Deceptive patterns, formerly known as dark patterns

Last Wednesday I gave a talk at Ping, Bekk’s student conference in Trondheim. The title was “Nei takk, jeg vil ikke spare penger”, which is Norwegian for “No thanks, I do not want to save money”, and if that sounds familiar, it is because you have seen it many times. It is the grey link under the big blue button below, so common in a lot of digital services these days. Such patterns in design have a name: deceptive patterns, formerly known as dark patterns, and below is a rundown of what we talked about.

Bad UX or dark pattern?

A button nobody can find is bad UX. It hurts the user and it hurts the business, so it gets fixed as soon as someone notices. A dark pattern is a different animal. It is design making it cheap to say yes and expensive to say no. This is bad for the user and profitable for the business, hence the temptation to both design it that way and leave it in.

Persuasion in itself is fine. Informing and persuading people is a large part of my job too, and good marketing and design are persuasive. Even a nudge is fine, as long as it meets the three conditions Richard Thaler, the economist who co-wrote the book Nudge, set for it:

• Everything is visible.
• Saying no is as easy as saying yes.
• The nudge is good for the one being nudged, not only for the one nudging.

But break one of the three and you have crossed the line.

Harry Brignull, a UX designer with a PhD in cognitive science, gave us the dark pattern name in 2010 when he started darkpatterns.org. In 2023 Brignull renamed his subject deceptive patterns.

Why they work

Daniel Kahneman describes our mind as two systems. System 1 is fast, automatic and always on. It reads colour before it reads text, and it taps where things are big and blue. System 2 is slow, lazy and expensive to run. It reads the terms, it likes a pause, and it only wakes up when something feels off. A good dark pattern is designed so that nothing feels off. The grey text is never hidden, it is simply not worth System 1’s attention, and System 2 never gets the call.

Six patterns from real sites

Confirmshaming

McAfee, the antivirus for Windows, asks for your email address before you get to the download and gives you two options: “Yes, I want the benefits” and “No, I like paying full price”. Declining takes a whole sentence instead of a word, and to click it you have to feel like an idiot for half a second. Robert Cialdini describes consistency as one of the shortcuts that guide our behaviour, while Jonathan Haidt argues that moral intuition generally arrives before moral reasoning. Luguri and Strahilevitz tested dark patterns on 1 963 Americans in 2021. The mild patterns more than doubled acceptance, from 11 to 26 percent, without measurable backlash. The aggressive patterns nearly quadrupled it, but caused strong negative reactions. The mild ones are the dangerous ones, because they pass without that backlash.

False hierarchy

Foodora’s cookie dialog has a big blue “Accept all” button next to a “Save settings” button that looks disabled. Nothing is hidden and every choice is there, they just do not weigh the same. The brain starts sorting on colour and size before you have consciously read a word. Paul Fitts showed in 1954 that a large target nearby is faster to hit than a small one farther away. That effect is easy to turn upside down. The European Data Protection Board calls this visual interference and says it can steer people towards options that give away more personal data.

Preselection

Gjensidige and McAfee tick the boxes for you. The only box left unticked is “I have read the terms”. Johnson and Goldstein’s 2003 study of organ-donor defaults has the best graph I know on the subject. Effective consent rates in opt-in countries ranged from 4 to 28 percent. In opt-out countries they ranged from 86 to almost 100 percent. Denmark had 4 percent and Austria almost 100, and it is not because Austrians are nicer people. Changing something takes a decision, while leaving it alone takes nothing, so it stays. A pre-ticked insurance at 79 kr is the same experiment run on you. The EU Court of Justice confirmed in the Planet49 ruling in 2019 that a pre-ticked box does not give valid consent to cookies, and such boxes still show up everywhere.

Roach motel

Roaches check in, but they do not check out. In the example from the talk, joining Viaplay took two steps and about 30 seconds. Leaving took multiple steps while they tried to wheel you back in. Thaler himself wrote a Science editorial in 2018 called “Nudge, not sludge” to distance himself from this kind of thing. After five steps you have invested time, which makes the next offer harder to dismiss. The roach motel only has to win today, since every day you postpone another 129 kr goes out. DellaVigna and Malmendier found that gym members on monthly contracts paid more than 17 dollars per visit, and waited an average of 2.3 full months after their last visit before cancelling. The paper is called “Paying not to go to the gym”.

