It’s not exactly a secret: Facebook and other major tech companies make most of their money from your personal data. After all, that’s what advertisers want most—and they’re willing to pay a pretty penny for it. However, the real issue lies in how these companies go about collecting your information. According to a new study from the Norwegian Consumer Council, Facebook tricks users into giving up their data using simple and subtle design tweaks.

For example, Facebook recently sent users a pop-up stemming from the strict new GDPR European data law that informed people about their privacy settings. However, on this pop-up, users were prompted to “Agree and Continue” with a large blue button. A greyed-out button next to it lets users “Manage Data Settings.” Obviously the blue button is more appealing; anyone who has ever used the Internet could guess that. Additionally, the study found that it took only four clicks to take the “easy road” through Facebook’s suggested settings, while it took 13 to customize settings. And those aren’t the only tricks these tech giants are using.

“The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users,” the report says.

Though Facebook is technically playing by the rules with these little elements, they make a big difference. That’s why it’s always a good idea to pay close attention when Facebook prompts you to do something.