An interface that steers people into sharing more data, buying more or staying subscribed longer than they meant to is no longer just poor design: in the EU, UK and US it is a legal liability with record penalties attached. Regulators now judge the screens themselves, from the sign up form and consent prompt to the settings page and the cancel button. This guide covers the main rule sets that apply to deceptive design (GDPR as read by the EDPB, the EU Digital Services Act, the FTC Act and ROSCA, and the California CCPA regulations), where enforcement stands, and a practical review method for product, design, privacy and security teams. Cookie banners are covered in depth in the Cookie and Tracking Technology Compliance Guide; this page covers the rest of the user journey. Last reviewed: November 2026.
Key takeaways
- Effect matters more than intent. The California regulations say an interface is a dark pattern if it has the effect of substantially subverting or impairing user autonomy, whatever the designer meant.
- Consent obtained by a dark pattern is not consent. Under the CCPA regulations it does not count, and under GDPR consent that is not freely given, specific and informed fails Articles 4(11) and 7.
- Cancellation is the most enforced journey. The FTC's settlement with Amazon over Prime sign up and cancellation (September 2025) carried a $1 billion civil penalty and $1.5 billion in refunds.
- Symmetry is the simplest test. The privacy-protective or exit path should never be longer, harder or less visible than the data-hungry or stay path.
- Evidence beats opinion. Keep design rationale, A/B test results and screenshots per release; regulators have used internal testing records to show that friction was deliberate.
Scope: who and what is covered
Deceptive design is not governed by one law. Several overlapping regimes apply, and which one bites depends on whether the practice affects personal data, a purchase or a platform user's choices.
| Regime | Who it applies to | What design it reaches |
|---|---|---|
| GDPR (EU) and UK GDPR, read with EDPB Guidelines 03/2022 | Any controller processing personal data of people in the EU or UK | Consent requests, privacy notices, privacy settings, rights requests and account deletion |
| EU Digital Services Act (Regulation (EU) 2022/2065), Article 25 | Providers of online platforms | Interfaces that deceive, manipulate or materially distort free and informed decisions, where the practice is not already covered by the Unfair Commercial Practices Directive or GDPR |
| EU Unfair Commercial Practices Directive 2005/29/EC | Traders dealing with consumers | Misleading and aggressive commercial practices, including in online interfaces |
| US FTC Act Section 5 (15 U.S.C. 45) and ROSCA (15 U.S.C. 8401 to 8405) | Most businesses selling to US consumers | Deceptive or unfair practices; online negative option (subscription) sales, which need clear disclosure, express informed consent and a simple way to stop charges |
| California CCPA regulations, section 7004 | Businesses in scope of the CCPA | Methods for submitting privacy requests and for obtaining consent |
| COPPA (US) | Online services directed to children under 13 or with actual knowledge | Parental consent flows and in-app purchasing by children |
The EDPB guidelines were written for social media platforms, but their categories and their reading of GDPR apply to any interface that handles personal data. The guidelines walk through the whole account life cycle: opening an account, staying informed, staying protected (consent and settings), exercising rights, and leaving.
The pattern vocabulary regulators use
Two taxonomies are worth adopting internally, because regulators quote them and because they give reviewers shared names.
| EDPB category (Guidelines 03/2022) | Named patterns | Closest FTC category (2022 staff report) |
|---|---|---|
| Overloading | Continuous prompting, Privacy Maze, Too Many Options | Obscure or subvert privacy choices |
| Skipping | Deceptive Snugness (most invasive option preselected), Look over there | Obscure or subvert privacy choices |
| Stirring | Emotional Steering, Hidden in plain sight | Induce false beliefs |
| Obstructing | Dead end, Longer than necessary, Misleading action | Lead to unauthorised charges (hard cancellation) |
| Fickle | Lacking hierarchy, Decontextualising, Inconsistent interface, Language discontinuity | Hide or delay material information |
| Left in the dark | Conflicting information, Ambiguous wording or information | Hide or delay material information (drip pricing, fine print) |
The FTC report, "Bringing Dark Patterns to Light" (September 2022), groups practices into four categories: design that induces false beliefs (disguised ads, fake countdown timers, false scarcity), design that hides or delays material information (drip pricing, buried fees), design that leads to unauthorised charges (free trials that convert, children's in-app purchases, hard cancellation), and design that obscures or subverts privacy choices.
