Dark Patterns

021 min

Where the term dark patterns comes from

The FTC called Amazon's designs dark patterns, a name that comes from a UX designer's website. Harry Brignull started the website darkpatterns.org in 2010 to collect and name these designs. A trick with a short name and public examples is easier to recognise and to criticise.

The name borrows from design patterns, the reusable solutions that designers share for common interface problems, such as a search box or a checkout. A dark pattern is reusable too. The difference is the problem it solves. It solves a business problem, such as low sign-ups, and the user pays the cost.

Brignull's list gave each trick a short label, such as roach motel or confirmshaming. The labels spread to research and the press. The site says its terms now appear in laws such as the EU Digital Services Act and the California Privacy Rights Act.

Later the site moved to deceptive.design and changed its term to deceptive patterns. It followed advice from the World Wide Web Foundation's Tech Policy Design Lab to avoid words with harmful associations. Its current definition also covers AI systems, not only apps and websites. Both names are in use today.

032 min

How dark patterns work

Dark patterns like Amazon's rarely state anything false. They work on the shortcuts people use to decide fast.

People skim. A user moving through a checkout reads little, takes the obvious path and accepts what is already selected. A dark pattern puts the business's preferred option on that obvious path. It then adds a known bias:

• The default effect: people tend to keep an option that is already selected. A pre-ticked box for travel insurance uses it.
• Loss aversion: losing something feels worse than gaining the same thing feels good. A cancel screen that lists everything the member "will lose" uses it.
• Social proof: people copy what others seem to be doing. A note that other shoppers are looking at the same hotel room uses it.
• The scarcity principle: things seem more valuable when they seem about to run out. A countdown timer on a sale uses it.
• The framing effect: the same choice feels different when it is worded differently. A decline link that makes the user say they prefer paying full price uses it.

The last tool is effort. Every extra click, page or search is a small cost. Busy people will not pay many small costs to reach an option. So when one option takes more effort than the other, fewer people choose it, even though both options still exist. That is exactly how the Amazon exit worked.

Five questions that make a pattern dark

Every interface pushes users somewhere, so a test is needed. In 2019, the researcher Arunesh Mathur and colleagues proposed five questions for describing how a dark pattern acts on a decision. Their first question asks whether a design puts unequal weight or effort on the choices it offers. The other four ask:

• Covert: is the effect hidden, so the user does not notice the push?
• Deceptive: does the design create a false belief, through a false statement, a misleading one, or a missing fact?
• Hides information: does it hold back facts the user needs, or show them only at the end?
• Restrictive: does it take away choices the user should have?

The Amazon checkout fails the hides-information question. The Amazon exit fails the effort question.

042 min

Common types of dark patterns

Those shortcuts can be used in many ways, so dark patterns have been sorted into named types. Most real flows combine several.

The Prime case used two of these. The checkout used sneaking. The exit was a roach motel, with nagging offers on the way out.

051 min

Why dark patterns spread

With so many named types, a fair question is why teams keep shipping dark patterns at all. Usually nobody decides to deceive. The trick wins a test.

In 2011, Brignull described this problem with A/B testing. An A/B test shows two versions of a page to different users and keeps the one that gets more sign-ups or sales. A design that tricks people into signing up will usually win more sign-ups than an honest one. So a team that measures only conversion picks the trick, one small test at a time.

Copying adds to this. Small teams copy the checkout and cancel flows of large companies, and copy their tricks with them.

Dark patterns sold as ready-made products

Some dark patterns are not designed by the team at all. They are bought. In 2019, Mathur's team built a crawler and looked at about 53,000 product pages on about 11,000 shopping websites. They found 1,818 dark patterns of 15 types, and 183 websites whose patterns were clearly deceptive. They also found 22 outside companies that sold dark patterns as ready-made products. Many were plugins for popular shop platforms. One plugin let shop owners show pop-ups about recent sales by typing in sales that had never happened.

For a shop owner, fake urgency was a setting, not a design decision. That helps explain why the same patterns appear on unrelated sites.

062 min

How much dark patterns change choices

Dark patterns spread because they work, and experiments have measured how well.

The identity-theft protection experiment

In a 2021 paper, the law scholars Jamie Luguri and Lior Strahilevitz ran an experiment with a large sample of American adults. Each person was told they had been signed up for an identity-theft protection plan. They believed their money was at stake, but no payment was ever taken, and everyone was told the truth at the end. The experiment changed only what a person had to do to decline the plan. One group saw a plain choice. One group saw mild dark patterns. One group saw aggressive ones.

Mild dark patterns doubled the share of people who stayed signed up. With aggressive ones, people stayed signed up more than four times as often as with the plain choice. The mild versions matter most, because nothing in them looks extreme enough to fail a design review.

Knowing about dark patterns does not protect people

A common belief is that careful users can see through these tricks. Strahilevitz tested this with Matthew Kugler, Marshini Chetty and Chirag Mahapatra. More than 1,700 people signed up for a new streaming service as beta testers and made six privacy choices. Half of them were told to make the most privacy-protective choice every time. Some saw nagging, some saw preselected defaults, and some had to click more to protect their data.

Dark patterns still pushed people into privacy choices they would not otherwise have made, including people who had been told to protect their privacy.

Dark patterns are not only a problem for vulnerable users

Another common belief is that dark patterns mainly catch older, poorer or less educated people. The same study found the effect in every group it measured: rich and poor, young and old, men and women, and people at every level of education. The effect depends on attention and effort, not intelligence, and everyone has limited amounts of both.

