untick
Start free

Dark patterns: what they are and what the law says

Short answer: Dark patterns, also called deceptive design, are interface choices that push people into decisions they didn’t mean to make: pre-ticked boxes, hidden reject buttons, invented countdowns and guilt-trip wording. In the EU they’re caught by consumer law, the GDPR’s consent rules and, on online platforms, the Digital Services Act; in the US by the FTC Act and state privacy laws such as California’s.

GuideLast reviewed Automated checks and general information, not legal advice.

The dark patterns regulators act on

These are the patterns untick checks, grouped the way they show up on a website. Each links to what it means, the rules behind it and how to fix it.

Consent & tracking

Trackers fire before consentAnalytics or advertising scripts load, or set cookies, the moment a visitor lands — before they have said yes.Tracking continues after “Reject”After we clicked the banner’s reject option, advertising or analytics requests kept firing.Tracking continues after consent is withdrawnWe accepted cookies, then changed our mind through the site’s own cookie settings. Advertising or analytics requests kept firing after the withdrawal.No easy way to change your mindAfter we accepted cookies, we found no link, button or icon on the page to change or withdraw that choice.Tracking cookies last longer than 13 monthsAfter consent, tracking cookies were set to last more than 13 months, often two years, so they keep identifying the visitor long after the choice was made.Ads tracking ignores Global Privacy ControlWe visited with Global Privacy Control switched on, the browser signal that says “don’t sell or share my data”. Advertising trackers still loaded.Trackers without any consent bannerThe site loads trackers or sets non-essential cookies but shows no consent prompt at all.No “Reject” on the first layerThe banner offers “Accept” but refusing takes extra clicks through settings — or is not possible at all.Consent or pay — no free way to say noThe only free option is to accept tracking. Visitors who say no have to pay or subscribe. This may not meet EU regulator guidance.“Reject” is harder to see than “Accept”Both choices exist, but reject is styled as a faint link or a much smaller button while accept is bold and colored.Banner comes back after “Reject”After we clicked “Reject” and reloaded the page, the cookie banner asked again. People who say no are asked over and over.Consent categories are pre-tickedMarketing, analytics or “legitimate interest” toggles in the consent settings are switched on by default.

Forms & opt-ins

Pre-ticked marketing opt-inA form checkbox for newsletters, offers or partner marketing is already ticked when the page loads.Agreement checkbox ticked for the userA checkbox that records agreement (terms, auto-renewal, data sharing) is ticked before the user touches it.

Pressure tactics

Countdown restarts for every new visitorWe loaded the page twice as two different first-time visitors. The countdown started again, so the deadline it shows isn’t real.Countdown timer pressureA ticking countdown pushes visitors to decide fast. We flag it so you can confirm the deadline is real.Scarcity & social-proof claimsMessages like “only 3 left” or “12 people are looking at this” appear on the page.Confirmshaming (guilt-trip opt-out wording)The option to decline is phrased to make people feel foolish (“No thanks, I don’t like saving money”).

Transparency

No privacy policy linkWe couldn’t find a link to a privacy policy on the page.

Shopping & contracts

No EU withdrawal buttonThe shop sells online to EU customers, but we found no “withdraw from contract here” button on its public pages.

How common are they?

When EU consumer authorities screened 399 online shops in 2023, 148 used at least one manipulative practice: 42 used fake countdown timers, 54 pushed people toward choices through design or wording, and 70 hid important information, including 23 that hid subscription terms.

Cookie banners are the most tested pattern of all, because a regulator only needs a browser to prove a problem. France’s CNIL alone has issued€530.9M in fines over cookies and consent since late 2024, from €325 million for Google down to small fines through its simplified procedure.See the fines tracker.

What the law says

European Union

  • Unfair Commercial Practices Directive. Bans misleading and aggressive practices, and blacklists some outright, including falsely claiming a product is available only for a very limited time (Annex I, point 7).
  • GDPR and the ePrivacy Directive. Consent must be freely given, specific, informed and an active choice, and cookies need it first. The EU Court of Justice ruled in Planet49 that pre-ticked boxes aren’t consent, and the EDPB has published guidelines on deceptive design patterns.
  • Digital Services Act, Article 25. Online platforms may not design their interfaces to deceive or manipulate users. It doesn’t apply to practices the Unfair Commercial Practices Directive or the GDPR already cover (Article 25(2)), so for most shop and cookie-banner dark patterns those laws are the ones that count.
  • Consumer Rights Directive. Pre-ticked boxes can’t charge for extras, and since 19 June 2026 online shops need a withdrawal button.
  • Digital Fairness Act. A proposal is expected in the fourth quarter of 2026, set to target dark patterns, addictive design and hard-to-cancel subscriptions.

United States

  • FTC Act, Section 5. Deceptive or unfair practices are unlawful; the FTC’s 2022 staff report “Bringing Dark Patterns to Light” lists the patterns it looks for.
  • Subscriptions. In September 2025 the FTC secured a $2.5 billion settlement with Amazon over Prime sign-ups and cancellations.
  • California. The CCPA regulations require symmetry in choice, and say consent obtained through dark patterns doesn’t count.

How to find them on your own site

Walk through your site as a first-time visitor in a private window: answer the cookie banner both ways, open every pop-up, go through signup and checkout, and read every checkbox and decline button before you click. Our step-by-step guide covers the cookie banner in ten minutes. Or let a scan do it:

Google Consent Mode v2 checkerSee what your Google tags report before a choice, after “Reject” and after “Accept”.“Reject all” testWe click your banner’s reject button and record every tracker that still fires.EU withdrawal button checkerCheck your shop for the “withdraw from contract here” button EU law requires.

Questions people ask

Are dark patterns illegal?

Many are. The EU bans several outright, such as false “limited time” claims, and treats others as misleading or aggressive practices. Consent obtained through a dark pattern isn’t valid under the GDPR or California’s privacy rules, and the FTC pursues them as deceptive practices in the US.

What’s the difference between a dark pattern and good marketing?

Good marketing helps people choose; a dark pattern chooses for them or misleads them. A real deadline, real stock levels and equal “Accept” and “Reject” buttons are fine. An invented deadline, a pre-ticked box or a hidden refusal are not.

What is the EU Digital Fairness Act?

A planned EU law on consumer protection online. The European Commission’s proposal is expected in the fourth quarter of 2026 and is set to cover dark patterns, addictive design, unfair personalisation and hard-to-cancel subscriptions. Until it’s adopted, existing consumer and data protection law applies.

Can a tool find every dark pattern?

No. Automated checks are good at what a browser can prove: trackers, pre-ticked boxes, unequal buttons, restarting timers and missing links. Whether a stock claim is true, or whether a flow is manipulative overall, still needs human judgement.

Sources

  1. European Commission: manipulative practices found in 148 of 399 online shops (Jan 2023)
  2. Unfair Commercial Practices Directive 2005/29/EC
  3. Digital Services Act, Regulation (EU) 2022/2065
  4. EDPB Guidelines 03/2022 on deceptive design patterns
  5. European Parliament Legislative Train: Digital Fairness Act
  6. FTC staff report: Bringing Dark Patterns to Light (2022)
  7. FTC: $2.5 billion settlement with Amazon (Sept 2025)
  8. California CCPA regulations § 7004

Which of these is your site doing?

Find out in about a minute. Free, no signup.

No signup · nothing installed · results in about a minute