Dark patterns are measurable, and the taxonomy and the law disagree about which members are unlawful

A design choice that gets a name and a count stops being a matter of taste. A practitioner's list of interface tricks, published from 2010, became a measured feature of the web. This fifth of ten units argues that the measurement moved the question from ethics to enforcement and exposed a gap. The taxonomy that made the problem measurable is a designer's list, organised by the mechanism of the trick rather than by legal wrong, and the law does not adopt it.

The list came before the measurement

Brignull's taxonomy is the list the literature inherited. It collects deceptive patterns into types with a plain definition for each. Sneaking is where information is hidden, forced action where the user must do something undesirable in return, and hard to cancel where signing up is easy and leaving is not. Each type now carries a count of the laws and enforcement actions attached to it, which makes the site an index of regulation as well as of design (Brignull 2023).

Gray and colleagues (2018) ran a content analysis over practitioner-identified examples and found a wide range of ethical concerns that practitioners frequently conflated under one umbrella term.

Measurement turned the list into a fact about the web

Mathur and colleagues (2019) changed the register of the argument. They built automated techniques for identifying dark patterns and ran them across about 53,000 product pages from about 11,000 shopping sites. The crawl found 1,818 instances across 15 types in seven categories. Of the sites, 183 engaged in deceptive practices, and 22 entities sold dark patterns as a turnkey service. A crawl can count what a case study can only illustrate, which lets a regulator describe a market.

Di Geronimo and colleagues (2020) carried the measurement to mobile interfaces: they analysed 240 popular apps and ran an experiment with 589 users. They found that 95 per cent of apps carried at least one dark pattern, and that most users did not recognise the patterns, though they performed better once informed.

The experiments established effect, and disclosure did not neutralise it

Luguri and Strahilevitz (2019) supplied the finding that a pattern works in two large-scale experiments with representative samples of American consumers. Users shown mild dark patterns were more than twice as likely to sign up for a dubious identity-theft service as a control group, and those in the aggressive condition were almost four times as likely. Only the aggressive patterns produced a backlash, and less educated subjects were significantly more susceptible to the mild ones. The effect is strongest where the trick is quietest.

Bongard-Blanchy and colleagues (2021) surveyed 406 individuals. They found that they were generally aware of the influence manipulative designs can exert, and that awareness did not equip them to oppose it. Their regression adds age: older respondents recognised a manipulative attempt less often and were less aware their choices were being influenced. Aung, Soubutts and Singh (2024) found the same group met restrictive, asymmetric and hidden information patterns most often on shopping sites, in a survey of 61 older adults.

Nouwens and colleagues (2020) showed the same at the scale of a regime. They scraped the five most popular consent management platforms across the top 10,000 United Kingdom websites, a sample of 680, and found that only 11.8 per cent met their minimal legal requirements. Their field experiment with 40 participants measured effects directly: the style of notification had no effect, removing the opt-out button from the first page raised consent by 22 to 23 percentage points, and more granular controls lowered it by 8 to 20. The regime did not remove dark patterns but produced a new family of them where it had specifically aimed.

Two instruments write the prohibition and leave the boundary to other law

Article 25 of the Digital Services Act (European Parliament and Council 2022) provides that providers of online platforms shall not design, organise or operate their interfaces in a way that deceives or manipulates recipients, or that otherwise materially distorts or impairs their ability to make free and informed decisions. Two limits sit in the same Article: the prohibition does not apply to practices already covered by consumer protection law or by data protection rules, which hands the boundary back to those instruments, and the Commission may issue guidelines on specific practices, naming more prominent choices, repeated requests for a decision already made, and termination made harder than subscription.

The Federal Trade Commission's staff report (FTC 2022) examined how dark patterns obscure, subvert or impair consumer choice. It creates no new offence, working from existing authority against deception and unfairness. The question is not which type a pattern belongs to but whether it deceives or unfairly harms a consumer.

The enforcement case and the evidence review test harm, not the list

In June 2023 the Federal Trade Commission sued Amazon, alleging that manipulative and deceptive interface designs enrolled members in Prime without consent. The complaint said the cancellation route the company called Iliad redirected them through several pages of retention offers, and that Amazon's leadership slowed changes that would have simplified it because those changes would have hurt revenue (FTC 2023). The case names no entry from the taxonomy from start to finish. It alleges deception and unfairness, which is this unit's gap in a single document: the list was built from design, and the test is built from harm to a consumer. Amazon agreed to pay 2.5 billion dollars, comprising a 1 billion dollar civil penalty, the largest the agency had obtained for a rule violation, and 1.5 billion dollars in redress for an estimated 35 million members, and it must show a decline button at enrolment, disclose the terms, allow cancellation by the same route used to sign up, and pay for an independent monitor (FTC 2025).

