So I've been asked to develop a feature at work that would give a generic welcome message to new users when they sign up. But the message isn't from our company; it is signed from the person who referred them to become a user.

So John sends a referral to Jane. When Jane signs up she will see a message that says: "Welcome, I'm glad you signed up! -John".

But John never gets notified about this message. It just shows up without his knowing it will.

As a user I don't like this feature and I've made it known. I also offered a solution as a feature that prompts John to send a generic welcome message. But I got pushback saying that this was legal and not a big deal.

Am I making a mountain out of a mole hill? Or is this as big of a deal as it feels to me?

If it is a big deal, what more can I do about it at work?

  • 4
    Is this your product? Is this your company? If not, let it go. Some battles can't be won.
    – joeqwerty
    Sep 9, 2021 at 23:23
  • Is it sent like a private message, or just in a pop-bar that you can't respond to?
    – Erik
    Sep 10, 2021 at 7:00
  • Why would John not know?
    – Kilisi
    Sep 10, 2021 at 8:42
  • @Erik it's a welcome message on the 1st screen of the app. Sep 10, 2021 at 14:06
  • @Kilisi That's my concern, John is never notified that we will be presenting a welcome message in his name when the user downloads the app. Sep 10, 2021 at 14:08

3 Answers 3


It is pretty sketchy. I would never want to send a message that purports to be from someone who did not authorize it.

But this isn't your company, so you may have to just do it. I would DEFINITELY send a note to the person asking for this feature that it may be poorly received if the people who the message is impersonating take umbrage with it. Then, once you've noted the possible negative consequence, do as you're instructed.

I'd definitely raise alarms on this, but I don't know that it's worth walking away from if the customer/employer has generally behaved ethically outside of this incident.

  • 5
    If you want to give a last push at persuasion before giving up, you could mock a screenshot of the proposed screen into a fake tech news article saying something like "Creepy website $x puts words in your friend's mouths" ... The Register or TechCrunch gives a regular stream of examples.
    – Adam Burke
    Sep 9, 2021 at 23:53

What you're describing sounds like a dark UI pattern. It looks like it might be a variation on the pattern below.

Friend Spam

The product asks for your email or social media permissions under the pretence it will be used for a desirable outcome (e.g. finding friends), but then spams all your contacts in a message that claims to be from you.

The most famous example of this dark pattern was used by Linkedin, which resulted in them being fined $13 million dollars as part of a class action lawsuit in 2015.



With that said, it's probably not the same pattern your company is using. LinkedIn's pattern was much worse in my opinion. Also, $13 million dollars was actually a drop in a bucket for a company like LinkedIn. And finally, this happened in the US and I'm not even sure what jurisdiction your company is in.

If you really want to convince them that this is a bad idea, I would talk instead about the PR backlash LinkedIn received.

And if you don't think you can convince them, perhaps you can nudge them to do some initial A/B testing for that message on only a small subset of your users.

I wouldn't be surprised that for many users, that they'll know instantly that this is not a message from their friend. And if you can demonstrate that this kind of message doesn't lead to a higher conversion rate, then you'll be speaking their language.

This is assuming that my hypothesis is right. Of course, it's possible that I'm wrong about this and that the data will show that they made the right decision financially (even if their decision was really scummy).


The bar your employer has set is "is it legal", not "will our users appreciate this", or "does this reflect poorly on us".

Ultimately, if all they care about is the legalities, the only thing that will sway them is an argument from a legal standpoint.

Looking specifically at the legal aspects, even though it's not the main focus of your question, where I reside fake endorsements are illegal. A question would be does a referral imply an endorsement any less than the invented quot... probably not.

Having said that, decisions makers are NOT meant to only care about legal aspects. They are meant to care about the overall impact of the business. Personally I would feel violated if a service I was using was putting words in my mouth.

What often happens in business is that once there is some sort of concept that "works", it's copied over and over again. How long will it be until when users enable features they get fake messages like: "I like how you also are using feature X", or "I'm using Y, and I LOVE it, you should use it to".

  • 3
    In the EU and the UK, processing personal data (the "sender's" name) without their informed consent for the use for which it is processed is illegal. Depending on the form the welcome message takes and the intended effect, it could be forgery in the UK. Sep 10, 2021 at 7:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .