CIPP/E Study Guide
IAPP Training · Module 8 - BoK V.D

Module 8 · Dark patterns (Guidelines 03/2022), AI & the EU AI Act

Last reviewed:

Dark patterns are deceptive interface designs that manipulate users about their personal data; EDPB Guidelines 03/2022 set out six categories. AI can make automated decisions, engaging Article 22; the EU's ethical principles are respect for human autonomy, prevention of harm, fairness and explicability. The EU AI Act (passed 13 March 2024) is risk-based with four tiers and is extraterritorial, covering providers and deployers.

The six dark-pattern categories (EDPB Guidelines 03/2022)
CategoryIdea
OverloadingFlooding users with too many options/requests to wear them down.
SkippingDesigning so users overlook or skip privacy-protective choices.
StirringUsing emotion or visuals to nudge a particular choice.
HinderingMaking it hard to exercise rights or change settings.
Fickle (Fickling)Inconsistent, unclear interface that confuses users.
Left in the darkHiding information so users can't understand the processing.

Dark patterns violate fair processing, transparency, data minimisation, accountability, purpose limitation, consent, and data protection by design and default.

AI can make automated decisions, engaging Article 22 (profiling/automated decisions). The EU Commission's ethical principles for trustworthy AI are respect for human autonomy, prevention of harm, fairness and explicability.

EU AI Act - four risk tiers
TierTreatment / example
UnacceptableProhibited
High riskMost heavily regulated
Limited riskTransparency obligations
Minimal / no riskLargely unregulated (e.g. spam filters)
AI Act scope

The EU AI Act (passed 13 March 2024) is extraterritorial: it covers providers and deployers in the EU, providers placing products in the EU, and operators outside the EU whose output is used in the EU. Exemptions include military/national security, R&D, certain third-country public authorities, non-professional personal use and some open-source AI.

Key terms - quick answers

What is “Dark patterns”?
Deceptive interface designs that manipulate users about their personal data; EDPB Guidelines 03/2022 list six categories.
What is “EDPB Guidelines 03/2022”?
EDPB guidance on dark patterns in social-media interfaces and how to recognise and avoid them.
What is “EU AI Act”?
The world's first comprehensive AI regulation, passed by the European Parliament on 13 March 2024; risk-based, with four tiers, and extraterritorial.
What is “Provider / deployer”?
Under the AI Act, providers develop or sell AI systems; deployers use them. Both can fall within scope, including operators outside the EU whose output is used in the EU.

Keep going - free

Every study note on this site is free. So are these: