In December 2022, the Federal Trade Commission charged Epic Games, maker of Fortnite, one of the most-played video games on the planet. The charge: using “dark patterns” to manipulate millions of players, including children, into making unintended purchases. The FTC’s complaint was specific. Fortnite’s interface was designed so that pressing a button while loading into a match, or while a controller vibration occurred, would trigger an instant purchase. The “V-Buck” currency the game used obscured the real cost of items. Cancellation paths were buried. Children had spent family money they didn’t mean to spend, and parents had no straightforward way to get it back. Epic settled for $245 million — at the time, the largest amount ever paid in an FTC action over dark patterns.
That case mattered because it named the practice out loud, at scale, with a financial consequence attached. Epic did not accidentally design a confusing interface. The confusion was the design. The patterns that extracted $245 million in unintended charges were deliberate choices, made by teams of designers and product managers who knew exactly what they were doing.
This is what dark patterns are: interface decisions made with the intent to manipulate rather than inform. Understanding them is not a technical exercise. It requires recognising a set of recurring tricks and knowing what to do when you see them.
The short answer: Dark patterns are interface designs built to manipulate you rather than inform you. Common ones include confirmshaming (guilt-tripping decline buttons), roach motels (easy to join, hard to cancel), manipulative cookie banners, trick questions, and fake close buttons. They are now regulated: GDPR, the EU’s Digital Services Act, the FTC Act, and California’s CPRA all address them. Your defence is to recognise the pattern and act anyway: if declining is harder than accepting, decline anyway. Tools like uBlock Origin and Consent-o-Matic automate cookie rejection.
Where does the term “dark pattern” come from?
UX researcher Harry Brignull coined the term “dark pattern” in 2010. He had been cataloguing interface designs that appeared engineered to work against users. Not through bugs or honest mistakes, but through deliberate choices that served the company at the user’s expense. He started a site, darkpatterns.org, documenting specific examples with screenshots and named categories. What he was describing was not new, but naming it gave critics and eventually regulators a shared vocabulary.
That vocabulary entered law in the European Union. GDPR Article 7, read alongside Recital 32, requires that consent be freely given, specific, informed, and unambiguous — and that withdrawing consent must be as easy as giving it. Any interface designed to make refusal harder than acceptance fails that test by definition. The EU’s Digital Services Act (DSA) took effect for large platforms in August 2023, and it goes further. Article 25 of the DSA explicitly prohibits platforms from using dark patterns to manipulate users’ choices, or interface design to subvert users’ intentions.
In the United States, the FTC has pursued dark patterns cases under Section 5 of the FTC Act, which bans unfair or deceptive acts in commerce. The Epic action was one. California’s CPRA, which amended the CCPA from 2023, specifically prohibits using dark patterns to obtain consent. It defines them as “user interfaces designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.” The legal definition tracks Brignull’s original framing closely. The term that started as a UX researcher’s classification project is now embedded in federal enforcement actions and state privacy law.
Confirmshaming
The name comes from “shaming the user for confirming refusal.” It appears most often in email opt-in prompts, subscription popups, and GDPR-era consent banners. A popup asks if you’d like to receive marketing emails. The opt-in button reads “Yes, save me money.” The opt-out button reads “No thanks, I don’t want to save money.”
The asymmetry is deliberate. It is designed to make the user feel foolish, vain, or self-defeating for declining. Other common formulations include “No thanks, I prefer to pay full price,” “No, I don’t care about my health,” and “No, I’d rather stay uninformed.” The factual claim embedded in the refusal button is almost always false or manipulative. There is no savings guarantee on the other side of that email list. But the framing exploits social discomfort at the moment of a decision.
Confirmshaming does not force you to consent. It pressures you through language that implies your refusal is irrational. You can recognise it instantly: if the decline button is phrased as a statement you’re making about yourself rather than a simple refusal, you’re looking at confirmshaming. Click it anyway.
Roach motels
The roach motel is defined by asymmetry between sign-up and exit. Getting in is designed to be fast and frictionless. Getting out is designed to require effort, time, and persistence.
Amazon Prime’s cancellation flow was the canonical example for years. In the European Union, Prime cancellation required navigating five or six screens. Each one offered to pause the subscription, reduce the price, transfer it to a family member, or otherwise avoid the cancellation you had explicitly requested. Each screen was a soft checkpoint, formatted to look like the process was complete, while actually presenting another offer to stay. In the US, Amazon Prime’s cancellation flow was the subject of an FTC lawsuit filed in June 2023. It alleged that the company enrolled people without clear consent, then made cancellation so difficult that members gave up. After regulatory pressure across the EU and the FTC action, Amazon simplified the flow. But the practice ran for years and cost subscribers money they didn’t intend to spend.
Gym memberships, streaming services, news subscriptions, and software trials all rely on roach motels. The sign-up process takes 90 seconds. The cancellation requires a phone call during business hours to a retention team trained to talk you out of leaving. Some services bury cancellation behind in-app flows that are inaccessible on desktop, or web flows that are inaccessible on mobile. Checking whether a service has a straightforward cancellation path before you subscribe is a reasonable precaution.
