Regulating Consent and Dark Patterns: Bridging Law, Web Measurement, and HCI
Talk by Nataliia Bielova
Abstract: Over the past decades, Web tracking technologies have enabled pervasive, large-scale surveillance of online activity for data extraction and targeted advertising. In response, European regulators have sought to safeguard users through the consent required by the General Data Protection Regulation (GDPR), operationalized in practice via cookie consent banners. Yet these interfaces frequently rely on “dark patterns” that manipulate user decision-making. Such manipulative design does not only affect end users, but can also distort interactions among other actors in the web ecosystem.
In this talk, I examine how cookie consent mechanisms and dark patterns can be regulated under existing and emerging EU legal frameworks, including the General Data Protection Regulation and the Digital Services Act (DSA). I argue that effective enforcement requires close collaboration between legal scholars, web measurement researchers, and the HCI community. By combining doctrinal legal analysis with web measurements and empirical user studies, regulators can be better equipped to make robust, evidence-based, legally binding decisions. I conclude by outlining the key opportunities and methodological challenges of this emerging transdisciplinary research agenda aimed at strengthening user protection online.
Bio: Dr. Nataliia Bielova is a Research Director in Computer Science at Inria (French Institute for Research in Computer Science and Automation). She is a privacy expert with a multidisciplinary background in computer science and regulation, investigating privacy and data protection on the Web. Dr. Bielova was a Senior Privacy Fellow at the French Data Protection Authority (CNIL) and an External Expert for the EU Commission for its implementation of the EU Digital Services Act (DSA). She received a Young Researcher Award from the French National Research Agency (ANR), the Rising Star award by Women at Privacy in 2023, the CNIL-Inria Privacy Award in 2025 and the Lovelace-Babbage Award from the French Science Academy and the French Computer Society in 2025.
