Privacy rights dark patterns

A dark pattern I’ve seen more than once is a privacy rights form that needs to be filled out including basic contact information. There is also mention of cookies and device IDs that goes something like this:

"any response we are able to provide to your request will necessarily only apply to the specific cookie or device IDs that you identify for us"

But no form field or explanation for how the cookie or device ID will be included is provided.

Where is it?

You got it! You’re already under surveillance and they’re trying their best not to admit it! They’re counting on you submitting the form from the phone or laptop or tablet that they are already tracking. Note that you have no intentional relationship with this company.

They will also often tell you that this is all okay because they do not maintain any personally identifiable information. The line of thinking here is that by placing a tracker on your machine, it is the machine that is being tracked, and they do not have your name or email address or other identifying attributes.

But hold on. Aren't they in the business of collecting and selling your information? Do you think the buyers of this data may be able to link this data to information they got from another source? The answer is: absolutely. Consider the power of having your recent purchase data merged with your location data or your social network graph data.

As I work in this space, I often measure the behavior we see with what would have been okay before there was an internet. In those days, the example above would have been analogous to someone putting a radio beacon under your car, then demanding that you let them search for the beacon before they’ll agree to stop surveilling you. In 2022, this is unfortunately very common.

The technology has changed, but the ethics should not have. There is a lot to say about this, and if you are looking for a deep dive I would recommend picking up "The Age of Surveillance Capitalism" by Shoshana Zuboff.