Cookie banner manipulation
The cookie consent banner is where dark patterns meet data collection at the largest possible scale. Billions of people encounter these banners every day. The design of most of them is not neutral.
The typical manipulative implementation: a large, colored “Accept All” button presented at eye level. A small, grey “Manage Preferences” link in fine text below it. Click “Manage Preferences” and you find yourself inside a panel with dozens of categories and potentially hundreds of individual toggles for third-party vendors, all pre-enabled. The “Save” button is at the bottom of a scrollable list. There is no “Reject All” button on the main banner.
This design is illegal in the EU. France’s CNIL ruled in January 2022 that Google and Facebook were violating GDPR by making consent to cookies significantly easier than refusing them. Google was fined €150 million. Meta received €60 million. The specific violation was the absence of a “Reject All” option at the first layer of the banner. GDPR requires that consent to tracking and refusal of tracking be presented with equal prominence and equal ease.
Meta’s data practices faced further scrutiny in January 2023. The Irish Data Protection Commission fined Meta €390 million over how it obtained consent for targeted advertising on Facebook and Instagram. Meta had been relying on “contract necessity” as a legal basis for processing personal data for ads. In effect, it argued that serving you personalised ads was necessary to provide the service you signed up for. The DPC, backed by the European Data Protection Board, rejected that argument. It is not necessary for Meta to show you targeted ads. It is profitable for Meta. The legal basis for personalised advertising in the EU is now explicitly consent, not contract — meaning Meta needs your affirmative, freely given agreement. The fine reflected years of design choices made to avoid asking for that agreement cleanly.
Trick questions and double negatives
The double-negative checkbox is simple and old. A pre-ticked box reads: “Uncheck here if you do not wish to not receive marketing emails from our partners.” Now parse that. Figuring out whether leaving it ticked means opted in or opted out takes more focus than anyone applying for a loyalty card in a supermarket queue has available.
Pre-ticked checkboxes are explicitly banned under GDPR — they have been since the regulation came into force in 2018. They remain common outside the EU and in jurisdictions with weaker rules. The intent is to produce consent through inattention. The user has to actively opt out. When the opt-out also requires understanding a double negative under time pressure, a significant proportion of users will not successfully opt out.
Trick questions appear in slightly subtler forms in app setup flows. Take “Help us improve by sharing usage data,” with a toggle that defaults to on, presented mid-flow during account setup. It is not technically a dark pattern, but it operates like one. The placement — between steps the user is trying to complete — exploits the user’s desire to keep moving. Most people tap “Continue” without reading. That is the intended outcome.
Misdirection and fake close buttons
The X button on a popup is supposed to close it. In a misdirection dark pattern, the X closes the popup in some cases and triggers the popup’s primary action in others. A modal asking you to enable notifications may have an X in the corner that, on closer inspection, activates the notification request rather than dismissing it. The visual language of “X means close” is being used against its own meaning.
Disguised ads are a variant. Search results on major engines are labelled as ads, but the label is small, low-contrast, and positioned to blend with organic results. Studies by consumer organisations have found that a significant proportion of users cannot reliably distinguish sponsored results from organic ones, even when labels are present. The interface is designed to reduce the salience of the “Ad” label. On comparison shopping sites and app stores, sponsored listings are often indistinguishable from ranked results unless you already know to look for the label.
Social proof nudges for consent
“87% of users share their location with us to get better results.” This framing uses social proof: the Cialdini principle that people look to others’ behavior to decide what is correct. The effect is to make sharing feel normal and withholding feel deviant. The statistic may be true, meaningless, or fabricated. Its function in the interface is persuasion, not information. It is placed on the location permission request screen to lower the psychological cost of consenting.
Related to this: progress bar consent flows. An onboarding flow presents a progress bar showing you are “80% done setting up your account.” But the remaining 20% includes a permissions screen asking for access to your contacts, microphone, and location. The progress bar creates a completion pressure — you’re almost done; you don’t want to leave the setup unfinished. The permissions screen is designed to feel like a required step rather than an optional choice.
Forced account creation and privacy policy walls
Some services require you to create an account before using features that don’t require an account. The account creation flow asks for name, email, date of birth, and sometimes phone number. Each field is a data collection opportunity. The email becomes a contact point for marketing. The date of birth confirms you’re over a threshold age and enriches a demographic profile. The phone number enables cross-platform identity matching. None of this is necessary to provide the service. The account requirement is the dark pattern.
The privacy policy wall works differently. You’ve been using a service — sometimes one you’ve paid for. The company updates its terms and presents you with a modal: “We’ve updated our privacy policy. By continuing to use [service], you agree to the new terms.” The new terms expand the company’s rights to process and share your data. Your only option to refuse is to stop using the service. This is sometimes called “consent or leave.” Under GDPR, it fails the “freely given” requirement — consent obtained under threat of losing a paid service is coerced. Under US law, it’s generally enforceable. Reading the diff between the old and new terms when these notices appear is worth the time.
