Dark Patterns - Deceptive UI Design Tricks

About 2 min read

A dark pattern is a UI/UX design technique that cleverly nudges users into taking actions they did not intend. It refers to designs that deliberately distort users' judgment for the company's benefit, such as making subscription cancellation extremely complicated or enabling the sharing of personal information by default. In the security context, tactics that maximize the collection of personal data by making privacy settings hard to understand are seen as especially problematic.

Historical Background

The term "dark pattern" was coined in 2010 by the British UX designer Harry Brignull. Brignull launched darkpatterns.org and systematically classified and called out the deceptive design patterns used by companies. Acting on advice from the Tech Policy Design Lab of the World Wide Web Foundation, the site was renamed deceptive.design and shifted its vocabulary to "manipulative, deceptive and coercive patterns." That is why regulatory documents and research also use the label "deceptive design," even though the phenomenon they point to is the same. This work drew the attention of academic research and regulators, and entering the 2020s, moves by the EU and the U.S. Federal Trade Commission (FTC) to explicitly make dark patterns a target of regulation accelerated. The discussion was initially limited to the purchase flow of e-commerce sites, but it later widened to digital services in general, including cookie consent banners, social media privacy settings, and subscription management.

Representative Types

Dark patterns have several typical types. "Confirmshaming" is a technique that uses wording designed to make the user feel guilty about the option to decline. For example, "No, I don't need the great deals" makes declining itself appear to be a loss. "Roach Motel" is a design that makes signing up easy but cancellation extremely difficult, frequently seen in subscription services. "Hidden Costs" is a tactic of adding fees or shipping charges at the final stage of checkout. "Forced Continuity" is a pattern that automatically switches the user to a paid plan after a free trial ends and deliberately makes the cancellation process hard to understand.

The Problem with Cookie Consent Banners

Since the enforcement of the GDPR, cookie consent banners have come to be displayed on nearly every website, but many of them contain dark patterns. Typically, the "Accept All" button is shown in a large, eye-catching color, while "Reject" and "Customize Settings" are hidden in small text links. You can tell whether the banner in front of you is steering you toward consent by checking three things: whether "Accept" and "Reject" sit at the same size and the same level, whether advertising and tracking options are off by default, and whether the same banner stops reappearing once you have refused. If even one of the three breaks down, it is safe to assume the banner was designed to maximize the consent rate rather than the freedom to choose. Once consent becomes a mere formality, the very basis of privacy protection starts to wobble. We also examine the balance between privacy and convenience.

Regulatory Trends in the EU

The EU's Digital Services Act (DSA) prohibits interface designs on online platforms that distort, manipulate, or substantially impair users' decision-making. The European Commission explains that deceptive design tactics, such as aggressive pop-ups or confusing and misleading consent buttons, are now prohibited. The timing is easy to misread: the DSA entered into force in November 2022, but it applied to all regulated providers only from 17 February 2024. Fines may in no case exceed 6% of a provider's global annual turnover. For those doing the designing, the riskiest construction is leaving the path to cancel or refuse in a state where it technically exists but is hard to find, because what is banned is not only false statements but any construction that substantially impedes a choice. From a compliance perspective, service designers need to consciously eliminate dark patterns.

Dark Patterns in Security Settings

Dark patterns also lurk in security settings. Tactics such as embedding the two-factor authentication settings screen deep in the menu hierarchy to make it hard to find, or defaulting privacy settings to "public to everyone," are dark patterns that deliberately keep the user's security level low. When combined with social engineering, users may not even realize that they are choosing dangerous settings. We recommend regularly reviewing the settings of the services you use, referring to the privacy settings guide.

How to Recognize Dark Patterns

To protect yourself from dark patterns, it is effective to cultivate the habit of pausing to think, "Why does only this option stand out?" and "Why is declining so cumbersome?" As with phishing, it is precisely in situations where you are rushed or made to feel guilty that calm judgment is required. Please also check the safe app installation guide.