A dark pattern is an interface design choice that steers a person into a decision they did not intend to make: an unwanted subscription, an accepted tracking cookie, an extra item in a basket. The manipulation sits in the structure of the screen rather than the truth of any statement on it. Prices can be accurate and disclosures present while the flow is still built so the outcome favouring the operator is the one most people reach. That structural quality separates the concept from false advertising, and explains why regulators reached for new vocabulary rather than reusing the old.

How the mechanism works

Three levers do most of the work. Information: material terms are hidden, buried in a second screen, or placed below the button that completes the action. Weighting: two options exist, but one is rendered in high-contrast colour at full size while the other appears as grey text. Effort: signing up costs one click, leaving costs fifteen.

The most widely used classification comes from a 2019 paper by researchers at Princeton University and the University of Chicago, which grouped instances into seven categories: sneaking, urgency, misdirection, social proof, scarcity, obstruction and forced action. Within those sat fifteen types, among them hidden costs, countdown timers, low-stock messages, confirmshaming and hard-to-cancel flows.

In a consent banner, an Accept all button completes the flow in one action while rejection requires opening a preferences layer and switching off vendors individually. Consent unlocks the advertising identifiers and measurement tags underneath, so the asymmetry carries revenue consequences, and the consent management platform rendering the banner is where the decision is implemented.

In a subscription, obstruction concentrates at the exit. The United States Federal Trade Commission alleged that Amazon's Prime cancellation route ran across four pages, six clicks and fifteen options, with retention offers at each step; internal documents named it after Homer's epic. Amazon settled in September 2025 for 2.5 billion dollars, a 1 billion dollar civil penalty plus 1.5 billion in consumer refunds.

Operation is rarely in-house only. The 2019 crawl of roughly 53,000 product pages across about 11,000 shopping sites found 1,818 instances on 1,254 sites, and identified 22 third-party suppliers selling the techniques as a packaged service, which turns a design choice into an industry input.

Origin and evolution

Harry Brignull, a British user experience researcher, registered darkpatterns.org on 28 July 2010 and published a library of twelve named techniques. The construction inverted design pattern, the standard term for a reusable interface solution.

Academic work followed slowly, then all at once. The Princeton paper appeared in November 2019. In April 2022 the European Commission published a behavioural study reporting that 97% of the most popular websites and apps used by EU consumers deployed at least one, the five most common being hidden information and false hierarchy, preselection, nagging, difficult cancellations and forced registration. Its experiments found exposure pushed the rate of choices inconsistent with a participant's stated preference to 47% for average consumers and 51% for vulnerable ones.

The Federal Trade Commission held a workshop in April 2021 and published a staff report, Bringing Dark Patterns to Light, on 15 September 2022, naming four recurring practices: disguising advertisements, obstructing cancellation, burying terms and fees, and extracting data through consent interfaces.

Brignull later moved away from his own coinage. His 2023 book used deceptive patterns and the original site became deceptive.design, on the argument that dark carried unintended connotations. Both terms remain in circulation, and regulators have standardised on neither.

Where the law bites

No single statute governs the practice. Europe regulates it through at least six instruments. The Unfair Commercial Practices Directive supplies the general standard. Article 25(1) of the Digital Services Act, Regulation (EU) 2022/2065, bars providers of online platforms from designing interfaces that deceive, manipulate or otherwise materially distort a user's ability to decide freely. The article never uses the phrase; Recital 67 supplies it, with examples covering repeated requests to reconsider a settled choice, cancellation made more cumbersome than sign-up, and defaults that are very difficult to change. Article 25(2) carves out anything already covered by the directive or the General Data Protection Regulation, leaving the provision residual. Article 25(3) allows guidelines on specific patterns; according to Osborne Clarke analysis published in July 2025, that power had not been used.

