Dark patterns in ecommerce: regulations, enforcement and how to audit your store

Dark patterns are design choices that steer users toward actions they did not consciously choose. The term was coined by UX designer Harry Brignull in 2010, but regulators only began treating them as a legal problem in earnest from 2022 onward. By 2026, they are an active enforcement priority across the US, EU and UK.

For ecommerce stores, the stakes are significant. The FTC has taken action against billion-dollar companies. California's CPRA explicitly prohibits dark patterns that undermine privacy rights. The EU's Digital Services Act and its consumer protection framework both address deceptive design. Stores that have not audited their flows are exposed.

This article covers what qualifies as a dark pattern under current regulatory frameworks, which enforcement actions matter most, specific patterns common in ecommerce and a practical audit method to identify problems in your own store.

What regulators mean by dark patterns

There is no single legal definition that spans all jurisdictions, but there is significant convergence in how regulators describe the problem.

The FTC's 2022 report "Bringing Dark Patterns to Light" defines them as design practices that trick or manipulate consumers into purchases, subscriptions or disclosures they did not intend. The report identifies four broad categories: misleading interfaces, drip pricing, disguised ads and difficult-to-cancel subscriptions.

The EU's perspective covers both consumer protection and privacy. The European Data Protection Board's 2022 guidelines on dark patterns in social media address consent specifically. The Digital Services Act, effective from 2024, prohibits "recommender systems and online interfaces that distort or impair the ability of recipients of the service to make free and informed decisions." The Consumer Rights Directive requires full price transparency before checkout.

California's CPRA defines a dark pattern as "a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice." Any mechanism that undermines a consumer's ability to exercise their privacy rights, including the right to opt out of data sale, falls under this definition.

The common thread is deception through design rather than through explicit false statements. A checkout that shows a total price that excludes shipping until the final step is not making a false claim, but it creates a false impression that regulators treat as equivalent.

FTC enforcement: the cases that set the standard

The FTC's 2023 action against Amazon is the most consequential dark pattern enforcement case to date. The FTC alleged that Amazon used a subscription enrollment flow deliberately designed to confuse consumers into signing up for Prime without intending to. The complaint identified specific UI choices: enrollment steps buried in the checkout flow, misleading button labeling and a cancellation process requiring multiple steps across different pages.

Amazon paid $25 million to resolve the FTC's COPPA claims related to Alexa data, with the Prime enrollment case remaining in litigation. But the complaint itself is a detailed description of what the FTC considers illegal design. Any ecommerce store running subscription enrollments should read it.

The FTC's 2021 action against Vonage resulted in a $100 million settlement for a cancellation dark pattern. Vonage made cancellation so difficult, requiring calls to retention specialists, long hold times and repeated attempts, that the FTC characterized the entire cancellation experience as an unfair practice. The settlement included requirements to make cancellation as easy as enrollment.

The FTC's "click-to-cancel" rule, finalized in 2024, codified this principle. Any service that allows online enrollment must offer an online cancellation mechanism that is at least as simple as enrollment. The rule applies broadly to subscription-based ecommerce.

The FTC also cited drip pricing in its 2022 report and in a 2024 proposed rule on junk fees. Drip pricing means advertising a price at the top of a funnel and revealing mandatory fees only at the final checkout step. Hotel booking sites triggered much of the enforcement interest, but the rule applies to any ecommerce operator.

EU Digital Services Act and consumer protection framework

The Digital Services Act (DSA) came into full effect for all platforms in February 2024. It prohibits online platforms from using interface designs that deceive or nudge users. Article 25 of the DSA specifically bans online interfaces that make it harder to cancel a service than to subscribe, that prompt users to revisit choices they have already made and that make the procedure for terminating a service more difficult than the procedure for initiating it.

The DSA applies to platforms operating in the EU, which covers any ecommerce store with EU customers. The European Commission enforces the DSA for very large platforms directly. National consumer protection authorities enforce it for smaller operators, working alongside the DSA's obligations under the Omnibus Directive and existing consumer protection law.

The EU Omnibus Directive, transposed into national law across EU member states from 2022, added specific requirements for price transparency. Products sold in the EU must display the full price before the final checkout step, including all mandatory charges. Fake countdown timers showing false urgency are explicitly prohibited. False statements about product popularity or scarcity (such as "Only 2 left in stock" when stock is not actually limited) are banned.

The European Data Protection Board's guidelines on dark patterns focus on privacy-specific manipulation. These guidelines identify patterns including "privacy maze" (burying privacy controls in inaccessible locations), "look over there" (distracting users away from privacy choices), "confirm shaming" (using guilt-inducing language on opt-out buttons) and "disguised ads" (presenting advertising as organic content). For cookie consent specifically, the EDPB guidelines state that banners using dark patterns to steer users toward accepting all cookies violate GDPR because the resulting consent is not freely given.