Drip pricing

Airlines have been fond of this. The example starts with a ticket at 199 kr. Then comes a service fee, a booking fee, a delivery fee and a payment fee, and you land on 339 kr. The price you saw is not the price you pay, but by now you have spent six minutes on the booking. The first number becomes the anchor, so the brain compares 339 with 199 and not with the competitor who said 329 up front. StubHub tested drip pricing against showing the full price from the start. Users who saw the fees only at checkout spent about 21 percent more. So they know what they are doing. In the example from Gjensidige, the initial price did not include the traffic insurance tax. The European Commission and consumer authorities in 23 EU countries, Norway and Iceland checked 399 web shops in 2023 and found at least one of three manipulative practices in 148 of them: fake countdowns, misleading interface design or hidden information.

Fake scarcity, fake urgency and fake social proof

Three patterns in one screenshot, which is how they show up in real life too. “Only 1 room left!”, “23 people are looking at this right now” and “Offer ends in 09:59”. In this example, reloading the page starts the countdown from ten minutes again, the 23 is a random number between 12 and 40, and the last room has always been the last room. A Princeton-led study of 11 000 shopping sites found real countdowns that reset while the offer remained valid, fake activity messages generated from random numbers and stock values generated on a schedule. It also found 22 third parties selling dark patterns as a ready-made service. A loss weighs about twice as much as an equal gain, and “missing out” is a loss while “not buying” is neutral. The designer picks which one you feel. Scarcity and social proof are sensible shortcuts in a shop with a real stock room. Online, the stock is a number in a database, and that number can be faked.

We still have nagging, sneak into basket, trick questions (“do not untick if you do not wish to not receive offers”), privacy zuckering and many more. Take a look over at deceptive.design.

How a dark pattern is born

No designer wakes up one morning wanting to manipulate anyone.

In release 14, the designer moves “no” under the button because it looks cleaner. The A/B test says plus 9 percent conversion, statistically significant, and everyone cheers. The Q3 OKR says 12 percent, so the PM asks if the no-button could be a little smaller. In release 19, the no is grey text reading “No thanks, I do not want to save money”, and that gives another 4 percent. In Q4 the bonus arrives. Every small step makes a little sense on its own, but in the end we’re left with a deceptive user experience. And that is an organizational failure.

Goodhart’s law, in Marilyn Strathern’s popular formulation, explains why it keeps happening: when a measure becomes a target, it stops being a good measure. The business wants happy customers who complete their purchase, so we optimize for conversion. The dashboard shows plus 9 percent. It does not show the regretted purchase that never gets returned, the subscription cancelled after two years of irritation, the friend who has to listen to a rant, or the room full of students at Ping who just saw the brand’s sign-up flow on a slide.

It is not necessarily legal either

Article 25 of the DSA bans interfaces that deceive, manipulate or materially impair free and informed choices on online platforms in the EU. Its incorporation into the EEA Agreement and Norwegian law is still under way. GDPR requires consent to be freely given, specific, informed and unambiguous, through a statement or clear affirmative action. The EDPB’s final guidelines list six categories of deceptive design. In Norway, sections 6 to 9 of the Marketing Control Act ban unfair, misleading and aggressive commercial practices, while section 8 of the Right of Withdrawal Act requires the total price, including taxes and additional costs, before an online purchase. Next up is the Digital Fairness Act, a Commission proposal planned for the fourth quarter of 2026, with dark patterns explicitly on the list.

It costs, too. Epic Games agreed to pay 245 million dollars in 2022 because Fortnite charged players for unwanted purchases through what the FTC called dark patterns, including inconsistent button layouts and purchases without confirmation. Amazon agreed to pay 2.5 billion dollars in 2025 over Prime enrolment without consent and a cancellation flow internally called “Iliad”. Of that, 1.5 billion dollars goes back to customers. Under Article 52 of the DSA, the maximum fine is 6 percent of global annual turnover. The Commission has since preliminarily found TikTok’s addictive design in breach of the DSA, and preliminarily found dark patterns in Meta’s reporting and appeals interfaces.

Tips to avoid misleading your users

We’ll end with some tips on how we can do better as developers, designers or business people:

• Ask who profits. If the answer is only “us” rather than “the user”, stop.
• Run the symmetry test. Leaving should be as easy as joining. “No” as easy as “yes”, and “reject all” as easy to find as “accept all”. Count the clicks. Swap the button colours in a test, and if conversion drops, the design was doing the selling.
• Read the microcopy out loud. Confirmshaming, double negatives and pre-ticked boxes expose themselves when spoken.
• Do not lie with numbers and time. And not lying to users is a good tip in general.

If you would be embarrassed to explain how a feature works, you are probably looking at a dark pattern.

So what do we do?

What do we do, as consultants, developers and designers, when the business side turns up with a dark idea? The students in the room have not sat in that meeting yet. They will, in about two years. So I ended the talk where it started, with the newsletter sign-up from the first slide, this time drawn with two buttons of equal weight.

We take the user’s side and make a good product instead. “No thanks” should be a perfectly fine answer.