Consent & Cookies
What is Dark Patterns?
Dark patterns are user interface designs that manipulate or pressure people into choices they would not otherwise make — such as consent banners where accepting takes one click but refusing takes five — and consent obtained through them is legally invalid under the CPRA and EU guidance.
The term covers a family of manipulative design techniques: asymmetry (a bright Accept button next to grey 'manage options' text), obstruction (rejection buried behind multiple screens), confirm-shaming ('No thanks, I hate saving money'), false hierarchy, pre-selection, nagging (re-prompting users who already refused), and misleading language ('We value your privacy' atop a banner engineered for acceptance).
Privacy law has moved from disapproval to definition. California's CPRA defines a dark pattern as 'a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice' and states flatly that agreement obtained through dark patterns does not constitute consent. CCPA regulations operationalize this for opt-out flows: symmetry in choice, no more steps to opt out than to opt in. In the EU, regulators reach the same result through GDPR's requirement that consent be freely given — the EDPB has published detailed guidance cataloguing deceptive design in cookie banners and social media interfaces, and enforcement actions have fined asymmetric banners specifically.
The FTC polices the same territory in the US under its unfairness and deception authority, with dark-pattern theories appearing in cases about subscriptions, cancellations, and children's apps — its staff report on the subject catalogs the same techniques regulators abroad have fined.
The practical test is symmetry: put Accept and Reject on the same layer, in the same visual weight, with honest copy, and make withdrawing consent as easy as giving it. Anything your conversion team celebrates because it 'recovers' consents from people trying to refuse is probably a dark pattern.
Why it matters for eCommerce
eCommerce teams optimize interfaces for conversion by profession, and consent flows are where that instinct becomes liability: an A/B test that lifts accept rates by demoting the reject button has manufactured invalid consent at scale. Audit your banner, unsubscribe, and opt-out flows with the symmetry test — and remember regulators screenshot these interfaces as exhibits.
Frequently asked questions
- Are dark patterns illegal?
- Consent or agreement obtained through dark patterns is invalid under the CPRA and under GDPR's freely-given standard, and the FTC treats manipulative design as an unfair or deceptive practice. So the pattern itself may not be a named offense everywhere, but it voids consent and attracts enforcement.
- What are common dark patterns in cookie banners?
- Accept-only first layers with rejection hidden in settings, visually asymmetric buttons, extra click-depth to refuse, pre-ticked purposes, guilt-tripping copy, and repeated re-prompting after refusal. EU regulators have fined several of these designs.
Related terms
Wondering how this applies to your own site? Get a free compliance scan — see every tracker that fires before consent, graded against CIPA, GDPR, CCPA/CPRA, and MHMD.
Run a free scan