Dark patterns e dados pessoais: uma análise da utilização de padrões enganosos no design de interfaces à luz do regime de proteção de dados brasileiro

Abstract

The present dissertation aims to analyze the use of dark patterns in user interface design under the Brazilian law, specifically under the national framework of personal data protection. It is an exploratory literature review conducted through the analysis of legal texts and documents from various fields, such as behavioral economics and human-computer interaction. The work has three chapters. The first chapter outlines the development of the rights to privacy and data protection, highlighting the centrality attributed to the control exerted by the individual over their information in global data protection legislations, with such control rooted in the assumption of the data subject as a rational agent. From this standpoint, the construction of the data subject as a vulnerable and susceptible individual to manipulation is delineated. This theoretical formulation aligns with the view that individual control is insufficient to effectively ensure the safeguarding of personal data. In the second chapter, the influence of interface design on the decision-making of users/data subjects is explored. Within this context, various definitions of dark patterns are presented, and it is observed that the main characteristics comprising deceptive patterns are: a) design with manipulative intent; b) direct impact on the user's decision-making process; c) ability to cause harm to the individual; d) applied with the aim of benefiting the product/service provider. Additionally, cognitive biases that can be exploited by these patterns are illustrated, alongside a taxonomy of dark patterns and specific types used within the context of personal data processing. Lastly, the third chapter proposes an evaluation of the application of deceptive patterns under the Brazilian data protection regime, employing the LGPD as a parameter. The assessment is based on three elements: a) principle of good faith; b) data processing legal basis, notably consent; and c) privacy by design principle. It is concluded that the use of dark patterns directly challenges fundamental principles of the right to personal data protection.