Norwegian agency report: Facebook and Google manipulate users to share personal data using “dark patterns” despite GDPR; Windows 10 gets a more favorable rating
Despite the new GDPR regulation entering into effect across Europe, Facebook and Google are manipulating users …
Context & Ripple Effects
When GDPR granted standardized data rights across 28 EU countries in May, the question was whether compliance would be substantive or cosmetic. TechCrunch's April analysis of Facebook's consent interface already flagged design that pushes users toward saying yes, and the Norwegian consumer agency's new report extends that critique by name to both Facebook and Google — while rating Windows 10's flows as comparatively favorable.
The report matters because it shifts the argument from whether the law is followed to how interfaces are built: dark patterns can satisfy a consent checkbox while defeating the choice behind it.
First-order effects
- Facebook and Google face a named regulatory accusation that their consent flows manipulate users into sharing personal data, on top of the earlier German authority probe into EU-to-US data transfers by the same companies.
- Windows 10 gains a comparative credibility win: its data-sharing prompts are judged less manipulative than the ad platforms'.
Second-order effects
- Regulators outside Norway get a template: California's later move to ban dark patterns under CCPA rules shows the finding generalizing from an agency report to enforceable design standards.
- Site-level evidence cuts both ways for publishers — EU pages shed cookies and trackers after GDPR (22% fewer cookies per page on 200+ news sites), so platforms relying on consent-driven tracking lose ground where enforcement bites.
Third-order effects
- If agencies keep auditing interface design rather than just policy documents, platform governance moves from what companies say about data to how their screens steer users — making UX itself a regulated surface.
- Divergent ratings like this one give regulators a benchmarking practice: comparing products' consent flows turns privacy compliance into a competitive ranking rather than a pass/fail checkbox.
The trend: Privacy enforcement is expanding from legal compliance documents to the design of consent interfaces themselves, with dark patterns becoming a named, regulated offense.