How Dark Patterns Destroy Long-Term UX and Brand Integrity
Dark patterns stopped being a UX guideline violation once regulators started citing dollar figures. The FTC's own 2022 staff report documents Amazon making more than $70 million in refunds available after burying in-app purchase confirmations from parents, and ABCMouse allegedly requiring six to nine screens to cancel a subscription. Treat cancellation and consent flows with the same engineering rigor as checkout, because regulators increasingly do.
Dark patterns have a name, a taxonomy, and now regulators
UX researcher Harry Brignull coined "dark patterns" in 2010 on a site now called deceptive.design. His taxonomy gave the industry a shared vocabulary for tactics that had existed for decades in direct mail and telemarketing, then moved online and scaled.
The current deceptive.design taxonomy lists 18 categories, from Hard to Cancel and Hidden Subscription to Confirmshaming and Fake Urgency. Knowing the taxonomy matters for engineering teams because it turns "this feels sketchy" into a specific, named pattern you can test for and refuse to ship.
The pattern types worth building tests against
| Pattern (deceptive.design taxonomy) | What it looks like in code |
|---|---|
| Preselection | A checkbox or radio default set to the business-favorable option before the user acts |
| Hard to Cancel | Cancellation requires more steps, screens, or channels than signup did |
| Hidden Subscription | A one-time purchase flow silently enrolls the user in a recurring charge |
| Visual Interference | The reject/decline option uses lower contrast or smaller touch targets than the accept option |
| Nagging | A dismissed prompt reappears on a timer instead of respecting the user's choice |
What it costs when it goes wrong
Amazon: the in-app purchase confirmation that wasn't
The FTC's Bringing Dark Patterns to Light staff report details the FTC's case against Amazon over children's in-app purchases. Amazon added a password prompt for purchases of $20 or more, but the prompt never disclosed that authorizing one purchase also authorized unlimited purchases for the next 60 minutes.
The result: charges from $0.99 to $99.99 racked up by children tapping buttons, with no further account holder involvement required. Amazon was ultimately forced to make more than $70 million in refunds available to consumers.
ABCMouse: six to nine screens to leave
The same report describes the FTC's complaint against ABCMouse, a children's online learning platform that promised "Easy Cancellation." According to the complaint, the company required consumers to click through six to nine screens to cancel, none of which could be skipped, several of which redirected users into upsell offers instead of the cancellation flow.
The first screen in that path didn't mention the word "cancellation" anywhere, according to the FTC. That's not an edge case slipping through review — it's a flow deliberately built to fail silently for anyone trying to leave.
One study cited in the FTC's report found that more than twice as many consumers accepted a free-trial offer when the recurring-charge terms were buried in small gray font, compared to a control group shown the same terms clearly. The dark pattern didn't just annoy people — it measurably changed the decision.
Vizio and Sunkey: dark patterns aren't limited to checkout
The same FTC report describes a case against smart-TV maker Vizio, which shipped a default setting called "Smart Interactivity" that collected and shared detailed television viewing activity with third parties. The FTC alleged Vizio gave many consumers no notice of the setting at all, and where a notice did appear, it timed out after one minute with no direct link to the settings menu.
A separate case against lead generator Sunkey Publishing involved websites styled to look like official US military recruiting sites, collecting personal information under a false affiliation and reselling it as marketing leads. Neither case involves a checkout flow — both involve default settings and false context, which is why a dark-pattern audit has to extend past payment screens into onboarding, permissions prompts, and any page that implies an affiliation you don't have.
The FTC's own conclusion on default settings: businesses should avoid defaults that collect, use, or disclose consumer information in ways users wouldn't expect, and should present choices about sensitive information without ambiguity — not buried in a settings menu three taps deep.
The regulatory floor engineering teams now build to
ROSCA set the baseline in 2010
The Restore Online Shoppers' Confidence Act requires any seller using a negative-option feature to: disclose all material terms clearly and conspicuously before collecting billing information, obtain the consumer's express informed consent before charging, and provide a simple mechanism to stop recurring charges. Every dark pattern case the FTC has brought around subscriptions traces back to one of these three failing.
The Click to Cancel rule is in flux, the principle isn't
The FTC's amended Negative Option Rule, described in its 2024 business guidance, would have required cancellation to be exactly as easy as signup, in the same medium the customer used to enroll, with no forced phone calls or live-agent gatekeeping.
The Eighth Circuit vacated that rule on procedural grounds before its compliance deadline. The FTC has since reopened rulemaking with a new advance notice of proposed rulemaking, so the specific rule is unsettled. The underlying ROSCA requirements above are not — they're statute, not rule, and they still apply today.
California and the EU codified it independently
California's Privacy Protection Agency issued an enforcement advisory defining dark patterns as interfaces that "subvert or impair consumers' autonomy, decision making, or choice," stressing that intent is irrelevant — effect is what triggers enforcement. The advisory's "symmetry in choice" standard means an "Accept All" button can't outrank a "Reject All" button in size, color, or position.
