How the Platform Economy Turns Interface Design Into a Privacy Risk

The most consequential battles over digital privacy may no longer be fought in privacy policies or courtrooms, but in the design of buttons, consent screens and account settings that users encounter every day. In "Privacy and Manipulation in the Platform Economy: An EU Framework for Regulating Dark Patterns," published in the journal Platforms, Panagiotis Kitsos of the University of Macedonia and Paraskevi Pappa of the University of Ioannina examine how manipulative digital interfaces translate into privacy harm, and whether Europe's increasingly dense regulatory architecture is capable of responding coherently.

The argument challenges a familiar assumption in digital regulation. Europe may not primarily suffer from a shortage of rules against manipulative design. The more serious weakness is that overlapping laws define similar conduct differently, assign enforcement to different regulators and impose different evidentiary thresholds. The result is a system that can be legally comprehensive while remaining institutionally fragmented.

Dark Patterns Are Becoming Part of the Platform Business Model

Dark patterns are interface choices that steer, pressure or mislead people into decisions they might not make under neutral conditions. They can include pre-selected privacy settings, confusing consent notices, repeated prompts, obstructive withdrawal procedures, visually biased choices or emotional cues designed to push users toward the option that benefits the platform.

The scale of the problem makes it difficult to dismiss these practices as isolated examples of aggressive design. The research cites a 2022 European Commission study in which 97% of major websites and applications examined in the EU contained at least one dark pattern. It also points to a 2024 coordinated international review in which 75.7% of digital services reviewed used such practices, while another European consumer-protection exercise found manipulative techniques on nearly 40% of online shopping websites.

What makes this especially important is the economic context in which the designs operate. Platforms frequently depend on data collection, engagement and continued user activity. Interface design is therefore not simply an aesthetic or usability function; it can influence what information users disclose, which permissions they grant and how difficult it becomes to reverse those decisions. The boundary between good commercial optimisation and manipulation becomes particularly significant when personal data are involved.

The authors move beyond the long list of labels that researchers and regulators have attached to these practices. By consolidating four privacy-focused taxonomies, they identify seven underlying mechanisms: pre-selected defaults; interface complexity and information overload; forced and bundled consent; deceptive or biased presentation; exploitation of relational and third-party data; obstruction of withdrawal and rights; and emotional steering or behavioural nudging. Six of these mechanisms are supported by at least three of the four independent classifications examined.

The shift from labels to mechanisms is more significant than it first appears. Regulators may describe the same conduct using the vocabulary of privacy law, consumer protection, platform governance or competition. However, a mechanism-based approach asks a simpler question: what is the interface actually doing to the user? That creates a common analytical language through which apparently different legal violations can be compared.

The Real Harm Is Not Just Lost Data; It Is Lost Autonomy

According to the paper, privacy dark patterns are united not by their appearance but by what they undermine. Across all seven mechanisms, the researchers identify some form of autonomy harm, a reduction in the user's practical ability to make an informed and self-determined choice about personal data.

Debates over privacy harm have often struggled with the absence of an immediately measurable loss. If a confusing consent screen does not cause financial damage, regulators may face difficulties explaining what exactly has been injured. Yet the study shows how manipulative interfaces can generate psychological, reputational, relational and economic harms while also producing less visible burdens such as lost control, wasted time and impaired decision-making.

The authors make a particularly useful distinction between the harm caused when users submit to a manipulative design and the burden experienced when they resist it. A person who eventually succeeds in refusing unnecessary cookies after navigating numerous screens may not have surrendered data, but that does not mean the interface imposed no cost. Time, attention and effort were deliberately made more expensive. The study therefore argues for recognising the cost of resistance, not only the cost of capitulation.

Privacy violations are often difficult to prove because regulators must connect an interface to an individual's experience of harm. The researchers instead develop the concept of "structural aptness": where a design mechanism necessarily creates a burden, such as making withdrawal more difficult than consent, the harm can sometimes be assessed through the structure of the interface itself rather than through detailed reconstruction of every user's subjective response.

The approach does not claim that every user experiences identical consequences. The paper acknowledges that vulnerability varies according to circumstances, digital literacy and dependency, and that the same interface may inconvenience one person while seriously harming another. But this is precisely why treating manipulative design merely as an inconvenience risks missing its wider distributional consequences.

Europe's Regulatory Gap Is Coordination, Not a Lack of Law

The most striking legal finding is that the GDPR engages all seven mechanisms identified by the researchers. The Digital Services Act covers five within their framework, the Data Act three, the Digital Markets Act two and the AI Act one. This complicates the standard narrative that rapidly evolving digital practices simply require another round of legislation. Europe already possesses a substantial legal toolkit.

The GDPR addresses manipulation through principles including fairness, transparency, consent and data protection by design. The DSA explicitly prohibits deceptive or manipulative interface practices, while the DMA, Data Act and AI Act address narrower aspects of consent, data sharing and algorithmic manipulation.

The difficulty is that these laws do not operate as one coordinated system. A single design feature can potentially engage privacy regulation, platform governance and competition rules at the same time, with different authorities applying different definitions, thresholds and enforcement objectives. The study therefore separates regulatory fragmentation into three forms: conceptual fragmentation in how the conduct is described, institutional fragmentation in who enforces it, and evidentiary fragmentation in what must be proven.

The most important gap concerns relational and third-party data, the collection or processing of information about people who may not even use the service themselves, for example through another user's address book or social connections. This mechanism appears in only one of the four privacy-specific classifications examined, yet the researchers consider it particularly important because the affected person may have neither consented nor interacted with the interface at all.

Its relative neglect exposes a limitation of interface-centred regulation. Digital manipulation does not always happen at the point where a user clicks a button. Increasingly, data exploitation can occur beneath the visible interface, through system architecture, profiling and network relationships. As platforms and AI systems become more interconnected, that distinction is likely to become increasingly important.

The Next Phase of Digital Regulation May Be Institutional, Not Legislative

The study's policy implications point toward coordination before expansion. Because several EU instruments ultimately seek to protect user autonomy, the authors argue that regulators could develop more consistent interpretations without necessarily rewriting the law. Joint guidance across data-protection, platform, competition and consumer authorities could help ensure that the same manipulative mechanism is recognised consistently across regulatory regimes.

• Businesses can't treat compliance as a matter of inserting legally correct language into a consent notice. Interface architecture itself is becoming part of the compliance environment. A privacy-protective option may formally exist while remaining practically inaccessible if accepting takes one click and refusing requires navigating several screens.
• For governments outside Europe, including regulators across the Global South, the wider lesson is valuable. Countries developing digital-governance systems have an opportunity to avoid some of Europe's institutional layering by designing coordination mechanisms alongside new legislation. Importing individual provisions without considering which agencies will enforce them, how evidence will be assessed and how overlapping mandates will interact could reproduce the same fragmentation.

The research nevertheless has clear limits. It is doctrinal and conceptual rather than an empirical study of user behaviour. Its mappings describe harms that particular mechanisms are capable of producing; they do not establish how frequently those harms occur in practice. The core privacy taxonomy is based on four sources, and the relational-data mechanism rests on only one. The authors also use enforcement cases illustratively rather than attempting to measure broader enforcement trends.

The limitations also point to the next research agenda. The framework can now be tested empirically across different platforms, populations and regulatory environments. Future work could investigate whether mechanism-based enforcement leads to more consistent outcomes, how cumulative exposure to manipulative interfaces affects users over time, and whether AI-generated persuasion creates forms of manipulation that existing interface-focused rules do not adequately capture.