Dark Patterns Stopped Being a Style Question
The taxonomy, the large scale study that measured how common these patterns are, and the point at which the practice became a legal question rather than a style question.
Date
Category
Writer
On 25 September 2025 Amazon agreed to pay 2.5 billion dollars to settle a case about a button. One billion of that was a civil penalty and 1.5 billion was consumer refunds, and the Federal Trade Commission's account of what went wrong is entirely a description of interface design. The agency charged that Amazon used deceptive user interfaces to lead consumers to enroll in Prime without their knowledge and built a complex and difficult process for consumers seeking to cancel their Prime subscription. The settlement order requires, among other things, that the decline option cannot be labelled with something like "No, I don't want Free Shipping".
That last clause is the part I would pin above a desk. A regulator has now written down, in an enforceable order, that the wording on a secondary button is a legal matter. Not a taste matter. Not a conversion-rate matter to be settled by whoever has the louder opinion in the review. A legal matter, with a monitor attached.
Where the word came from
Harry Brignull coined the term "dark patterns" in 2010 and founded the site that catalogued them, then called darkpatterns.org and now deceptive.design. Brignull holds a PhD in cognitive science and has spent more than two decades in user experience as a researcher, designer and consultant, which matters to the history: the vocabulary came from inside the profession, not from outside it. The site's current definition is deliberately plain. Deceptive patterns are tricks used in websites and apps that make you do things you didn't mean to, and more precisely features of apps, websites and AI systems that stop you doing what you want, or steer you into harmful decisions.
The catalogue now runs to eighteen named types: Addictive Design, Comparison Prevention, Confirmshaming, Currency Confusion, Disguised Ads, Fake Scarcity, Fake Social Proof, Fake Urgency, Forced Action, Hard to Cancel, Hidden Costs, Hidden Subscription, Nagging, Obstruction, Preselection, Sneaking, Trick Wording and Visual Interference. The site notes that it was formerly called Dark Patterns without explaining the rename, though the shift from a colour metaphor to a plain description of conduct reads, to me, like a deliberate move towards language a lawyer can use.
The study that turned a vocabulary into evidence
For nine years the taxonomy was a collection of screenshots. Then in 2019 Arunesh Mathur, Gunes Acar, Michael J. Friedman, Elena Lucherini, Jonathan Mayer, Marshini Chetty and Arvind Narayanan published "Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites". Their abstract states the method and the result without ornament:
Analyzing ~53K product pages from ~11K shopping websites, we discover 1,818 dark pattern instances, together representing 15 types and 7 broader categories. We examine these dark patterns for deceptive practices, and find 183 websites that engage in such practices. We also uncover 22 third-party entities that offer dark patterns as a turnkey solution.
The project page adds the figure that gets quoted least and matters most: those 1,818 instances were present on 1,254 of the roughly 11,000 sites, about 11.1%. Roughly one shopping site in nine. The researchers also found that sites which were more popular, by Alexa ranking, were more likely to feature dark patterns, and they counted 234 instances of specifically deceptive patterns across those 183 sites.
Category | Types identified | What it does to the user |
|---|---|---|
Sneaking | 3 | Hides or delays information the user would object to |
Urgency | 2 | Imposes a real or invented deadline |
Misdirection | 4 | Steers attention towards or away from a choice |
Social proof | 2 | Uses others' behaviour, real or invented, as pressure |
Scarcity | 2 | Signals limited supply or demand |
Obstruction | 1 | Makes one path harder than another |
Forced action | 1 | Requires an unrelated action to proceed |
The twenty-two third-party vendors are the finding I would put in front of anyone who thinks this is a problem of individual bad designers. Some of these patterns were not designed at all in the studio sense. They were purchased, installed as a script, and configured by a marketing team.
What the law now actually says
The European Union wrote a general prohibition into the Digital Services Act, Regulation (EU) 2022/2065, adopted on 19 October 2022 and applicable from 17 February 2024. Article 25 is short enough to read in full, and reading it in full is the only way to understand its limits.
Paragraph 3 is a list of three design decisions. Visual hierarchy between two options. Nagging. Asymmetric cancellation. Those are the things a designer draws, and the Commission has named them as the practices it may write guidance about.
Paragraph 2 is the part that gets dropped from summaries, and it substantially narrows the article. Practices already covered by the Unfair Commercial Practices Directive or by the GDPR fall outside Article 25, which means a great deal of ordinary consumer deception and almost all consent-related manipulation is dealt with under older instruments instead. Article 25 is a gap-filler, not a general charter. The DSA's recital on the subject describes dark patterns as practices that materially distort or impair the ability of recipients to make autonomous and informed choices, naming deceptive nudging, non-neutral presentation of choices, complex cancellation and biased defaults.
The enforcement has begun. On 12 July 2024 the European Commission sent X preliminary findings of non-compliance on three grounds, covering dark patterns, advertising transparency and data access for researchers, citing Articles 25, 39 and 40(12) of the DSA.
