B.C.'s privacy commissioner has reiterated a call for a children's cyber protection code after a global internet sweep found privacy choices are being manipulated.
Commissioner Michael Harvey said the sweep examined more than 1,000 websites and mobile apps and found that nearly all employed one or more deceptive design patterns that made it difficult for users to make privacy-protective decisions.
“Our children are particularly vulnerable to over-collection of their personal information online,” Harvey said.
This year’s annual Global Privacy Enforcement Network (GPEN) Sweep took place between Jan. 29 and Feb. 2. It involved participants, or “sweepers,” from 26 privacy enforcement authorities from around the world.
“It was clear to both privacy and consumer protection sweepers that many websites and apps employ techniques that interfere with individuals’ ability to make choices that best protect their privacy or consumer rights,” Harvey’s office said of the GPEN findings.
A significant issue issue noted in the findings was the use of so-called deceptive design patterns — also known as ‘dark patterns,’ features that steer users towards options that may result in the collection of more of their personal information.
What those patterns may also do, B.C.’s Office of the Information and Privacy Commissioner said, is force users to take multiple steps to find a privacy policy, log out, or delete their account, or present them with repetitive prompts aimed at frustrating them and ultimately pushing them to give up more of their personal information than they would like.
The B.C. office focused on websites targeting children to further its commitment to promoting and protecting the privacy rights of young people.
That commitment has included calling for a Children’s Code, "which would bolster guidance to businesses on safeguards for handing the data of young people that address the specific challenges and unique harms youth face when they engage online."
“We found a higher incidence of deceptive design patterns in Canada than in other countries, and that children are more often the targets. These websites are deceiving and manipulating our kids into revealing their private information — so that they can use it to further deceive and manipulate them,” Harvey said.
“These are real harms to our children and when a child is harmed, so are we all. We call upon websites and apps to end these ‘dark patterns’ and limit the collection and use of our kids’ personal information,” Harvey added.
Harvey’s office collaborated with the Office of the Information and Privacy Commissioner for Alberta and the Office of the Privacy Commissioner for Canada for the sweep.
Canadian sweepers found that 56 per cent of children’s websites and apps displayed a false hierarchy by making the option to sign up to the service more prominent than that to continue without an account.
Further, on 54 per cent of the children’s websites and apps, Canadian sweepers encountered charged language that could dissuade users from choosing more privacy protective options.
In 45 per cent of cases, they encountered some form of "nagging" when interacting with children’s websites and apps. For example, users were repeatedly confronted with the same prompts or requests.
The full results can be found online.
Earlier calls for code
Harvey’s predecessor Michael McEvoy called for a code back in 2022, citing online privacy concerns such as ad targeting.
Such a code was already in use in the United Kingdom, Ireland and California, McEvoy said.
He reiterated that a year later, saying such a code would allow youth “to enjoy the tremendous and exciting potential of technology while minimizing opportunities for bad actors to manipulate youth for their own gains.”
McEvoy also said he was exploring how provincial lawmakers and regulators, including the likes of school boards, could create stronger digital age guidelines for privacy and information sharing standards for youth that will be underpinned by existing fundamentals of privacy rights found in B.C.’s Freedom of Information and Protection of Privacy Act.
