EPIC Encourages CalPrivacy to Prohibit Dark Patterns in Privacy Policies

In response to CalPrivacy’s request for input on the state’s privacy policy requirements, EPIC submitted comments on Wednesday advising the Agency to ensure that policies are easily accessible, do not use dark patterns, and directly link to ways Californians can exercise their privacy rights. 

EPIC’s comments argue that privacy policies and disclosures should be as clear as possible and directly tied to actionable steps so that Californians can effectively exercise their rights under the California Consumer Privacy Act. The CCPA established Californians’ right to know, correct, delete, and opt out of the sale of personal information, and it includes strong data minimization requirements to protect state residents from the harmful overcollection of personal information, out-of-context and impermissible secondary data uses, and excessive data retention. 

EPIC specifically recommended CalPrivacy address harms from privacy policies that are spread across many documents and links and require policies to directly link to where individuals can exercise their rights under the CCPA. These regulations should also prohibit the use of dark patterns in privacy policies, EPIC said. 

EPIC has consistently engaged with CalPrivacy to strengthen Californians’ privacy rights. EPIC also regularly advocates against all forms of manipulative designpatterns, also known as dark patterns. This week, EPIC published its latest report on the issue, titled Good Luck Opting Out: Manipulative Design Patterns in Opt-Out Processes.