The United Kingdom's competition regulator published its own account in two papers (CMA 2022). They describe online choice architecture as the environment in which people act, set out a taxonomy of 21 practices, and summarise the evidence on each. They frame the account around harm to consumers and competition rather than the mechanism of a trick.

Contested question: which entries in the list are unlawful?

The disagreement is not about prevalence, which the crawls settled. It is about what follows from a taxonomy whose entries were selected on design grounds.

One position holds that existing law already reaches the harmful entries, so the taxonomy is evidence rather than legislation. The FTC (2022) acts on that view, enforcing against deception and unfairness without asking whether a named pattern is on a list. The CMA (2022) treats its taxonomy as a way to organise evidence of harm and to locate where competition or consumer law may bite.

A second position holds that the boundary cannot be drawn from the design list at all, because the list and the legal test are different kinds of thing. Gray and colleagues (2021) read three types of consent banner from the design and legal sides together and set out the tensions. A designer's reading of what a banner says about a relationship is not a legal test of whether consent was informed.

A third position denies that the term carries a single normative criterion. Mathur, Kshirsagar and Mayer (2021) reviewed the literature and found not a consistent definition but a set of thematically related considerations drawn from psychology, economics, ethics, philosophy and law. They argue for moving past subjective criticism to empirical methods grounded in stated normative perspectives.

What would settle it is enforcement decisions applying a general standard to named practices, and guidelines under Article 25(3), which would fix part of the boundary for platforms. Until then, the taxonomy tells a designer what to avoid building, and does not tell a regulator what to prosecute.

The three positions rest on different kinds of evidence. The Federal Trade Commission (2022) and Competition and Markets Authority (2022) positions are enforcement practice, strong on what regulators do and silent on what they miss. Gray and colleagues (2021) is an interaction criticism across three banner types and Mathur, Kshirsagar and Mayer (2021) a literature review, so both argue about definitions rather than measure an effect, and the crawls measure prevalence rather than unlawfulness. The strongest objection to this unit's thesis is that the mismatch is a lag rather than a structural difference, since Commission guidelines and Federal Trade Commission cases are converging on the same short list. While the dispute is open, a designer should test each pattern against deception and unfairness, and record what the user understood.

The counter-case: a design control that worked, and what it did not do

Kollnig and colleagues (2022) analysed two versions of 1,759 iOS apps from the United Kingdom App Store, one from before iOS 14 and one updated to comply. Apple's App Tracking Transparency, a mandatory opt-in for tracking, prevented collection of the Identifier for Advertisers, used for cross-app tracking, as promised, evidence that a platform-level requirement can change what an app can do. The same study found the limit: the number of tracking libraries per app stayed roughly the same on average, and many apps continued to collect device information usable for cohort tracking or fingerprinting. A design control removed one mechanism and left others in place. The counter-case is not that regulation failed but that it moved the tracking.

Where the argument is heading

The direction now runs through instruments rather than lists. The Digital Services Act writes the boundary into its own text by leaving specific practices to Commission guidelines. The next phase will be conducted in guidance and enforcement notices. The sixth unit returns to the mechanism the law declines to test.

The sources this unit rests on

Each note is this unit's summary of what the cited document did and found, not a quotation from it.

