Taking aim: ICO & CMA on harmful design

Designers and product managers, I urge you to pay attention to this new publication on ‘harmful design’ aka deceptive patterns. It’s a joint position paper by the ICO and CMA, the UK’s privacy and competition regulators respectively.

I wasn’t heavily involved in this work – I had my hands full with the privacy design guidance – and I’m no longer at the ICO. So I have some leeway to give my own (strictly personal) interpretation of this paper in a way the authors and employees can’t.

Have no doubt: this is a warning shot.

Two powerful regulators have joined forces to put industry on notice over deceptive patterns. The language is carefully couched but IMO the implication is clear. This is step one. Step two will be robust. I won’t be surprised to see direct enforcement (i.e. legal action against companies that keep using deceptive patterns) or strict policy stances (essentially, outright prohibitions) in the near-ish future.

It’s rare and difficult for regulators to join forces like this. Two regulators expressing their joint disapproval of the same design patterns: that’s huge. Not one big stick but two.

Here are the five patterns the paper highlights:

• Harmful nudges

• Confirmshaming

• Biased framing

• Bundled consent

• Default settings

The paper gives specific, mocked-up examples, and both regulators explain why they’re concerned about each pattern, pointing to UK laws already in effect.

So, my advice: if you work for a technology team in the UK or on a digital product with UK customers, act now. Read the document. Identify whether you’re using these deceptive patterns. If so, remove them now. If you don’t have that authority, show the document (and this post too, if you like) to your most senior product leader and your legal team.

This paper is the regulators cocking the gun. You don’t want the barrel pointing at you.