State Dark Pattern Rules: How California, Colorado and Connecticut Void Manipulated Consent

Three Definitions Built on One Sentence

California, Colorado and Connecticut each define "dark pattern" in their comprehensive privacy statutes, and all three start from the same words: a user interface "designed or manipulated with the substantial effect of subverting or impairing user autonomy," decision-making or choice. What each legislature attached to that sentence is different, and the attachment determines where the working standard is found.

California's version at Civil Code section 1798.140(l) hands the detail to regulation. Colorado's, at section 6-1-1303(9) as printed in the 2024 Colorado Revised Statutes, carries no qualifier in the statute, although the Attorney General's rules supply one. Connecticut's, at section 42-515(14), looks outward to the Federal Trade Commission without saying which FTC documents count. Connecticut re-enacted its definitions section in Public Act 25-113, section 5, effective July 1, 2026; the dark pattern definition is still subdivision (14) and its wording is unchanged in the 2026 Supplement.

Consent That Never Existed

None of the three statutes contains a general prohibition on dark patterns. The rule sits inside the definition of consent, which each statute uses to mark when permission to process has been given. In all three, agreement obtained through a dark pattern is carved out of consent, alongside acceptance of broad terms of use and gestures such as hovering over or closing content.

California's consent definition in section 1798.140(h) also requires agreement "for a narrowly defined particular purpose" and ends: "Likewise, agreement obtained through use of dark patterns does not constitute consent." Colorado's, in section 6-1-1303(5), lists "[a]greement obtained through dark patterns" as the third thing that "does not constitute consent." Connecticut's, in section 42-515(7), excludes "(C) agreement obtained through the use of dark patterns," and Public Act 25-113 carried that subdivision forward without change.

The effect is to change the question an enforcer asks. It is less whether an interface was unfair in the abstract than whether a consent the statute requires was ever obtained. Where consent is a precondition to processing, as it is for sensitive data under Colorado's section 6-1-1308(7) and Connecticut's section 42-520, an interface within the definition leaves the processing without the permission the statute demands.

California: A Regulation Written in Examples

The CCPA regulations provide the detail section 1798.140(l) anticipates. Section 7004 of title 11 of the California Code of Regulations, in the text the Agency lists as effective January 1, 2026, requires methods for submitting CCPA requests and obtaining consent to follow five principles: easy to understand, symmetry in choice, no confusing language or interactive elements, no choice architecture that impairs choice, and easy to execute. Each principle comes with illustrations, and several of the less-quoted ones show how far the section reaches past cookie banners:

• an opt-out of sale or sharing that takes more steps than the same business's opt-in, counted from the click on the "Do Not Sell or Share My Personal Information" link to completion (§ 7004(a)(2)(A));
• a financial incentive program whose participation option is "selected by default or featured more prominently" than the choice not to participate (§ 7004(a)(2)(E));
• reversing a consistent "Yes" then "No" button order at the moment a question "would contravene the consumer's expectation" (§ 7004(a)(3)(C));
• a countdown clock saying "time is running out to consent" next to a discount that is not actually limited (§ 7004(a)(3)(E));
• a gas-price app that will not accept consent to necessary geolocation use without also taking consent to sell location data to data brokers (§ 7004(a)(4)(B)); and
• a business that "knows of, but does not remedy," broken links or unmonitored inboxes, or that makes consumers wait on a page or complete duplicative forms (§ 7004(a)(5)(B)-(C)).

Subsection (b) connects the principles to the consent rule. A method that does not comply with subsection (a) "may be a dark pattern," the illustrations are "a non-exhaustive list of dark patterns," and a business that used dark patterns to obtain consent to sell personal information "shall be in the position of never having obtained the consumer's consent to do so."

Subsection (c) addresses state of mind, which the statute does not. An interface is a dark pattern if it "has the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice." A business's intent "is not determinative ... but a factor to be considered," and where a business did not intend that effect "but the business knows of and does not remedy a user interface that has that effect, the user interface is still a dark pattern."

The concept now appears outside section 7004 as well. The risk assessment provisions list, among negative impacts on consumers, "requiring consumers to consent to processing when such consent cannot be freely given (e.g., because it was obtained through the use of a dark pattern)," and the provisions on requests to access automated decisionmaking technology state that request methods "must not use dark patterns."

The Agency has applied the symmetry principle in an enforcement decision. On March 12, 2025, it announced a Board decision requiring American Honda Motor Co. to pay $632,500 and change its practices. One of four allegations was that Honda used "an online privacy management tool that failed to offer Californians their privacy choices in a symmetrical or equal way." As quoted in the Connecticut Attorney General's 2025 report, the order found that "[w]hile Consumers can 'Accept All' cookies with one click, opting out of the cookies requires at least two clicks." Honda also agreed to consult a user experience designer about its request methods.

Colorado: Rules on Design, Timing and Withdrawal

Colorado's statute is spare, and the detail is in Part 7 of the Colorado Privacy Act Rules, 4 CCR 904-3. Rule 7.01 says Part 7 exists in part to clarify "the prohibition against obtaining agreement through the use of Dark Patterns." Rule 7.02 lists when consent is required: before processing sensitive data, before processing a known child's data, before selling, targeting advertising or profiling for significant decisions after the consumer has opted out, and before processing for purposes not reasonably necessary to or compatible with the original ones.