Cookie banners are where this bites first
Most designers will never touch a very large online platform. Almost all of them will touch a consent banner, and that is territory governed by the GDPR and the ePrivacy Directive rather than by Article 25.
The European Data Protection Board's Cookie Banner Taskforce, formed after a wave of complaints from the campaign group NOYB, adopted a report on 17 January 2023 after thirteen meetings. Its conclusions are a list of design failures. A vast majority of authorities held that the absence of a refuse or reject option on any layer of the banner breaches the consent requirement. Pre-ticked opt-in boxes, the taskforce confirmed, do not lead to valid consent under either the GDPR or the ePrivacy Directive. Refusal must not be reduced to a link behind wording such as "refuse" buried in body text without visual emphasis. On colour and contrast the assessment is case by case, but the taskforce flagged banners where the contrast between the text and the button background is so minimal that the text is unreadable. Withdrawing consent must be as easy as giving it.
France's regulator has kept enforcing. On 3 September 2025 the CNIL fined Google 325 million euros and Shein 150 million euros in cookie cases. Its reasoning includes a sentence that is effectively a design brief: the alternatives offered to a user must therefore be presented in a balanced manner, without encouraging them to choose one option over another (for example, by making one choice more complex than the other).
California put symmetry in the regulations
California took a different route and wrote the design principle directly into rule text. Section 7004 of Title 11 of the California Code of Regulations governs the methods businesses use to obtain consumer consent, and it sets out five principles. The second is the one to memorise: The path for a consumer to exercise a more privacy-protective option shall not be longer or more difficult or time-consuming than the path to exercise a less privacy-protective option.
The regulation supplies worked examples. A choice offering only "Yes" and "Ask me later" lacks symmetry, because there is no way to say no. A banner pairing "Accept All" with "More Information" is asymmetric for the same reason. Double negatives are named as confusing. And the consequence is stated plainly: a user interface is a dark pattern if it has the effect of substantially subverting or impairing user autonomy, decisionmaking or choice, and any agreement obtained through the use of dark patterns shall not constitute consumer consent. The consent is void. The data collection that followed it was unlawful.
The California Privacy Protection Agency's Enforcement Division restated all of this in Enforcement Advisory No. 2024-02 on 4 September 2024, giving examples including opt-out flows that require more steps than opting back in.
A correction, because the popular version is wrong
A lot of designers I speak to believe the United States has a click-to-cancel law. It does not, and the story of how it briefly did is worth knowing.
The FTC announced a final Negative Option Rule, widely reported as the "click to cancel" rule, on 16 October 2024. It was challenged, and the United States Court of Appeals for the Eighth Circuit vacated it in Custom Communications, Inc. v. FTC, 142 F.4th 1060 (8th Cir. 2025). The grounds were procedural rather than substantive: the court found the Commission's failure to issue a preliminary regulatory analysis was, in its phrase, procedurally insufficient. On 12 February 2026 the FTC published a notice restoring the Negative Option Rule to the form it had before the 2024 rule took effect, the older Prenotification Negative Option Plans rule at 16 CFR Part 425.
The rule is gone. The enforcement is not. Amazon's 2.5 billion dollar settlement in September 2025 was brought under the Restore Online Shoppers' Confidence Act and the FTC Act, both of which long predate the vacated rule. Epic Games paid 520 million dollars in December 2022, of which 245 million was refunds for what the FTC described as counterintuitive, inconsistent, and confusing button configuration that led players to incur unwanted charges based on the press of a single button. The agency's Bureau of Consumer Protection director, Samuel Levine, said at the time that Epic cost consumers millions in illegal charges through its use of dark patterns. None of that depended on a rule about cancellation flows.
The FTC's staff report "Bringing Dark Patterns to Light", published in September 2022, had already grouped the conduct into four tactics: misleading consumers and disguising ads; making it difficult to cancel subscriptions or charges; burying key terms and junk fees; and tricking consumers into sharing data. Levine's line in the accompanying press release was that these traps will not be tolerated.
Where the line sits, concretely
Pulling the instruments together, here is what I now treat as settled rather than arguable when I design a consent step, a checkout or a cancellation flow.
Two options presented for a decision must be reachable with the same effort. Same number of steps, same number of clicks, same prominence. This is explicit in California's section 7004, implicit in the CNIL's balance requirement, and named in DSA Article 25(3)(a).
If there is an accept, there must be a reject at the same level. Not one layer down, not behind a settings panel, not as a text link in a paragraph. That is the EDPB taskforce's first finding.
Cancelling must be no harder than subscribing. DSA Article 25(3)(c) names it. The FTC's Amazon order requires it. The vacated American rule would have codified it, and its absence changes nothing about the risk.
Nothing may be pre-selected in a consent context. The taskforce is unambiguous that pre-ticked boxes do not produce valid consent.
Asking again after someone has answered is a named practice in Article 25(3)(b). A banner that reappears on every page view because the visitor declined is not a technical limitation, it is a pattern with a name.