Remaining layers include Article 13 of the Digital Markets Act, on circumvention through interface design; Article 16e of the Consumer Rights Directive, applicable to distance financial services contracts from 19 June 2026; Article 5(1) of the AI Act; and the GDPR's requirement that consent be freely given. The European Data Protection Board has set out how the two regimes interact where both cover the same screen.

The United States has no equivalent federal statute, so enforcement runs on Section 5 of the FTC Act and the Restore Online Shoppers' Confidence Act. State privacy law supplies the only statutory definition in wide use: a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making or choice. California adopted it through the Privacy Rights Act, alongside the rule that agreement obtained this way is not consent; Colorado and Connecticut copy the wording. Texas sued Hisense on the same logic, contrasting one-click enrolment in automatic content recognition with a multi-step opt-out. A 2026 FTC order closing the Kochava location data case voided consent obtained through an interface that subverts autonomy.

Why it matters for the marketing community

The commercial stakes concentrate in two places. One is consent: in Europe the banner decides how much addressable inventory exists. France's CNIL issued formal notices over deceptive consent interfaces in December 2024, later fined the publisher of vanityfair.fr 750,000 euros, and imposed 325 million euros on Google over cookie placement and inbox ad formats. Privacy group noyb took BeReal to the same regulator over a prompt that remembered acceptance indefinitely while returning daily to anyone who declined. A German administrative court separated banning manipulative design from mandating a button layout; an Austrian court ruled a consent-or-pay wall unlawful.

The other is retention. Conversion rate optimisation and obstruction share a toolkit, and the difference is legal rather than technical. Australia's competition regulator named subscription traps and manipulative design an enforcement priority for 2026-27, then produced results: 15 million dollars against Emma Sleep for resetting countdown timers and phantom strikethrough prices, 10 million against JustAnswer over a 2 dollar joining fee that hid monthly charges, a finding against eHarmony on renewal pricing, and proceedings against Microsoft over a cheaper plan allegedly withheld from 2.7 million subscribers.

Limitations and disputes

The largest problem is definitional. Neither the DSA nor the UCPD defines the term operationally, leaving the boundary between legitimate persuasion and unlawful manipulation to case-by-case interpretation. Scarcity messaging is lawful when stock is genuinely low and unlawful when it is not, and the interface looks identical either way.

Prevalence estimates diverge sharply by method. The Princeton crawl found patterns on about 11% of the shopping sites it examined; the Commission's mystery shopping exercise reported 97%; a sweep of 642 traders by 27 authorities across 26 countries in early 2024 found 75.7% using at least one and 66.8% using two or more. The spread reflects sample selection rather than any change in behaviour.

Industry has contested both framing and instruments. Trade bodies including the Interactive Advertising Bureau challenged the FTC's click-to-cancel rule in court days after it was finalised on 16 October 2024. The Eighth Circuit vacated it entirely on 8 July 2025 in Custom Communications, Inc. v. FTC, six days before it took effect, on the procedural ground that the agency had skipped a required preliminary regulatory analysis. An IAB Europe coalition objected to the scope of the Digital Fairness Act consultation in July 2025, arguing existing law already covers the ground.

Enforcement lands unevenly. Australian penalties have run from tens of thousands of dollars to 15 million while one American settlement reached 2.5 billion, on broadly similar conduct.

Not the same as

Nudge describes choice architecture built to help the person choosing; sludge, its counterpart in the same literature, describes friction that obstructs them. A dark pattern is sludge or misdirection deployed against the user's interest, so the categories overlap without matching.

Addictive design targets time spent rather than a specific transaction. The Commission issued preliminary findings against Meta in July 2026 over infinite scroll, autoplay and push notifications, using the DSA's systemic risk provisions rather than Article 25.

Misleading claims concern the content of a representation. A false original price is a misleading claim; an accurate one positioned to make a discount look larger is a design question. Cases often plead both.

Conversion rate optimisation tests interface variants against an outcome metric. It crosses the line when the winning variant wins by obscuring information or imposing asymmetric effort.