California CPRA: dark patterns and privacy rights

California's CPRA took a direct approach to dark patterns in the privacy context. The law defines a dark pattern as any design that subverts or impairs user autonomy, decision-making or choice. This applies specifically to the exercise of CPRA privacy rights.

An opt-out mechanism for data sale that uses a 15-step process, requires users to contact customer service by phone or sends users through a confusing interface that is designed to cause abandonment is a dark pattern under CPRA. A consent banner that makes accepting easier than declining is a dark pattern. A privacy policy structured so that disclosures are impossible to find is a dark pattern.

The California Privacy Protection Agency has included dark pattern auditing in its enforcement approach. The CPPA's enforcement guidance explicitly states that the agency will examine not just the existence of required mechanisms but the design of those mechanisms. A "Do Not Sell" link that works technically but is designed to be missed is not compliant. Stores should also review their CCPA and CPRA compliance more broadly to understand how dark pattern rules fit into the full framework.

Fines run to $7,500 per intentional violation per consumer. At typical ecommerce traffic volumes, a dark pattern that affects every California visitor creates potential liability that scales with the site's popularity.

Seven dark patterns common in ecommerce

1. Hidden costs and drip pricing

The store advertises a product at $49. At checkout, after the user has entered their address and payment details, the total reveals $49 + $12 shipping + $3 handling + $5 "sustainability fee" = $69. The user has already committed significant time and cognitive effort to the checkout. The design relies on this sunk cost to prevent abandonment.

This is illegal under the EU Omnibus Directive and targeted by the FTC's junk fees rulemaking. Full price transparency requires showing the complete cost before the user enters payment details.

2. Pre-checked add-ons and forced bundling

A product page has a checkbox pre-ticked to add a protection plan, expedited shipping or a "free trial" that requires a credit card and auto-renews. The user must actively uncheck to avoid the charge. The design relies on users not reading every element of a form.

Pre-checked consent boxes are explicitly prohibited under GDPR for cookie consent. The same principle applies to commercial add-ons. Under the Consumer Rights Directive, pre-ticked boxes for additional charges are prohibited in the EU.

3. Confirm-shaming

Opt-out language is designed to invoke guilt or shame. A popup offers a 10% discount with two buttons: "Yes, I want to save money" and "No, I prefer to pay full price." The decline option is phrased to make refusal feel irrational or self-harmful.

In the privacy context, confirm-shaming on cookie banners is specifically identified by the EDPB as a dark pattern that invalidates consent. A button that reads "No, I do not care about my privacy" is not neutral and does not produce freely given consent. The same principle applies to any consent or opt-out mechanism under consent management frameworks.

4. Trick questions and double negatives

A checkout form includes: "Uncheck this box if you do not want to receive marketing emails." A user who wants to avoid marketing emails must check the box. The double negative means that the intuitive action produces the opposite of the intended result.

Many stores use this for email list enrollment. It produces a large list of users who did not understand they were signing up. Under GDPR and the CAN-SPAM Act, marketing consent must be unambiguous. Trick questions produce invalid consent. The email marketing compliance rules in both the US and EU require that consent be clear and affirmative.

5. Hard-to-cancel subscriptions

Subscribing takes two clicks. Cancelling requires logging in, navigating to account settings, finding a cancellation option that is not in the obvious location, clicking through a retention flow with multiple "are you sure?" screens and potentially contacting customer support. Some stores make the cancel button invisible or require a phone call.

The FTC's click-to-cancel rule directly addresses this. If a user can subscribe online, they must be able to cancel online through a process of comparable simplicity. Retention flows are permitted, but only after a clear cancellation option is presented. Any flow that makes cancellation contingent on speaking to a retention agent violates the rule.

6. Forced consent and privacy bundling

A store requires users to accept marketing cookies or behavioral tracking as a condition of completing a purchase. Refusing cookies means being unable to check out. This is not consent: it is coercion.

GDPR Article 7 requires that consent be freely given. Consent is not freely given when refusal results in denial of service. The EDPB has stated explicitly that cookie walls on ecommerce sites that condition access to purchasing on accepting advertising cookies violate GDPR. The consent management platform must be configured so that users can decline non-essential tracking and still complete a purchase.

7. Urgency and scarcity manipulation

A product page displays a countdown timer that resets when it expires. A banner reads "17 people are viewing this item" regardless of actual traffic. A stock counter shows "Only 3 left" when warehouse stock is in the thousands.

The EU Omnibus Directive prohibits false urgency and false scarcity claims. These are not marketing exaggerations in the grey area: they are specific prohibited practices. National consumer protection authorities across the EU have begun enforcement actions against countdown timers and fake stock warnings. The UK's Competition and Markets Authority has issued similar guidance.

How to audit your store for dark patterns

An effective dark pattern audit covers every flow where a user makes a decision. This means more than the product page and checkout. It includes subscription enrollment, account creation, email list signup, cookie consent, newsletter unsubscribe and subscription cancellation.