Key obligations
GDPR and the EDPB reading
- Fairness and transparency, Article 5(1)(a): the EDPB treats fairness as the starting point for assessing any design pattern. A pattern that misleads people about processing is unfair even if every required word appears somewhere.
- Consent, Articles 4(11), 6(1)(a) and 7: consent must be a clear affirmative act, requests must be clearly distinguishable from other matters (Article 7(2)), and withdrawing must be as easy as giving it (Article 7(3)). Preselected boxes, bundled consent and repeated prompts after a refusal undermine all three.
- Information, Articles 12 to 14: information must be concise, transparent, intelligible and easily accessible, and given at the right time. Scattered, decontextualised or language-switching notices are the "Fickle" and "Left in the dark" patterns.
- Rights, Articles 12(2), 15, 17 and 20: controllers must facilitate the exercise of rights. Dead-end links, extra verification steps not required for sign in, and deletion journeys hidden behind retention offers obstruct them.
- Data protection by design and by default, Article 25: the default setting must be the privacy-protective one. Deceptive Snugness is a direct breach of Article 25(2).
- Accountability, Article 5(2): you must be able to demonstrate that the interface is fair, which in practice means design records and test evidence.
Digital Services Act Article 25
Online platforms must not design, organise or operate their interfaces in a way that deceives or manipulates users, or otherwise materially distorts or impairs their ability to make free and informed decisions. Recital 67 gives the policy reason and names making cancellation significantly more cumbersome than sign up as an example. Article 25(3) lets the Commission issue guidance on three practices in particular: giving more prominence to certain choices, repeatedly asking a user to make a choice already made (especially through pop-ups), and making termination more difficult than subscribing. The ban does not apply where the Unfair Commercial Practices Directive or GDPR already covers the practice, so for consent and data choices GDPR remains the main route.
FTC Act and ROSCA
- Deception and unfairness: Section 5 reaches interfaces that create false beliefs or cause substantial injury consumers cannot reasonably avoid, such as unauthorised charges.
- Subscriptions under ROSCA: before charging, disclose all material terms, obtain express informed consent, and provide a simple mechanism to stop recurring charges. Most large dark pattern cases rest on ROSCA.
- Children: COPPA requires verifiable parental consent; the Epic Games case combined a COPPA penalty with refunds for billing design.
California CCPA regulations, section 7004
Methods for submitting requests and obtaining consent must follow five principles: language that is easy to read and understand; symmetry in choice (the more privacy-protective path must not be longer or more difficult); no confusing language or interactive elements (silence or failure to act is not consent); no choice architecture that impairs or interferes with the consumer's choice; and methods that are easy to execute, without unnecessary burden or friction. A method that fails these principles may be a dark pattern, any agreement obtained through a dark pattern is not consent (section 7004(b)), and the test is the effect of the interface, not intent (section 7004(c)). See the CCPA and CPRA guide for the wider regime.
Timeline and current status
| Date | Event | Status as checked November 2026 |
|---|---|---|
| September 2022 | FTC staff report "Bringing Dark Patterns to Light" | Staff report, guidance rather than a rule |
| 27 October 2022 | Digital Services Act published in the Official Journal | In force; Article 25 applies to online platforms |
| 19 December 2022 | FTC announces Epic Games orders: $275 million COPPA penalty and $245 million refunds over billing design | Concluded |
| 24 February 2023 | EDPB adopts final version 2.0 of Guidelines 03/2022 | Current |
| 3 October 2024 | European Commission publishes the Digital Fairness Fitness Check, naming dark patterns among the most harmful practices | Led to the Digital Fairness Act initiative, under preparation; no proposal date given by the Commission |
| 16 October 2024 | FTC announces final "Click-to-Cancel" amendments to the Negative Option Rule (16 CFR Part 425, published 15 November 2024) | Revised by a 12 February 2026 Federal Register notice to conform to federal court decisions; ROSCA itself still applies |
| 4 April 2025 | UK CMA publishes guidance on unfair commercial practices (CMA207), updated 18 November 2025 | Current |
| 25 September 2025 | FTC settlement with Amazon over Prime enrolment and cancellation: $1 billion civil penalty, $1.5 billion refunds for about 35 million consumers | Settled |
| 1 January 2026 | Current consolidated CCPA regulations take effect, including section 7004 | In effect |
| 13 March 2026 | FTC Advance Notice of Proposed Rulemaking on recurring charges and easier cancellation (docket FTC-2026-0265) | Open rulemaking; watch for a proposed rule |
Two items are moving: the EU Digital Fairness Act and a new FTC cancellation rule. Neither changes today's obligations, but both point the same way, towards explicit rules on cancellation, defaults and repeated prompts.
