Dark Patterns: Where Deceptive Design Is Actually Regulated

A Design Critique That Became a Defined Term

For most of its life “dark pattern” was a phrase in design criticism describing interfaces that steer a user toward a choice they would not otherwise make: the pre-ticked box, the cancellation flow buried three screens deep, the decline button rendered in grey on grey. It is now a defined term in American statutes and regulations, and the definitions are narrower and more specific than the critique they came from.

The California formulation is the one others have copied. Civil Code section 1798.140(l) defines a dark pattern as “a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.”

Two words in that sentence do most of the work. “Substantial” sets a threshold, so friction alone is not enough. “Effect” makes the test outcome-based rather than motive-based, which is what separates the legal term from the design critique — it does not ask what the designer was trying to do.

The FTC Route: Section 5 and Nothing Narrower

There is no federal dark patterns statute. What exists is section 5 of the FTC Act, 15 U.S.C. 45(a)(1), which declares “unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce” to be unlawful, and empowers the Commission to prevent them.

That generality is both the strength and the constraint. Section 5 reaches any deceptive interface without waiting for a rule that names it, which is why the Commission has been able to act against manipulative design at all. But a section 5 case is a case: proved on its own facts, resolved by consent order most of the time, and binding on the respondent rather than on an industry.

Turning a pattern of cases into a rule of general application is a much harder procedure, and the Commission's most recent attempt to do it failed on exactly that point.

The Click-to-Cancel Rule, Vacated

The Negative Option Rule dates to 1973, when the Commission promulgated it after finding that some negative option marketers were engaged in unfair and deceptive practices violating section 5. On November 15, 2024 the Commission published a final rule amending it, at 89 FR 90476, under the title “Rule Concerning Recurring Subscriptions and Other Negative Option Programs.” The 2024 rule did four things:

1. Prohibited misrepresentations of any material fact made while marketing using negative option features.
2. Required sellers to provide important information before obtaining billing information and charging the consumer.
3. Required sellers to obtain unambiguously affirmative consent to the negative option feature before charging.
4. Required sellers to provide simple cancellation mechanisms to immediately halt all recurring charges.

Businesses and industry groups petitioned four federal circuits for review; the Judicial Panel on Multidistrict Litigation consolidated the petitions in the Eighth Circuit. Petitioners argued the rule failed the specificity and prevalence requirements of section 18 of the FTC Act, violated section 22 because the Commission had not issued a preliminary regulatory analysis, and was overbroad and unworkable.

The court reached the procedural ground. As the Commission's own subsequent rulemaking records it, the Eighth Circuit found the failure to issue a preliminary regulatory analysis “procedurally insufficient” and vacated the 2024 rule, in Custom Communications, Inc. v. FTC, 142 F.4th 1060, 1069–70, 1074 (8th Cir. 2025).

On February 12, 2026, at 91 FR 6507, the Commission took final action conforming three rules to the courts' orders: it recodified the Negative Option Rule as it stood before the 2024 amendment took effect, withdrew the CARS Rule, and removed the Non-Compete Rule from the Code of Federal Regulations. The rule was effective on publication.

The vacatur was procedural rather than substantive: the Eighth Circuit did not hold that the Commission lacks authority over deceptive cancellation flows. That distinction matters for what comes next, and the Commission has already moved. On March 13, 2026, at 91 FR 12318, it published an advance notice of proposed rulemaking seeking public comment on the need for amendments to the prenotification rule “to help consumers avoid recurring payments for products and services they did not intend to order and to allow them to cancel such payments without unwarranted obstacles.” Comments closed April 13, 2026, and no final rule had issued as of this writing.

The Statute That Survived

One federal obligation was untouched by any of this, and it is frequently overlooked because the rule attracted the attention. Section 4 of the Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403, enacted December 29, 2010, makes it unlawful to charge or attempt to charge a consumer for goods or services sold in an internet transaction through a negative option feature unless the person:

• provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information;
• obtains the consumer's express informed consent before charging a credit card, debit card, bank account or other financial account; and
• provides simple mechanisms for the consumer to stop recurring charges.

The overlap with the vacated 2024 rule is close enough to be striking: disclosure before billing information, affirmative consent before charging, simple cancellation. What ROSCA does not supply is the specificity the rule would have added — how conspicuous, what form of consent, how simple — which is precisely the detail a legislative rule exists to furnish. The statute borrows its definition of a negative option feature from the Telemarketing Sales Rule at 16 CFR Part 310.

California Wrote the Design Standards Down

The most concrete deceptive-design rules in American law are not federal. They are in the CCPA regulations at section 7004, which set out five principles for methods of submitting requests and obtaining consent, each with worked examples.

Symmetry in choice. The path to a more privacy-protective option may not be longer, more difficult or more time-consuming than the path to a less protective one. The examples are unusually specific: a consent choice offering only “Yes” and “Ask me later” is not symmetrical because there is no option to decline, and a banner offering only “Accept All” and “More Information” (or “Preferences”) is not symmetrical because acceptance takes one step and the alternative takes more. The rule states the symmetrical version outright: “Accept All” and “Decline All.”