Run the audit in a private browser window with no saved state. Approach each flow as a first-time visitor who is not reading every word. This mirrors how most users interact with ecommerce sites.

Checkout flow

• Is the total price (including all fees, shipping and taxes) visible before the payment step?
• Are any add-ons pre-checked? Who benefits from the default?
• Are there any subscription elements in a one-time purchase flow? Are they clearly labeled?
• Is the final total significantly higher than the price shown at product listing?
• Are countdown timers present? Do they reset?

Subscription enrollment

• Is the recurring billing amount and frequency displayed prominently before enrollment?
• Is the trial-to-paid conversion date clearly stated?
• Is there an online cancellation path that does not require contacting support?
• How many steps does cancellation require compared to enrollment?

Cookie and privacy consent

• Are all non-essential cookie categories defaulted to off?
• Is declining as easy as accepting (same number of clicks, same visual prominence)?
• Does opt-out language use neutral framing? No confirm-shaming?
• Can users complete a purchase without accepting advertising or analytics cookies?
• Is the "Do Not Sell or Share My Personal Information" link present and functional for California visitors?

Email and marketing opt-ins

• Are email marketing checkboxes unchecked by default at checkout?
• Is the language on opt-in checkboxes unambiguous? No double negatives?
• Is the unsubscribe process in marketing emails functional and single-step?

Scarcity and urgency claims

• Are stock counts accurate? Are they updated in real time?
• Are countdown timers tied to real deadlines (sale end dates, shipping cutoffs)?
• Are "X people viewing this" counters based on real traffic data?

Remediation: how to fix what you find

Most dark pattern fixes are straightforward. The difficulty is usually internal: they were introduced to lift conversion metrics and there is organizational resistance to removing them. The compliance and legal risk argument is often necessary to override this resistance.

For hidden fees: surface all mandatory charges on the product page or at the earliest point in the funnel. Shipping estimates are acceptable; invisible charges are not.

For pre-checked add-ons: change all defaults to unchecked for items that benefit the store rather than the user. Session cookies and cart persistence should remain on. Expedited shipping upgrades, protection plans and marketing subscriptions should default off.

For confirm-shaming: replace all manipulative button labels with neutral language. "No thanks" is acceptable. "No, I prefer to pay full price" is not.

For cancellation friction: build an online cancellation path. Retention offers are acceptable but must come after a clear option to cancel, not before. Remove any requirement to call or email to cancel. Run the cancellation flow yourself and count the steps. If it takes more steps than enrollment, reduce it.

For forced consent: reconfigure your CMP so that declining cookies does not block checkout. This may require separating session-essential cookies from analytics and marketing cookies at the platform level. For more on a full compliance audit, our checklist covers cookie consent, privacy rights and other compliance areas in one framework.

For fake urgency: remove countdown timers that reset, replace fabricated viewer counts with real data or remove them entirely and ensure stock counts are accurate. The short-term conversion lift from these patterns is not worth the regulatory exposure.

The enforcement trajectory

Dark pattern enforcement will intensify through 2026 and beyond. The FTC has signaled that the click-to-cancel rule is an enforcement priority. The CPPA in California has funded dark pattern detection as part of its audit program. The European Commission has named deceptive design as a priority under the DSA.

Automated detection is improving. Regulators are building or procuring tools that can scan ecommerce checkout flows, cookie banners and subscription enrollment screens for specific pattern signatures. The era of dark patterns requiring a human inspector to discover is ending.

Stores that proactively audit and remediate dark patterns before enforcement actions begin are in a substantially better position, both legally and reputationally. Consumer trust in ecommerce is a commercial asset as well as a legal obligation. The expanding state privacy law landscape in the US means that dark pattern rules, particularly around privacy consent, will only expand in geographic scope over the next two to three years.

Frequently asked questions

What are dark patterns in ecommerce?

Dark patterns are user interface designs that manipulate users into actions they did not intend or would not choose if the choice were presented clearly. In ecommerce, common examples include hidden fees revealed only at checkout, pre-checked add-ons, confirm-shaming opt-out language, subscription cancellation flows designed to exhaust users and forced consent that bundles privacy agreement with service access.

Is using dark patterns illegal in the US?

Yes, in many cases. The FTC has authority to pursue dark patterns as unfair or deceptive acts under Section 5 of the FTC Act. The FTC's 2022 dark patterns report and subsequent enforcement actions against Amazon, Vonage and others confirm this. California's CPRA explicitly prohibits dark patterns that undermine consumer privacy rights, with fines of up to $7,500 per intentional violation per consumer.

How do I audit my ecommerce store for dark patterns?

Walk every conversion flow as a first-time visitor: homepage to checkout, subscription signup, account creation and cancellation or unsubscribe flows. For each step, ask whether the total cost is visible, whether pre-checked options benefit the user or the store, whether opt-out language is neutral, whether cancellation is as easy as signup and whether consent is freely given without coupling to service access. Document every screen. Repeat from a mobile device, since many dark patterns are worse on small screens.