In addition to fraudulent pretenses for collection, there are practices which are simply predatory or harrassment.
Numerous sites present various dialogues on every visit (more so if you use incognito mode as a rule, I do), or treat Tor access highly differently from direct access (denying access entirely, raising GDPR blocks, putting various nags in the way, or popping up often-impenetrable CAPTCHA dialogues).
There's the case of sites which mandate javascript use to present any content, even if no interactive elements are used.
There are the repeat nags to use apps and such. Twitter's dialogue offers the options "Switch to the app" and that won't-take-no-for-an-answer-creepy-stalker "Not now". (Disabling JS breaks the site fully, reminding me that I actually want to use whatever Nitter site(s) are not yet rate-limited: https://github.com/zedeus/nitter/wiki/Instances)
There are buttons and other tools which follow users across the Internet and devices.
There are tools that track and correlate multiple signals, including audio tracking (embedded signals in commercial music and advertising broadcasts), MAC address, device ID, Bluetooth ID, SSID locations, etc.
Google have a an "opt-out" standard for SSID identifiers, which really ought to be criminal: https://support.google.com/maps/answer/1725632#how_opt_out&z... (HN discussions: https://news.ycombinator.com/item?id=27518415 https://news.ycombinator.com/item?id=7347397 https://news.ycombinator.com/item?id=22466447)
DuckDuckGo provides counterexamples to several of these, handily illustrating several practices I'd like to see far more widespread:
- There's a no-JS site which works fine in console-mode browsers. I use that for a bash-function CLI search-engine tool (actually, several leveraging DDG's bang searches). Two, actually: https://lite.duckduckgo.com/lite and https://duckduckgo.com/html (standard formatting, but HTML-only functionality).
- There's a "no-nag" URL so you can pop up the search page without any prompt to set DDG as your primary browser: https://start.duckduckgo.com/ (This is a particularly elegant solution IMO to the company's need to convert users to defaulting the search engine, and not annoy those who've long since done so.)
- The site Just Works on Tor. There's an Onion address as well: http://3g2upl4pq6kufc4m.onion/ I've certainly never encountered a CAPTCHA.
(DDG isn't perfect, the recent Tank Man image censorship resulting from the site's major reliance on Bing for Web and Image search being a notable recent issue.)
A major problem with normalising dark patterns is that they become acceptable, people cannot even conceive that they have an alternative, and that as technologies evolve from early-adopter toy (or secret advantage) to mass-public necessity for commerce, business, government, culture, and social essentials, there is simply no alternative but to be subjected to these patterns. Criminalising these, especially after an initial warning or finding (Because Reasons, regulators often seek relatively modest initial remedies, there are critics of this practice, and many, myself included, would strongly appreciate second offences and further to carry much deeper bite).
The trade and exchange in third-party data and information should be fully and completely outlawed where not specificly and directly authorised and necessary for transactional fulfillment.