Authors:
Philippe Valoggia
1
;
Anastasia Sergeeva
2
;
Arianna Rossi
3
and
Marietjie Botes
4
Affiliations:
1
ITIS, Luxembourg Institute of Science and Technology, Esch-sur-Alzette, Luxembourg
;
2
DBCS, University of Luxembourg, Esch-sur-Alzette, Luxembourg
;
3
LIDER Lab, Sant’Anna School of Advanced Studies, Pisa, Italy
;
4
University of KwaZulu Natal, South Africa
Keyword(s):
Privacy Principles, Dark Patterns, Privacy Engineering, ISO/IEC 29100, 2011.
Abstract:
The privacy engineering literature proposes requirements for the design of technologies but gives little guidance on how to correctly fulfil them in practice. On the other hand, a growing number of taxonomies document examples of how to circumvent privacy requirements via ”dark patterns,” i.e., manipulative privacy-invasive interface designs. To improve the actionability of the knowledge about dark patterns for the privacy engineering community, we matched a selection of existing dark patterns classifications with the ISO/IEC 29100:2011 standard on Privacy Principles by performing an iterative expert analysis, which resulted in clusters of dark patterns that potentially violate the ISO privacy engineering requirements. Our results can be used to develop practical guidelines for the implementation of technology designs that comply with the ISO Privacy Principles.