Avoid confusing language or elements. No double negatives — the rule names “Yes” or “No” beside “Do Not Sell or Share My Personal Information” as an example. Toggles labelled “on” or “off” may need clarifying language. Reversing the customary order of confirm and decline buttons at the moment the answer matters is given as confusing by design.

Avoid impairing choice architecture. Disruptive click-through screens before an opt-out can be submitted qualify. So does bundling: the rule's example is a location-based service that will not let a consumer consent to the necessary use of geolocation without also consenting to sale of that geolocation to data brokers.

Easy to execute. A business may not require a consumer to search or scroll through a privacy policy to find the opt-out mechanism after clicking the link. Knowing of but not remedying circular or broken links, or unmonitored or aggressively filtered inboxes, may itself violate the regulation, as may making a consumer wait unnecessarily while a request processes.

The consequence provision is what gives these teeth. Section 7004(b) states that a method not complying with subsection (a) may be considered a dark pattern, and that “[a]ny agreement obtained through the use of dark patterns shall not constitute consumer consent” — a business that used them “shall be in the position of never having obtained the consumer's consent.” The remedy is not a fine for bad design; it is the retroactive disappearance of the legal basis for everything done in reliance on that consent.

Section 7004(c) then settles the mental-state question. An interface is a dark pattern if it has the effect of substantially subverting or impairing user autonomy, decisionmaking or choice. Intent “is not determinative… but a factor to be considered”: a business that did not intend the effect but knows of it and does not remedy it may still have a dark pattern, and deliberate ignorance of an interface's effect “may also weigh in favor of establishing” one.

The Consent Definitions in the State Statutes

Outside California the mechanism is different and quieter. Rather than regulating design directly, the state comprehensive privacy statutes write dark patterns out of their consent definitions, so a deceptive interface does not produce a valid legal basis in the first place.

California's statutory definition at Civil Code 1798.140(h) is the template. Consent means a freely given, specific, informed and unambiguous indication of the consumer's wishes, and the section then excludes three things: acceptance of general or broad terms of use containing processing descriptions alongside unrelated information; hovering over, muting, pausing or closing a piece of content; and agreement obtained through dark patterns.

Delaware and New Jersey both carry that three-part exclusion almost verbatim. They also do something California's statute does not: both extend the definition of a dark pattern beyond their own text to incorporate federal practice. Delaware defines it as a subverting interface or “[a]ny other practice the Federal Trade Commission refers to as a ‘dark pattern.’” New Jersey's includes “any practice the United States Federal Trade Commission refers to as a ‘dark pattern.’”

That is an unusual drafting choice and worth noticing. It ties a state consent definition to an evolving federal characterisation rather than to a fixed statutory list — and it does so by reference to what the Commission “refers to,” language broad enough to encompass reports, business guidance and complaint allegations rather than only rules that survive judicial review.

Why the Vacatur Left an Uneven Map

The practical result of 2025 and 2026 is that deceptive interface design is regulated unevenly rather than uniformly, and the unevenness runs along an axis that has little to do with how harmful a given pattern is.

Two asymmetries follow from that table. The first is subject-matter: the federal instruments in force reach subscription and billing design, while the state instruments reach privacy choice design. A manipulative cookie banner and a manipulative cancellation flow are governed by different bodies of law with different remedies, and neither reaches the other.

The second is remedial. The federal route produces penalties and injunctive terms against a respondent. The California route produces something structurally different: consent that never existed, and therefore a missing legal basis for the processing that followed. A business can be entirely outside the FTC's rule-level reach and still find that the agreements it collected are void under section 7004(b).

There is also a timing asymmetry worth stating plainly. The Eighth Circuit's ground was that the Commission had not issued a preliminary regulatory analysis, not that the four requirements were beyond its authority. A procedurally sound rulemaking covering the same ground would not run into that holding, and the March 2026 advance notice is the Commission acting on that reading. It proposes no rule text, so whether a rule follows, what it would require, and when, are all unresolved.

What This Guide Does Not Cover

European approaches to deceptive design are not described here. The consolidated texts of the relevant instruments could not be retrieved during this research, and a regime is not worth summarising from memory when the whole basis of these guides is that a reader can open the source.

Nor is any count offered of how many FTC enforcement actions have rested on deceptive-design theories, or of what the resulting consent orders require. Those orders are individually public but there is no authoritative tally, and constructing one from press coverage would be exactly the kind of unverifiable synthesis these guides avoid. The two rulemaking documents cited above describe the Commission's rule-level position; the case-level position is not generalised from here.

Finally, this guide is about deceptive design as a general matter. The distinct rules that apply to interfaces directed at children sit under a different statute and a different rule, and are covered separately in our guide to children's privacy compliance.

Frequently Asked Questions