Enforcement and penalties
- GDPR: infringements of the basic principles, including conditions for consent, carry fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83(5)). Supervisory authorities can also order processing to stop, which for consent obtained through a dark pattern can mean deleting the data collected. See GDPR Fines and Enforcement Statistics.
- Digital Services Act: national Digital Services Coordinators enforce against platforms under penalty rules set by each Member State, and the Commission supervises very large online platforms and search engines, which it can fine up to 6% of worldwide annual turnover. See the Digital Services Act Security Obligations Guide.
- FTC: civil penalties where a rule is violated (as with ROSCA in the Amazon case), consumer redress, and conduct orders that dictate interface changes. The Amazon order bans decline buttons worded to shame, such as "No, I don't want Free Shipping".
- Earlier FTC cases in the 2022 report: Age of Learning (ABCmouse) settled for $10 million after a cancellation path of six to nine screens; children's in-app purchase cases against Amazon, Apple and Google led to refunds of more than $70 million, at least $32.5 million and $19 million.
- UK: since the consumer protection provisions of the Digital Markets, Competition and Consumers Act 2024 came into force in April 2025, the CMA can decide itself that consumer law has been broken and fine a company up to 10% of its global turnover; its CMA207 guidance sets out the unfair commercial practices the Act prohibits, including drip pricing and fake reviews.
- California: the CPPA and the Attorney General enforce the CCPA; consent obtained through a dark pattern is treated as no consent, so every downstream use of that data is exposed.
The common thread in large cases is evidence that the business knew. In Epic Games, the FTC alleged internal testing showed cancel and refund features had been made harder to find, and that more than one million complaints had been ignored. Design experimentation records are discoverable.
What it means for AI agents and non-human identities
- Conversational interfaces are interfaces: a chatbot or AI assistant that pushes upgrades, repeats a request after a refusal or makes cancellation conversational and endless is a Continuous prompting or Longer than necessary pattern in a new medium. Review scripted flows and model instructions with the same symmetry test.
- Agents acting for users meet dark patterns too: browser and shopping agents that sign up or check out on a user's behalf can be steered by preselected add-ons, drip pricing and disguised ads. Agents should treat preselected options as unconsented and surface total price before commitment. See the Browser and Computer-Use Agent Guide and Agentic Commerce for Merchants.
- Merchants must not design against agents: making cancellation possible only through flows that block automation while sign up is automatable recreates asymmetry. Treat a properly authorised agent's cancellation request as the user's request.
- Consent and delegation records: where an agent's service account or token grants consent or accepts terms, log which human delegated that authority, the scope and the version of the terms shown. The Identity Data Privacy and Consent Guide covers consent records in identity systems.
- Personalised persuasion: using profile data or model inference to time prompts at moments of weakness raises fairness questions under GDPR Article 5(1)(a) and the Digital Fairness Act scope (addictive design, unfair personalisation).
Compliance steps
- Inventory the journeys. List every flow that collects consent, sells a subscription, changes a privacy setting, handles a rights request or closes an account, across web, mobile, email and chat. Include third-party consent tools and checkout widgets.
- Capture evidence per journey. Screenshot or record each step on each platform and language, count clicks and screens for the enter path and the exit path, and store the capture with the release version.
- Score against the taxonomies. Walk each journey against the EDPB six categories and the FTC four categories. Record which named pattern, if any, applies, and the legal provision it engages.
- Apply the symmetry test. Compare accept versus reject, subscribe versus cancel, share versus do not share: number of steps, visual prominence, wording and placement. Fix any asymmetry against the protective option.
- Fix defaults. Set privacy-protective defaults for non-essential processing (GDPR Article 25(2)), remove preselected boxes and bundled consent, and stop re-prompting after a refusal for a defined period.
- Govern experiments. Require privacy or legal sign-off for A/B tests on consent, pricing disclosure and cancellation flows, and never optimise those flows on conversion alone. Keep the test hypothesis and results.