Rule 7.09(A) sets out nine design principles. Several have no close counterpart in California's section 7004:

• Emotional steering. Choices should avoid language or visuals that "unfairly, fraudulently, or deceptively coerce or steer" a decision. The rule's example pairs "I accept, I want to help endangered species" with "No, I don't care about animals."
• Defaults. Choices "should not be presented with a preselected or default option," including automatically selected checkboxes and radio buttons.
• Interruption. A consumer who declines should not be interrupted repeatedly in one visit, redirected away from the content sought, or made to navigate multiple pop-ups.
• Audience. "The vulnerabilities or unique characteristics of the target audience" should inform presentation, with examples for services used mainly by minors and by elderly users.
• Accessibility tools. If consenting takes two clicks on a website, "it should take no more than two actions for a Consumer using a digital accessibility tool to complete the same Consent process."

Rule 7.09(C) states the operative bar: controllers "shall not use an interface design or choice architecture to obtain required Consent" that has the substantial effect of subverting or impairing choice, or of "unfairly, fraudulently, or deceptively manipulating or coercing a Consumer into providing Consent," with the principles in paragraphs (A) and (B) serving as factors. Paragraph (B) allows controllers to consider other jurisdictions' dark pattern statutes, rules and guidance. Paragraph (E) closes off a familiar argument: "The fact that a design or practice is commonly used is not, alone, enough to demonstrate that any particular design or practice is not a Dark Pattern." Paragraph (F) confirms that consent obtained through dark patterns "does not constitute valid Consent."

Other Part 7 rules regulate the moments around a consent screen. Rule 7.03(B)(2) excludes "pre-ticked boxes, and other negative option opt-out constructions" from the clear affirmative action consent requires. Rule 7.05(B) bars a controller seeking consent after an opt-out from using "schemes that cause consent fatigue, such as interface dominating cookie banners, high frequency requests, cookie walls, pop-ups," and its example treats a pop-up seeking targeted advertising consent from a visitor who opted out through a universal mechanism as an invalid request. Rule 7.07(A) requires that consent can be refused or revoked "as easily and within a similar number of steps" as it is given. Rule 7.08 requires consent to be refreshed after 24 months without interaction, unless the consumer can update preferences through a user-controlled interface.

The rules cited here are the Attorney General's official text dated March 15, 2023. The Department's July 2025 proposed amendments, published for comment on its rulemaking page, proposed one addition to Part 7, a provision in Rule 7.03 on system design features used by minors, and no change to Rule 7.09.

Connecticut: A Statute and an Attorney General's Reading

Connecticut has no counterpart to section 7004 or Rule 7.09. Its dark pattern law is the two definitions above and a withdrawal rule. Section 42-520 requires a controller to "provide an effective mechanism for a consumer to revoke the consumer's consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer's consent," and on revocation to stop processing "as soon as practicable, but not later than fifteen days after the receipt of such request." In the text in force before July 1, 2026 that duty was subdivision (a)(6). Public Act 25-113, section 9, restructured the section, and in the amended version in the 2026 Supplement the same words appear at subparagraph (a)(1)(G).

Enforcement belongs to the Attorney General, who under section 42-525(a) holds "exclusive authority to enforce" the Act's core provisions. The office's updated enforcement report, dated April 17, 2025, describes how it has applied the dark pattern provisions. In fall 2024 it sent a cure notice sweep aimed at cookie banners and had identified more companies for a second sweep. The report states that the flagged banners violated the Act, "and likely CUTPA," by "failing to provide consumers with a symmetrical choice."

It describes two of them. One offered a prominently colored "AGREE" button, while opting out required clicking "SHOW PURPOSES," moving to a separate window, and finding preferences already set to opt in. The other stated that continued browsing meant acceptance and offered only "ACCEPT ALL COOKIES," plus a link to the general privacy policy with no opt-out.

The report then sets out what it calls informal guidance: a banner offering to accept all cookies "should also offer a symmetrical option to reject all cookies," with both "displayed on the screen at the same time, and in the same color, font, and size." A footnote states that the guidance "does not confer any rights on any person and does not operate to bind the OAG or the public." The report's footnotes cite section 42-520's revocation provision, the CPPA's Honda order, CPPA Enforcement Advisory No. 2024-02, and the FTC staff report "Bringing Dark Patterns to Light."

Where the Three Diverge

The differences are less in the definitions than in how much each state has written around them. California's regulation is organized by principle and reaches request methods as well as consent, so a high-friction opt-out page is within it even when no consent is sought. Colorado's rules are directed at consent interfaces and add limits on when and how often a controller may ask. Connecticut relies on the statute and on guidance its Attorney General describes as non-binding, with the FTC reference as its one open-ended element.

Some matters fall outside this comparison. Other state statutes with similar definitions, including Delaware's and New Jersey's, are discussed in our dark patterns guide and are not charted here. California's Agency lists preliminary rulemaking activity titled "Reducing Friction in the Exercise of Privacy Rights," whose preliminary comment period closed on April 6, 2026, and its regulations page states that it has no proposed regulation packages at this time, so there is no draft text to compare.

Frequently Asked Questions