Privacy Zuckering

Consent screens grew as the list of things requiring consent grew. Analytics, recommendations, marketing email, third-party processors and data retention each earn a line. Past roughly ten items, people stop reading and start skipping. At that point the layout of the screen, rather than the wording on it, decides what people agree to.

Pagedeck's first signup screen had that shape. Twelve consent items sat in one list, and below them a single blue button offered to allow everything. Turning items off individually meant one grey toggle per item. No regulation was being broken and nobody set out to mislead anyone. Four months later, 94 percent of accounts had the item allowing document contents to train recommendations switched on, and the support queue was filling with people who had no memory of agreeing to it.

The name traces back to the founder of a social network that reorganised its privacy settings several times. It was never meant to describe one company; it settled into a label for the whole practice of changing the outcome through the shape of the consent screen.

The mechanism isn't a deceptive sentence, it's a layout that raises the reading cost on one side only. Make allowing take one action and refusing take twelve, and the result tilts without a single rule being broken. Five devices do the work.

1. Default everything on. People leave defaults alone, and a screen with a dozen switches is exactly where that tendency is strongest. If all twelve items open in the on position, somebody who pressed nothing has consented to twelve things, and the log records that as a choice.
2. Price the two paths differently. Allow all is one tap; individual refusal is twelve. One button is blue and the other is the same grey as the background.
3. Invert the sentences. Write the item as "don't send me tailored recommendations" and checking the box takes two reads to interpret. Mixing toggles that mean "on" with toggles that mean "off" on one screen does the same job.
4. Bundle required consent with optional consent. Put the terms of service and marketing email in a single checkbox and the item nobody can refuse carries the item they would have refused.
5. Keep the real scope far away. The screen says data is used to improve the service, and what is actually collected and how long it's kept lives two clicks deeper.

What separates this from the other types is that it takes something you can't get back. Money taken by forced continuity can be refunded, usually within a support thread or two. Time taken by a roach motel ends when the cancellation finally goes through. Data that has already moved may have gone into a model, or to another company, before the account was deleted.

It appears anywhere consent has to be collected in one pass. Five places account for most of it.

1. The signup consent screen. This is where the largest number of items collect, and whatever is switched on here stays on for the life of the account.
2. The cookie banner. Allow all sits on the first screen as a button while per-category settings live one screen deeper, behind a link sized for the corner of the box.
3. App permission prompts. Location or contacts get requested at a moment unrelated to the feature that needs them, and re-prompting after a refusal layers nagging on top.
4. Profile visibility settings. Default the profile to public without saying so and users learn their information is searchable from someone outside the product — which is the version of this that generates the most anger, because it involves other people seeing something they never published.
5. Third-party connection screens. Whether the scope is read-only document access or full account access gets one line in small type, on a screen people reach while trying to finish something else.

Auditing this is faster by creating an account than by reading documentation. Sign up pressing nothing, accepting every default, then count what's switched on and count how many taps it takes to switch all of it off. Two numbers come out of that exercise, and both of them are easier to argue with than a policy review is. Pagedeck turned nine of its twelve defaults off and matched the size of the allow-all button to the size of the per-item settings button. Consent for recommendation training fell from 94 percent to 41 percent. Read as a number that's a loss; the remaining 41 percent, though, was consent that generated no deletion requests.

"This is privacy zuckering. Allow all is a button and the individual settings are a text link."

Pointing out that the two options aren't the same size, as an argument for reverting the design.

"94 percent consent isn't a number we earned."

The figure reflects the structure of the screen rather than a judgement any user made.

"Can you pull the list of items that default to on?"

Start by counting what is switched on without the user having chosen it, before arguing about any individual item.

When Noa rebuilt the signup screen, the change wasn't cutting items — it was making the two buttons the same size. The proposal went up knowing consent rates would drop, and what Grace approved it on was 78 support threads from the preceding four months. Each "I don't remember agreeing to this" thread took about 20 minutes to handle, and nine of them turned into account deletion requests.

The most common position is that staying inside the law means it isn't a dark pattern. The consent wording meets every requirement, so nothing looks wrong. But this type is about placement, not wording. Set the same sentence in a size and colour nobody reads and the outcome matches having no sentence at all. Regulators have moved the same way, looking past the existence of the disclosure to the relative size and contrast of the two options and the number of clicks refusal costs.

The other habit is assuming bad intent is required. The name carries enough edge that people picture somebody designing this deliberately. In practice, treating consent rate as the metric and running A/B tests against it arrives here on its own. A version with a larger allow-all button lifts consent six percent, that version wins, and the next experiment starts from that screen. The useful point is that this is diagnosable from the screen rather than from anyone's motives. Unlike confirmshaming, where the evidence sits in the copy, here the evidence sits only in the layout — which is how the people who built it can end up not knowing what they built.