Key Takeaways
- “Dark patterns” (interfaces designed to nudge users into decisions they wouldn’t otherwise make) are no longer a purely ethical concern. They’re a regulatory one.
- The FTC’s click-to-cancel rule and the EU’s Digital Services Act now impose real penalties on flows that make cancellation, opt-out, or consent unnecessarily difficult.
- Common offenders include: subscription cancellation flows with more steps than sign-up, pre-checked consent boxes, roach-motel account deletion paths, and misleading urgency cues.
- Fixing these before enforcement arrives is meaningfully cheaper than fixing them after. And the sites that fix them tend to convert better, not worse, once the manipulative friction is removed.
- The test worth applying: would a regulator reading your flow the way a skeptical user would find anything to object to?
A few years ago, “dark patterns” was the sort of phrase you’d hear at UX conferences and industry meetups. Designers and usability practitioners argued about it in blog posts. Ethical brands made noises about avoiding them. Meanwhile, plenty of large consumer sites kept using them, because they worked, and because there was no real cost to using them.
That cost has now arrived. Over the last eighteen months, regulators on both sides of the Atlantic have moved from strongly-worded guidance to actual enforcement, and the design decisions that used to be a matter of company values are now a matter of company liability.
This post is a quick look at what changed, what’s now genuinely risky, and what to do about it if you haven’t looked at your own site’s flows lately.
What actually changed
Two regulatory moves are worth knowing about specifically.
The FTC’s “click-to-cancel” rule, finalized in late 2024 and now in active enforcement, requires that cancelling a subscription must be at least as easy as signing up for one. If a customer can subscribe with two clicks online, they must be able to cancel with two clicks online. No mandatory phone calls, no navigating through five screens of retention offers, no chat queues designed to time-out inactive users.
The EU’s Digital Services Act (DSA), fully in force across the region, prohibits design that “deceives or manipulates” users, with explicit callouts for pre-checked consent boxes, misleading prominence of options, and repeat prompting for choices the user has already made. Penalties can reach 6% of global annual turnover for large platforms.
Neither regulation is aimed solely at giants. Both apply to consumer-facing sites that serve users in those jurisdictions, and both have been used against smaller operators as test cases. If you have US or EU customers and you run subscription, consent, or account flows on your site, these apply to you.
The offenders you’re most likely to have
Most sites don’t set out to be manipulative. The dark patterns creep in gradually, usually as small optimizations that each seemed reasonable at the time. The most common ones seen in audits include:
- Cancel flows longer than sign-up flows. The classic example. Customer signs up in three clicks; cancelling takes seven screens, three retention offers, and a phone call. Now explicitly regulated in the US.
- Pre-checked consent boxes. Boxes for marketing consent, data sharing, or newsletter opt-in that are checked by default. Explicitly prohibited under the DSA and under most modern privacy regimes; also poor practice under longstanding US guidance.
- Roach-motel account deletion. Making it easy to create an account and effectively impossible to delete one. Common on older platforms; increasingly a source of complaints and regulator interest.
- Confirmshaming. Opt-out language written to make users feel bad for declining. “No thanks, I don’t want to save money.” While it may read as clever copywriting internally, it reads as manipulation to a regulator.
- False urgency cues. Fake countdown timers, fabricated stock scarcity (“only 2 left!” when there are 200), or fake activity indicators (“3 people are viewing this now”). Increasingly scrutinized by both the FTC and EU regulators.
- Cookie banners that make “accept all” one click and “reject all” three. Any consent flow where the manipulated choice is easier than the neutral one now falls squarely inside the DSA’s definition of manipulation.
Why fixing this is good business, not just legal hygiene
The counterintuitive thing that keeps coming out of site audits is that the sites that clean these patterns up tend to convert better afterwards, not worse.
Manipulative friction produces short-term compliance and long-term resentment. Users who feel coerced into subscribing cancel harder when they eventually do; users who feel tricked into consent are the ones who leave one-star reviews and file complaints. Users who found the flow honest and easy are the ones who convert, stay, and refer.
The economics of dark patterns almost always look worse than they seem once you factor in the churn, the support tickets, the chargebacks, and the reputational drag. Fixing them isn’t a favor to your users; it’s a favor to your overall business health.
What to actually do
If you haven’t looked at your own site’s flows through this lens recently, three practical things worth doing:
- Do a cancellation audit. Count the clicks from your sign-up flow. Count the clicks from your cancellation flow. If cancellation is longer, that’s your fix.
- Do a consent audit. Check every place your site asks for consent (cookies, marketing opt-in, data sharing, newsletter). If “accept” and “decline” aren’t equally easy, they need to be. If any boxes are pre-checked, they need to not be.
- Do a skeptical read. Have someone who doesn’t work for the company walk through your site’s most critical flows (sign-up, checkout, cancellation, account settings) with a single question: is anything here trying to nudge me toward a choice I wouldn’t otherwise make? Anywhere the answer is yes deserves a second look.
The regulatory environment on this is unlikely to loosen. If anything, enforcement will get stricter over the next few years as regulators build case law and audit patterns. Sites that address these patterns before enforcement arrives will do so on their own timeline and their own terms. Sites that wait will address them under external pressure, which tends to be more expensive and less thorough.
It’s a good time to look at your flows. Better now than after a complaint.
About the author
Neil Fraser leads digital strategy at STIR, helping clients translate brand positioning into websites and digital experiences that actually convert. He works across discovery, UX, and build, with a particular focus on the details that quietly determine whether a site earns its keep, and, increasingly, whether it stays on the right side of regulators.