- Test with users and accessibility checks. Low-contrast "reject" text is Hidden in plain sight; run contrast and screen reader checks on choice screens.
- Monitor and roll back. Track metrics after each release and revert any change that sharply shifts consent rates or cancellation completion without a lawful explanation.
Measuring it
| Metric | What it tells you |
|---|---|
| Steps to cancel versus steps to subscribe, per channel | Direct measure of cancellation symmetry (DSA Recital 67, ROSCA simple mechanism) |
| Accept rate versus reject rate on each consent screen, before and after design changes | Very high acceptance after a redesign is a red flag for steering |
| Cancellation start to completion rate | Drop-off inside the cancel flow suggests obstruction or retention offers that block exit |
| Rights requests abandoned before submission | Obstruction of Articles 12(2) and 15 to 20 |
| Complaints and chargebacks mentioning unexpected charges or inability to cancel | The signal the FTC said Epic ignored |
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | PT-4 Consent; PT-5 Privacy Notice; PT-3 Personally Identifiable Information Processing Purposes | Consent mechanisms and notices that are fair and understandable |
| NIST SP 800-53 Rev. 5 | SA-8 Security and Privacy Engineering Principles; SA-8(33) Minimization | Privacy engineering in design, including collecting only what is needed |
| NIST CSF 2.0 | GV.OC-03 legal, regulatory and contractual requirements including privacy are understood and managed | Puts consumer protection and privacy design law into governance |
| GDPR | Articles 5(1)(a), 7, 12, 25 | Fairness, consent, transparency, data protection by design and by default |
Common failure patterns
- Cancel by phone or chat only, sign up online: the textbook asymmetry named in DSA Recital 67 and at the centre of the Amazon and ABCmouse cases.
- Confirmshaming decline buttons: wording that makes the protective choice sound foolish ("No, I don't want Free Shipping") is Emotional Steering and is now banned by order in the Amazon case.
- "Accept all" in colour, "Settings" as grey text: Hidden in plain sight, and the most common finding in cookie enforcement; it appears in account sign up and app permission prompts too.
- Re-asking until yes: repeating a consent or upsell prompt every session after a refusal is Continuous prompting and is named in DSA Article 25(3).
- Retention offers that never end: each "are you sure" screen adds steps; past one clearly declinable offer, it becomes Longer than necessary.
- Privacy settings split across menus: a Privacy Maze, worsened when web and mobile apps use different labels (Inconsistent interface).
Practitioner checklist
- Map every consent, subscription, settings, rights and account closure journey on every channel.
- Record step counts for entry and exit paths and fix any asymmetry against the protective option.
- Remove preselected consent boxes and bundled consent; set protective defaults under GDPR Article 25(2).
- Make withdrawing consent and cancelling available in the same channel and with no more steps than giving it.
- Ban confirmshaming copy and enforce equal visual weight for accept and reject controls.
- Require privacy or legal review for experiments on consent, pricing disclosure and cancellation flows; keep the records.
- Apply the same review to chatbot scripts, AI assistant instructions and agent-facing flows.
- Track the five metrics above per release and investigate sharp shifts.
- Show total price, including mandatory fees, before the first commitment step.
- Watch the FTC recurring charges rulemaking and the EU Digital Fairness Act and update the review criteria when they land.
Standards and references
- EDPB: Guidelines 03/2022 on deceptive design patterns in social media platform interfaces
- EUR-Lex: Regulation (EU) 2022/2065 (Digital Services Act)
- FTC: Bringing Dark Patterns to Light
- FTC: Negative Option Rule
- California Privacy Protection Agency: CCPA Regulations (section 7004)
- FTC: Settlement with Amazon over Prime enrolment and cancellation
- European Commission: Review of EU consumer law and the Digital Fairness Act
- CMA: Unfair commercial practices guidance (CMA207)
- GOV.UK: CMA statement as the new consumer protection regime comes into force (7 April 2025)
Related NHI Mgmt Group resources: Cookie and Tracking Technology Compliance Guide · Consent Management Guide: Cookies, CMPs and GPC · Privacy by Design Guide for Engineering Teams · Data Minimisation. This guide summarises the GDPR, Digital Services Act, FTC Act, ROSCA and CCPA rules on deceptive design and is not legal advice.