

EXECUTIVE SUMMARY

These Guidelines offer practical recommendations to social media providers as controllers of social

media, designers and users of social media platforms on how to assess and avoid so-called “deceptive

design patterns” in social media interfaces that infringe on GDPR requirements. To this end, the EDPB

recommends that controllers make use of interdisciplinary teams, consisting, among others, of

designers, data protection officers and decision-makers. It is important to note that the list of

deceptive design patterns and best practices, as well as the use cases, are not exhaustive. Social media

providers remain responsible and accountable for ensuring the GDPR compliance of their platforms.

Deceptive design patterns in social media platform interfaces

In the context of these Guidelines, “deceptive design patterns” are considered as interfaces and user

journeys implemented on social media platforms that attempt to influence users into making

unintended, unwilling and potentially harmful decisions, often toward a decision that is against the

users’ best interests and in favour of the social media platforms interests, regarding the processing of

their personal data. Deceptive design pattern s aim to influence users’ behaviour and can hinder their

ability to effectively protect their personal data and make conscious choices. Data protection

authorities are responsible for sanctioning the use of deceptive design patterns if these breach GDPR

requirements. The deceptive design patterns addressed within these Guidelines can be divided into

the following categories:

 Overloading means users are confronted with an avalanche/large quantity of requests,

information, options or possibilities in order to prompt them to share more data or

unintentionally allow personal data processing against the expectations of the data subject.

The following three deceptive design pattern types fall into this category: Continuous

prompting, Privacy Maze and Too Many Options

 Skipping means designing the interface or user journey in a way that users forget or do not

think about all or some of the data protection aspects.

The following two deceptive design pattern types fall into this category: Deceptive Snugness

and Look over there

 Stirring affects the choice users would make by appealing to their emotions or using visual

nudges.

The following two deceptive design pattern types fall into this category: Emotional Steering

and Hidden in plain sight

 Obstructing means hindering or blocking users in their process of becoming informed or

managing their data by making the action hard or impossible to achieve.

The following three deceptive design pattern types fall into this category: Dead end, Longer

than necessary and Misleading action