Dark Patterns.

Deceptive user-interface designs that nudge or trick users into actions against their interest — over-broad consent, hidden cancellations, sneak-in opt-ins — increasingly regulated under GDPR Article 5, the EU DSA, and U.S. FTC Click-to-Cancel rules. It belongs to the Privacy & Data Protection category of cybersecurity.

Deceptive user-interface designs that nudge or trick users into actions against their interest — over-broad consent, hidden cancellations, sneak-in opt-ins — increasingly regulated under GDPR Article 5, the EU DSA, and U.S. FTC Click-to-Cancel rules.

Dark patterns is a term coined by UX researcher Harry Brignull in 2010 for user-interface designs that deceptively nudge users into actions counter to their own interest, such as accepting tracking, buying more, or staying subscribed. Common patterns include 'confirmshaming' opt-out wording ('No thanks, I don't want better deals'), pre-checked consent boxes, asymmetric button styling that makes 'Accept all' visually dominant, hidden costs revealed only at checkout, and 'roach motel' subscription flows where signup takes one click and cancellation takes a phone call. Regulators have moved from soft guidance to enforcement: the European Data Protection Board's 2022 dark-patterns guidelines apply GDPR Article 5(1)(a) fairness and transparency obligations; the EU Digital Services Act explicitly prohibits dark patterns for very large online platforms; the U.S. FTC's 'Click-to-Cancel' rule (2024) requires that cancellation be as easy as subscription; the California Privacy Protection Agency adopted dark-patterns regulations in 2023. From a privacy-engineering perspective, dark patterns are now both an ethical and a regulatory risk and increasingly a vector targeted by competitor reports, NGO-led audits, and class-action plaintiffs.

Defences for Dark Patterns typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Deceptive design, Sludge patterns.