The data collection connection
Dark patterns are not merely annoying interface choices. They are mechanisms for collecting more data than users would consent to if the interface were honest. Every percentage point increase in cookie acceptance rates translates into a richer behavioral tracking profile on each user. Every additional field filled in during a forced account creation represents another data point in a commercial profile. Every user who fails to navigate an opt-out flow represents a longer retention of their data.
More data collected through manipulative means means more data exposed when that company suffers a breach. The Irish DPC’s Meta fine involved data used to build advertising profiles. That same data — behavioral histories, demographic information, cross-site tracking records — is exactly what appears in breach datasets. The size of a company’s data collection footprint directly determines the scale of harm when their systems are compromised. Reducing what they collect about you, by resisting dark patterns wherever possible, reduces your exposure.
What regulators are actually doing
Enforcement is accelerating. The FTC’s Epic Games action in December 2022 was followed in June 2023 by the FTC’s complaint against Amazon over Prime enrollment and cancellation practices. The FTC has also published guidance explicitly naming dark patterns as unfair or deceptive practices under Section 5 of the FTC Act. That signals more enforcement actions are coming.
In the EU, DSA Article 25 is the strongest instrument. It applies to “very large online platforms,” those with more than 45 million monthly active users in the EU. It prohibits using interface design to deceive users or distort their decision-making. The European Commission has investigative authority under the DSA and has already opened proceedings against several major platforms under its provisions.
California’s CPRA, effective January 2023, prohibits using dark patterns to obtain consent for the sale or sharing of personal data. It writes this prohibition directly into the definition of valid consent. The California Privacy Protection Agency (CPPA) is still in its early enforcement phases, but the statutory prohibition is in place.
The UK’s ICO published specific guidance on dark patterns in 2022, identifying them as inconsistent with GDPR-derived UK law, and has named them in enforcement contexts.
None of this enforcement moves quickly enough to protect you in real time. The practical defense is recognising the patterns yourself.
How to spot dark patterns and what to do
When you encounter a popup, consent banner, or permissions request, apply two tests before acting. First: is the refusal path as easy to find and use as the acceptance path? If the “Accept” button is large, colored, and prominent, and the “Decline” option requires three clicks through nested menus, you are looking at a manipulative design. Decline anyway — it just takes longer. Second: is the language on the refusal option a description of your choice, or a statement about your character? If declining feels like agreeing that you are foolish or self-defeating, that is confirmshaming. It does not mean accepting is the right decision.
For cookie banners specifically: install Consent-o-Matic, a browser extension built by researchers at Aarhus University that recognises common consent management platforms and automatically selects the most privacy-protective option. It is available for Firefox, Chrome, and Edge, and it handles the navigation of multi-level preference panels automatically. Firefox with uBlock Origin blocks many tracker requests before they load regardless of what you click on a consent banner. Brave Browser applies equivalent blocking by default without requiring extensions.
For account creation dark patterns: use a temporary or aliased email address for accounts you don’t fully trust. Services like SimpleLogin or Apple’s “Hide My Email” generate unique forwarding addresses. You can sign up, evaluate the service, and revoke the forwarding address if it is used for spam.
In the EU, you can file a complaint with your national data protection authority when you encounter a clear violation. Examples include a cookie banner with no “Reject All” button, a pre-ticked marketing consent checkbox, or a service requiring cookie acceptance as a condition of access. In France: cnil.fr/plainte. In Germany: the state-level DPA for your region (a list is maintained at bfdi.bund.de). In Ireland: dataprotection.ie. In the UK: ico.org.uk/make-a-complaint. Complaints from users are how most GDPR enforcement cases begin.
For US residents: the FTC accepts reports at reportfraud.ftc.gov. California residents can file complaints with the CPPA at cppa.ca.gov. These reports build the factual record regulators use when deciding where to direct enforcement attention.
What you can do right now
Practical steps that require no technical expertise:
Take five minutes and audit the apps on your phone for location permissions. Go to Settings > Privacy (iOS) or Settings > Location (Android) and revoke location access for any app that doesn’t need it to function. Navigation apps need location. A weather app you opened twice doesn’t.
On the same screen, check which apps have microphone and camera access. Revoke anything that does not have an obvious reason to listen or watch.
When you next see a cookie banner, do not click “Accept All.” Click “Manage Preferences” or the equivalent, turn everything off, and save. Use Consent-o-Matic to automate this going forward.
Before subscribing to any paid service, look up the cancellation process. If it requires a phone call or is not clearly described, treat that as a warning about how the company operates.
When an app’s setup flow asks for permissions mid-sequence, stop. Tap the “Don’t allow” or “Skip” option if one exists. If it does not exist and the permission is not required to use the app, decline and report the behavior to the relevant app store.
The more data you successfully withhold through these steps, the smaller your exposure when — not if — one of the companies holding your data suffers a breach. Companies that collect less data lose less when they are compromised. Reducing their take through informed resistance to dark patterns is a direct privacy protection measure.
The patterns described here are not hypothetical. They are live, in production, on sites and apps you use today. They were put there by people who knew what they were doing. Recognising them is the first step to not being manipulated by them.
See what a scan finds → walks through an example report of the kinds of data brokers expose. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.