The EU's Digital Services Act independently bans the same behavior. The European Commission's own summary states plainly that "deceptive design tactics, such as aggressive pop-ups or confusing and misleading consent buttons, are now prohibited" under the DSA.
Comparing the three frameworks
| Framework | Core requirement | Status / enforcement |
|---|---|---|
| ROSCA (US federal statute) | Clear disclosure, express consent, simple cancellation mechanism | In force since 2010; basis for FTC cases against Amazon, ABCMouse, Health Formulas |
| FTC Negative Option Rule | Cancellation as easy as signup, same channel, no forced live agent | 2024 rule vacated by Eighth Circuit; FTC reopened rulemaking in 2026 |
| CCPA / CPPA guidance | Symmetry in choice; effect-based test, intent irrelevant | Active enforcement advisory as of September 2024 |
| EU DSA Article 25 | Bans interfaces that deceive, manipulate, or materially distort user choice | In force; enforced by the European Commission and national regulators |
Where accessibility and dark patterns overlap
An obstruction-heavy cancellation flow doesn't just violate consumer protection law. It routinely fails accessibility standards, because the same design choices that frustrate an average user disproportionately block users with cognitive or memory disabilities.
WCAG 2.2 Success Criterion 3.3.8 requires that authentication not depend on a cognitive function test unless an alternative method is available — the same principle that should apply to a cancellation flow that demands the user solve a maze of screens to prove they really want to leave. The W3C's Making Content Usable for People with Cognitive and Learning Disabilities guidance goes further, describing exactly the kind of multi-step, easy-to-derail flow ABCMouse allegedly built as a barrier for this population.
- Run your cancellation flow through the same screen-reader and keyboard-navigation testing as checkout, not a lighter pass
- Count the steps: if cancellation takes more clicks or screens than signup, that's both a dark pattern and, for cognitively disabled users, an access barrier
- Never require a phone call or live chat to cancel if signup didn't require one — this fails ROSCA and disproportionately burdens users with communication-related disabilities
An engineering checklist for consent and cancellation flows
- Default every optional checkbox to unchecked; never preselect an opt-in a user didn't ask for
- Give accept and reject (or subscribe and cancel) buttons equal visual weight — same size, same contrast tier, same click depth
- Disclose price, recurrence, and cancellation terms before the payment form, not after, and keep that text at normal body-copy size
- Build cancellation in the same channel as signup: if a user could subscribe with two clicks online, they should be able to cancel with two clicks online
- Log cancellation funnel drop-off the same way you log checkout drop-off — a flow that leaks users at every screen is a signal, not a KPI to defend
- Route every dismissible prompt through a single suppression flag; don't let a declined prompt reappear on a timer
What we audit before we ship a checkout or subscription flow
We count screens. If cancellation takes more steps than signup, that's the finding, full stop, before anyone debates the copy on any individual screen.
The same audit checks for preselected checkboxes, mismatched button weight, and any prompt that reappears after a user dismissed it. All three showed up in FTC enforcement actions, and all three are cheap to fix before launch and expensive to litigate after.
FAQ
Is a dark pattern illegal, or just bad practice?
It depends on the jurisdiction and the specific pattern. In the US, ROSCA makes certain subscription dark patterns illegal today; California's CPPA and the EU's DSA independently prohibit manipulative interface design under their own statutes.
Is the FTC's Click to Cancel rule currently in effect?
No. The Eighth Circuit vacated the 2024 rule on procedural grounds, and the FTC reopened rulemaking with a new advance notice in 2026. The underlying ROSCA requirements — clear disclosure, informed consent, simple cancellation — remain in force regardless.
Does intent matter for a dark pattern finding?
Under California's CPPA guidance, no. The advisory states dark patterns are judged by effect on user autonomy, not by whether the business intended to deceive.
How many screens should a cancellation flow have?
No regulator sets an exact number, but the standard is parity with signup. If signing up took two screens, cancellation taking six or nine — the number alleged against ABCMouse — is the kind of gap that draws enforcement.
Are dark patterns and accessibility violations the same thing?
Not identical, but they overlap heavily. A multi-step, easy-to-derail cancellation flow is both a consumer protection issue and, per WCAG 2.2 and W3C cognitive accessibility guidance, a barrier for users with cognitive or memory disabilities.
What's the fastest way to check our own product for dark patterns?
Compare screen count and click depth between your signup and cancellation flows, and check every checkbox default. Those two checks catch the majority of patterns cited in FTC enforcement actions.
References
- FTC Staff Report: Bringing Dark Patterns to Light (September 2022)
- FTC: Bringing Dark Patterns to Light (report landing page)
- FTC Business Blog: Click to Cancel — the amended Negative Option Rule
- FTC Legal Library: Negative Option Rule (current status)
- California Privacy Protection Agency: Enforcement Advisory on Dark Patterns
- European Commission: The Digital Services Act
- Deceptive Patterns: Types Taxonomy (Harry Brignull)
- W3C: Understanding Success Criterion 3.3.8 Accessible Authentication (Minimum)
- W3C WAI: Making Content Usable for People with Cognitive and Learning Disabilities