The decline label must describe the decline, not punish it. "No, I don't want Free Shipping" is the exact construction the FTC's order against Amazon forbids.
Contrast, size and colour between paired options are now evidentiary. The EDPB looks at them. So does California. A grey ghost button next to a filled primary is a measurable asymmetry, and someone will measure it.
There is a thing I cannot tell you, and I want to be honest about it rather than pretend to a certainty I do not have. I do not know where the boundary falls between legitimate emphasis and unlawful steering. Every interface has a hierarchy; a design with no hierarchy at all is not neutral, it is just bad. The regulations use words like "materially distorts" and "substantially subverting", and those words will be given content case by case over years. What has changed is not that the boundary is now clear. It is that there is a boundary, that it is enforced, and that the person who drew the two buttons is the person whose work is being examined.
Sources
Harry Brignull, "Deceptive Patterns" (formerly darkpatterns.org), deceptive.design. Definition of deceptive patterns and the catalogue of eighteen named types. deceptive.design
"Dr Harry Brignull", Deceptive Patterns. Coinage of the term "dark patterns" in 2010 and founding of the site; Brignull's background in cognitive science and user experience. deceptive.design/about-us/dr-harry-brignull
Arunesh Mathur, Gunes Acar, Michael J. Friedman, Elena Lucherini, Jonathan Mayer, Marshini Chetty and Arvind Narayanan, "Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites", 2019, arXiv:1907.07032. Abstract, sample sizes, 1,818 instances, 15 types, 7 categories, 183 deceptive sites, 22 third-party vendors. arxiv.org/abs/1907.07032
Princeton Web Transparency and Accountability Project, "Dark Patterns at Scale" project page. The 1,254 of 11,000 sites figure (11.1%), the 234 deceptive instances, the per-category type counts, and the correlation with Alexa popularity. webtransparency.cs.princeton.edu/dark-patterns
Regulation (EU) 2022/2065 (Digital Services Act), Article 25 "Online interface design and organisation" and Article 93 "Entry into force and application". Adopted 19 October 2022; applicable from 17 February 2024. eu-digital-services-act.com/Digital_Services_Act_Article_25.html
European Commission, "Commission sends preliminary findings to X for breach of the Digital Services Act", 12 July 2024. Preliminary findings on dark patterns, advertising transparency and researcher data access under Articles 25, 39 and 40(12). digital-strategy.ec.europa.eu/en/news/commission-sends-preliminary-findings-x-breach-digital-services-act
European Data Protection Board, "Report of the work undertaken by the Cookie Banner Taskforce", adopted 17 January 2023. Findings on missing reject buttons, pre-ticked boxes, deceptive link design, button contrast and withdrawal of consent. edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf
CNIL, "Cookie regulation: the CNIL is continuing the action plan initiated in 2019 and has imposed two fines on SHEIN and GOOGLE", 3 September 2025. Fines of 325 million euros (Google) and 150 million euros (Shein), and the balanced-presentation reasoning. cnil.fr/en/cookie-regulation-cnil-continuing-action-plan-initiated-2019-and-has-imposed-two-fines-shein-and
California Code of Regulations, Title 11, Section 7004, "Requirements for Methods for Submitting CCPA Requests and Obtaining Consumer Consent". The five principles including symmetry in choice, the illustrative examples, and the rule that agreement obtained through dark patterns is not consent. law.cornell.edu/regulations/california/11-CCR-7004
California Privacy Protection Agency, Enforcement Division, Enforcement Advisory No. 2024-02, 4 September 2024. Restatement of the symmetry requirement and examples of non-compliant opt-out flows. cppa.ca.gov/pdf/enfadvisory202402.pdf
Federal Trade Commission, "Bringing Dark Patterns to Light", staff report, September 2022, and accompanying press release of 15 September 2022. The four tactic categories and Samuel Levine's statement. ftc.gov/reports/bringing-dark-patterns-light
Federal Trade Commission, "FTC Secures Historic $2.5 Billion Settlement Against Amazon", 25 September 2025. The 1 billion dollar penalty and 1.5 billion dollars in refunds, the allegations, and the injunctive terms including the decline-button labelling requirement. ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-25-billion-settlement-against-amazon
Federal Trade Commission, "Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations", 19 December 2022. The 520 million dollar total, the 245 million dollars in refunds, and the button configuration allegations. ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations
Federal Trade Commission, "Revision of the Negative Option Rule, Withdrawal of the CARS Rule, Removal of the Non-Compete Rule To Conform These Rules to Federal Court Decisions", 91 Fed. Reg., 12 February 2026. Vacatur of the 2024 rule in Custom Communications, Inc. v. FTC, 142 F.4th 1060 (8th Cir. 2025) and restoration of 16 CFR Part 425.
Related reading
Latest Articles.
© Moc Mallen Studio
Thoughts, ideas, and perspectives on design, simplicity, and creative process.