071 min

Dark patterns in cookie consent pop-ups

Cookie consent pop-ups are one of the most studied places where dark patterns appear, because almost every web user meets them every day. The EU's General Data Protection Regulation (GDPR) says consent to tracking must be freely given, specific, informed and unambiguous. Many pop-ups make one answer much easier than the other.

The consent pop-up study

In 2020, Midas Nouwens and colleagues collected the designs of the five most common consent tools on the top 10,000 websites in the UK, 680 sites in all. Only 11.8% met the minimum requirements the team drew from European law.

The team then tested the eight most common designs with 40 people in a field experiment. Removing the reject option from the first screen raised consent by 22 to 23 percentage points. A percentage point is a direct difference between two percentages, so a rise from 50% to 72% is 22 points.

What did not change consent

The same experiment shows which design details matter. Whether the pop-up was a small banner or a barrier that blocked the whole page made no difference. Showing more detailed choices on the first screen lowered consent by 8 to 20 points. So the position of one option mattered more than the size or style of the whole pop-up.

092 min

Dark patterns and the law

Both the Amazon and Fortnite cases ended with regulators, because dark patterns are now a legal problem in many places, not only a design problem.

• United States. The FTC uses the FTC Act, which bans unfair or deceptive practices, and the Restore Online Shoppers' Confidence Act (ROSCA), which covers online subscriptions. In its 2022 report Bringing Dark Patterns to Light, the FTC described dark patterns in online shopping, cookie banners, children's apps and subscription sales.
• European Union. The GDPR sets the rules for valid consent. The EU's Digital Services Act of 2022 bans online platforms from building interfaces that deceive or manipulate their users.
• California. The California Privacy Rights Act uses the term dark patterns in its rules on consent.

The Amazon settlement shows what regulators ask for in return. Amazon must offer an easy way to cancel Prime, using the same method people used to sign up.

A dark pattern does not need intent

A common misreading is that a design only counts as a dark pattern when someone meant to deceive. The Digital Services Act does not ask about intent. Its ban also covers interfaces that seriously weaken a user's ability to make a free and informed decision. So a design that won an A/B test, with nobody planning a trick, can still break the rule. Regulators look at what the design does to the user, and a team cannot defend a pattern by saying it was never meant that way.

102 min

Dark patterns vs. nudges, persuasion and bad design

The law draws a line, but designers still need to tell dark patterns apart from ordinary persuasion. Every interface pushes users somewhere. The difference is whose interest the push serves, and whether the user can see it and undo it.

A nudge comes from choice architecture, the idea that the way choices are arranged changes what people pick. A dark pattern uses the same tools, aimed at the business's goal instead of the user's. Behavioural economists use the word sludge for friction that makes a good choice harder. Many dark patterns, such as the roach motel, are a kind of sludge.

The line between a dark pattern and bad design is the direction of the error and how long it stays. One confusing button is a usability bug. A confusing button that always fails in the business's favour, and stays in place after complaints, is a pattern.

Friction is not always bad either. A confirmation step before deleting an account protects the user. The test is whose mistake the friction prevents.

112 min

How to avoid building dark patterns

A product team can keep dark patterns out of its own work with a few concrete rules. Each one comes from a case above.

1. 1

   Make leaving as easy as joining.

   If signing up takes one screen, cancelling should take about one screen, by the same method. The Amazon order now requires exactly this.

2. 2

   Give accept and decline equal weight.

   Same size, same contrast, same screen. In the consent study, moving one option off the first screen changed consent by more than 20 points.

3. 3

   Leave paid extras unticked.

   Let people add them.

4. 4

   Show the full price the first time a price appears.

   No fees on the last screen.

5. 5

   Use urgency and stock messages only when they are true.

   Drive them from real data, never from a plugin setting.

6. 6

   Write decline options in neutral words.

   "No thanks" is enough.

7. 7

   Judge a test by more than conversion.

   Also track refunds, chargebacks, cancellations in the first month and support contacts. A version that wins on sign-ups and loses on these is probably a trick.

Designers often face conversion targets. With stakeholders, the useful argument is the later cost: refunds, support load, lost trust and, for Amazon, $2.5 billion.

These rules have a limit. Removing all friction can hurt users too. An action that cannot be undone, such as deleting an account or sending money, needs a confirmation step. An honest design keeps the friction that protects the user and removes the friction that protects revenue.

121 min

How to spot dark patterns in a product

Even with those rules, dark patterns can enter a product through a test result or a copied flow, so teams need ways to find them. Most dark patterns leave traces in data a team already has:

• Cancelling takes many more steps than signing up. Count the screens in both flows.
• Support tickets ask how to cancel, or why a charge appeared.
• Chargebacks or refund requests rise after a design change.
• Opt-in rates are far above what users say they want in surveys or interviews.
• Many users cancel on the day a free trial turns into a paid plan.
• A reject or decline option appears only on a second screen.

Users can watch for the same signs from the other side. Check the basket before paying, look for pre-ticked boxes, and set a reminder before a free trial ends. Researchers are also building tools that find dark patterns automatically by scanning pages, the way Mathur's crawler did.

When a team finds one of these signs, the decision is simple: change the flow before a regulator or a refund queue makes the decision for it.

?3 questions

Questions people ask

§11 sources

Sources