Recent developments

The regulatory centre of gravity has shifted to Europe. The Digital Fairness Act, consulted on between 17 July and 24 October 2025, sits in the Commission work programme for the fourth quarter of 2026 and covers deceptive interface design, addictive design, influencer marketing and unfair personalisation. It remained unpublished as of August 2026.

In Washington the rulemaking restarted rather than ended. The FTC issued an advance notice of proposed rulemaking on negative option marketing on 11 March 2026, with comments due 13 April. It asks about cancellation times, retention offer performance and save-a-sale practices, and requests the economic data whose absence sank the previous attempt. Cases continue under existing authority meanwhile, including the January 2026 complaint against JustAnswer over recurring charges reaching 26 times the advertised entry price.

Timeline

  • 28 July 2010: Harry Brignull registers darkpatterns.org and publishes an initial taxonomy of twelve techniques
  • November 2019: Princeton and University of Chicago researchers publish a crawl of about 11,000 shopping sites, finding 1,818 instances and 22 third-party suppliers
  • 29 April 2021: FTC holds a public workshop on digital dark patterns
  • April 2022: European Commission behavioural study reports 97% prevalence across popular EU websites and apps
  • 15 September 2022: FTC publishes the staff report Bringing Dark Patterns to Light
  • 19 October 2022: Digital Services Act adopted, with Article 25 and Recital 67
  • 1 January 2023: California Privacy Rights Act takes effect with a statutory definition
  • 2023: Brignull publishes Deceptive Patterns and renames the original site deceptive.design
  • 29 January to 2 February 2024: ICPEN and GPEN sweep 642 traders, finding 75.7% prevalence
  • 17 February 2024: DSA obligations apply to all platforms
  • 4 September 2024: California Privacy Protection Agency issues an enforcement advisory on consent interfaces
  • 16 October 2024: FTC finalises the click-to-cancel rule
  • 12 December 2024: CNIL issues formal notices over cookie banner design
  • 19 March 2025: Hannover Administrative Court rules on cookie banner requirements
  • 8 July 2025: Eighth Circuit vacates the click-to-cancel rule in Custom Communications, Inc. v. FTC
  • 17 July to 24 October 2025: European Commission consults on the Digital Fairness Act
  • 25 September 2025: Amazon settles the Prime enrolment and cancellation case for 2.5 billion dollars
  • 19 February 2026: ACCC names dark patterns and subscription traps among its 2026-27 priorities
  • 11 March 2026: FTC issues an advance notice of proposed rulemaking on negative option marketing
  • 19 June 2026: Article 16e of the Consumer Rights Directive becomes applicable
  • Fourth quarter 2026: Digital Fairness Act proposal scheduled

Summary

Who: Harry Brignull coined the term in 2010. Enforcement now sits with the European Commission and national data protection and consumer authorities in Europe, the Federal Trade Commission and state attorneys general in the United States, and the Australian Competition and Consumer Commission. The practices are implemented by publishers, retailers, platforms, subscription businesses and the consent and optimisation vendors that supply them.

What: Interface design that deceives, manipulates or materially distorts a person's ability to choose freely, through hidden information, unequal weighting of options or asymmetric effort. Consent obtained this way is void under Californian privacy law and does not meet the GDPR standard.

When: Named in 2010, documented at scale from 2019, and written into binding law from 2022 through the Digital Services Act and the California Privacy Rights Act. Enforcement escalated across 2024 to 2026, with a 2.5 billion dollar American settlement in September 2025 and an EU legislative proposal scheduled for the fourth quarter of 2026.

Where: Everywhere a consent banner, checkout, sign-up form or cancellation flow is rendered. Jurisdictionally, the densest rules sit in the European Union, with California, Colorado and Connecticut supplying the American statutory definition and Australia enforcing through general consumer law.

Why: Interface structure influences outcomes independently of whether any statement on screen is false, so consumer protection law built around truthful representation left a gap. The regulatory response closes it by making design itself a compliance surface.