• Brignull, H. (2023). Deceptive patterns (dark patterns). https://www.deceptive.design/types The practitioner taxonomy that named the patterns the literature later measured. It defines each type and links it to a count of the laws and enforcement actions attached to it.
• Gray, C. M., Kou, Y., Battles, B. et al. (2018). The Dark (Patterns) Side of UX Design. doi:10.1145/3173574.3174108 Content analysis of a corpus of practitioner-identified dark patterns. Found a wide range of ethical concerns conflated under one umbrella term, and a shared designer worry about becoming complicit in manipulation.
• Mathur, A., Acar, G., Friedman, M. J. et al. (2019). Dark Patterns at Scale. doi:10.1145/3359183 Built automated techniques and crawled about 53,000 product pages from about 11,000 shopping sites. Found 1,818 instances across 15 types and seven categories, 183 deceptive sites and 22 vendors selling dark patterns as a service.
• Di Geronimo, L., Braz, L., Fregnan, E. et al. (2020). UI Dark Patterns and Where to Find Them. doi:10.1145/3313831.3376600 Analysed 240 popular mobile apps and ran an online experiment with 589 users. Found 95 per cent of apps carried at least one dark pattern and the average carried seven types, and that most users did not recognise them until informed.
• Luguri, J. and Strahilevitz, L. (2019). Shining a Light on Dark Patterns. doi:10.2139/ssrn.3431205 Two large-scale experiments with representative American consumers. Users shown mild patterns were more than twice as likely to sign up for a dubious service and those shown aggressive patterns nearly four times, and only aggressive patterns produced a backlash.
• Bongard-Blanchy, K., Rossi, A., Rivas, S. et al. (2021). Dark Patterns from the End-User Perspective. doi:10.1145/3461778.3462086 Surveyed 406 individuals on awareness of manipulative designs. Found general awareness of the influence such designs exert but no ability to resist it, so information alone does not neutralise the effect.
• Nouwens, M., Liccardi, I., Veale, M. et al. (2020). Dark Patterns after the GDPR. doi:10.1145/3313831.3376321 Scraped the five most popular consent platforms on the top 10,000 United Kingdom websites and ran a field experiment with 40 participants. Found only 11.8 per cent met minimal legal requirements, and that button design shifted consent by up to 23 percentage points.
• Mathur, A., Kshirsagar, M. and Mayer, J. (2021). What Makes a Dark Pattern... Dark? doi:10.1145/3411764.3445610 Review finding no single concern and no consistent definition in the literature, only thematically related considerations from several disciplines. Argues that measurement should be grounded in explicitly stated normative perspectives.
• Gray, C. M., Santos, C., Bielova, N. et al. (2021). Dark Patterns and the Legal Requirements of Consent Banners. doi:10.1145/3411764.3445779 Interaction-criticism reading of three types of consent banner from the design and legal sides together. Sets out the tensions between a designer's reading and a legal test of informed consent, and proposes transdisciplinary dialogue.
• Kollnig, K., Shuba, A., Van Kleek, M. et al. (2022). Goodbye Tracking? doi:10.1145/3531146.3533116 Analysed two versions of 1,759 United Kingdom iOS apps before and after iOS 14. Found App Tracking Transparency prevented collection of the advertising identifier, but the number of tracking libraries per app stayed roughly the same and fingerprinting continued.
• Competition and Markets Authority (2022). Online choice architecture. https://www.gov.uk/government/publications/online-choice-architecture-how-digital-design-can-harm-competition-and-consumers A discussion paper and an evidence review published on 5 April 2022. It sets out a taxonomy of 21 practices and summarises the evidence on each.
• Federal Trade Commission (2022). Bringing dark patterns to light. https://www.ftc.gov/reports/bringing-dark-patterns-light A staff report from September 2022, after an April 2021 workshop, on how dark patterns obscure consumer choice. It works from existing deception and unfairness authority rather than a new prohibition, and gives enforcement examples.
• European Parliament and Council (2022). Regulation (EU) 2022/2065 (Digital Services Act). https://eur-lex.europa.eu/eli/reg/2022/2065/oj Article 25 prohibits online platforms from designing interfaces that deceive or manipulate recipients or impair free and informed decisions. It carves out practices covered by consumer and data protection law and allows Commission guidelines on specific practices.
• Federal Trade Commission (2023). FTC takes action against Amazon for enrolling consumers in Amazon Prime without consent and sabotaging their attempts to cancel. https://www.ftc.gov/news-events/news/press-releases/2023/06/ftc-takes-action-against-amazon-enrolling-consumers-amazon-prime-without-consent-sabotaging-their The complaint of 21 June 2023 alleging that Amazon used manipulative and deceptive interface designs to enrol members in Prime without consent and complicated cancellation through a process it named Iliad. It alleges deception and unfairness rather than naming any entry from a dark pattern taxonomy. The order closing the case is Federal Trade Commission (2025), https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-25-billion-settlement-against-amazon, a 2.5 billion dollar settlement with a 1 billion dollar civil penalty, the largest for a rule violation, 1.5 billion dollars in redress, and required changes to the enrolment and cancellation flows.