German Authority and EU Bodies Target “Dark Patterns” in Trading Apps and Online Interfaces | Perspectives & Events

Recently, the German Federal Financial Supervisory Authority (BaFin) issued guidance that investment firms are not allowed to use dark patterns in trading apps or trading portals

and announced that it will promptly intervene on already-identified use of dark patterns. In addition, other existing and upcoming EU legislation restricts the use of dark patterns

and applies to businesses beyond investment firms. Most EU businesses will be affected by at least some dark pattern rules, and the use of dark patterns in online interfaces such

as those of apps or homepages can violate multiple laws. Against this backdrop, businesses should review their current practices and digital interfaces immediately. This Legal

Update provides further detail on the various prohibitions and possible sanctions. “Dark Patterns” Dark patterns are design elements (e.g., the size and color of buttons) or

processes (e.g., unsubscribing from a service) that may obscure, mislead or deceive users into making unintended choices in online interfaces.  For example, two of the dark

patterns BaFin has criticized, based on its review of trading apps, are having no or a barely perceptible button to cancel a transaction while having a strikingly designed button

to conclude a transaction. Similar discussions revolve around cookie banners that require website users to click on multiple buttons, for example, to avoid having to accept all

cookies. Relevance of BaFin Guidance for Investment Firms Outside of Germany Other investment firms operating in the EU should take note of the BaFin guidance. It is based on

Section 63 (6) sentence 1 of the German Securities Trading Act (WpHG), which is part of the code of conduct for investment firms and implements Article 24 (3) sentence 1 of the

European Directive 2014/65/EU (MiFID II) into national law. Other European supervisory authorities could also see the use of dark patterns as unfair and misleading in the sense of

Article 24 (3) sentence 1 MiFID II.  Other Prohibitions Under EU Law and Applying Beyond Investment Firms Other existing and upcoming EU legislation focuses on the use of dark

patterns and applies to more businesses than just investment firms. For example, the European Data Protection Board (EDPB) stipulates in its "Guidelines on Dark Patterns in Social

Media Platform Interfaces" of March 2022 that the use of dark patterns may violate data processing requirements under the GDPR such as the principles of fairness and transparency

(Art. 5 (1) (a) GDPR) and information obligations under Art. 12 (1) sentence 1 GDPR. Furthermore, consent to data processing may be invalid if it was induced by manipulative design