Rules
Dark Patterns vs Persuasion: Where US Regulators Draw the Line
Dark patterns vs persuasion in US law: the FTC, state privacy rules and what a compliant disclosure must contain before a charge, plus penalties and refunds.
What to take away
- Dark patterns hide, bundle or force a choice. Lawful persuasion states the terms and lets the buyer decline.
- The FTC treats dark patterns as unfair or deceptive acts under Section 5 of the FTC Act; state attorneys general can sue on the same conduct.
- A compliant disclosure names the material terms before payment, in readable type, and apart from unrelated agreements.
- Federal negative option rules require a cancellation path at least as simple as the path that enrolled the customer.
- California and several other states add consent, notice and retention duties on top of federal law.
- Non-compliance usually ends in a consent order, refunds and civil penalties, not a warning letter.
Who draws the line: the FTC, state attorneys general and state privacy agencies
Dark patterns and persuasion describe the same design tools pointed in different directions. Harry Brignull, a researcher who coined the term in 2010, catalogs the recurring ones.
His list includes roach motel, where signing up takes one click and canceling takes a phone call, and confirmshaming, which labels the decline link with a guilt trip such as "No thanks, I like paying more."
Persuasion has a documented toolkit too. Robert Cialdini's "Influence," first published in 1984, names reciprocity, commitment and social proof. The book also covers authority, liking and scarcity.
None of those principles is illegal. A real deadline and a verified subscriber count inform a buyer. A countdown that resets on every page load misleads one.
Regulators test three things: whether the material terms appear before payment, whether consent is affirmative and unbundled, and whether canceling is as easy as signing up.
An FTC staff report in September 2022, "Bringing Dark Patterns to Light," named false urgency, confirmshaming and hard-to-cancel traps.
The Federal Trade Commission is the primary federal enforcer for deceptive interface design. Its authority rests on Section 45 of the United States Code, which bars unfair or deceptive acts or practices in or affecting commerce. That sentence reaches checkout flows, trial offers and cancellation screens.
The test has two prongs. A practice is deceptive when a material statement or omission is likely to mislead a reasonable consumer. It is unfair when it causes substantial injury a buyer cannot reasonably avoid, and no offsetting benefit justifies it.
State attorneys general enforce their own consumer protection statutes and often act sooner than the FTC does. California adds a second layer through the CCPA and its amendments, which the California Privacy Protection Agency enforces. Colorado, Connecticut, Virginia and Texas have privacy laws of their own, each with its own consent standard.
What a compliant disclosure contains
A lawful disclosure puts the material term in front of the buyer before money moves. It uses ordinary words, readable size, and is not detached from the consent it describes.
Compliant Disclosure Checklist
- Amount, frequency, renewal date above pay button
- Affirmative consent separate from other agreements
- Cancellation method via enrollment channel
- Contact address, phone or email in offer
- Contact details repeated on receipt
A pre-checked box or a fee at the final step is what regulators call a dark pattern: an interface that pushes people into an action they did not intend.
| Element | What it must contain | Where it belongs |
|---|---|---|
| Terms | The amount of each charge, how often it recurs, and the renewal date | Directly above the payment button |
| Consent | An affirmative step the customer takes, kept apart from other agreements | At the point of sale |
| Cancellation | The method for stopping the charge, using the channel that enrolled them | On the confirmation page and each receipt |
| Trial conversion | The date the free period ends and the price that follows | Next to the free-trial claim, not in a footnote |
| Contact | A mailing address, phone number or email for questions | In the offer and the receipt |
The FTC's .com Disclosures guide, issued in 2013, states that a disclosure a phone user cannot see or read is not a disclosure. Placement matters as much as wording.
Consent rules assume a buyer who reads and weighs what a seller states. Informational influence ethics covers what a listener is owed when they rely on a claim.
Records to keep
A business should be able to reconstruct what a customer saw and agreed to. Keep:
- The exact screen copy and layout shown at sign-up
- A timestamped record of the consent action
- Every renewal notice sent before a charge
- The confirmation sent when a customer cancels
- Cancellation requests and the date each was honored
- A log of complaints and how each was closed
What happens if you do not comply
The FTC seldom sends a warning first. It files a complaint and settles on a consent order that bans the practice, orders refunds, and requires compliance reporting for years.
The Epic Games case shows the scale. In December 2022 the agency announced a $520 million settlement over Fortnite, including a $275 million civil penalty for children's privacy and a $245 million refund pool over purchase flows the FTC called deceptive.
Vonage paid $100 million in November 2022 over subscriptions that were easy to start and hard to stop. The FTC's case against Amazon over the Prime cancellation flow ended in a $2.5 billion settlement in September 2025: $1 billion in civil penalties and $1.5 billion for refunds.
California's 2022 action against Sephora over opt-out signals ended in a $1.2 million civil penalty, a corrective plan and an order to honor those signals.
The FTC's Negative Option Rule, known as click-to-cancel, set a federal standard for subscriptions before a federal appeals court vacated it in 2025. The agency has said it will keep pursuing the same conduct case by case under Section 5 and the Restore Online Shoppers' Confidence Act.
Sellers learn the same lesson each time: small permissions compound, and disputes begin with a click nobody remembers making. Commitment and consistency sets out what decides whether a yes holds up.
Where the rules differ by place
California requires businesses to honor opt-out preference signals and limit use of sensitive personal data, while Colorado and Connecticut require consent before processing sensitive data.
California's CCPA took effect on January 1, 2020, and the CPRA amendments took effect on January 1, 2023. The California Privacy Protection Agency began enforcing on March 29, 2024.
Virginia's Consumer Data Protection Act took effect on January 1, 2023. Colorado's Privacy Act and Connecticut's Data Privacy Act both began on July 1, 2023. Texas started enforcing its Data Privacy and Security Act on July 1, 2024.
Those laws give residents a right to appeal a denied request. Several state consumer protection statutes allow private lawsuits, a remedy the FTC Act does not create. Timing also differs: some attorneys general publish guidance first; others file without notice.
Example: a trial offer that failed on three counts
Take an illustrative trial page. It advertises a free month in large type, mentions the renewal only in a footnote, and pre-checks a box for a second product. Three failures appear at once: a buried material term, bundled consent, and a missing cancellation number.
A compliant version states the renewal price next to the free month, leaves the second product unchecked, and prints the cancellation line on the receipt.
Trial Offer Failures
Compliant
- Material term
- Prominent
- Consent
- Separate
- Cancellation
- On receipt
Illustrative Failure
- Material term
- Buried in footnote
- Consent
- Pre-checked box
- Cancellation
- Missing number
Testimonials add a second risk when they read like editorial content. FTC guidance on native advertising requires that paid placements be identifiable as advertising. A truthful count of subscribers is a fair claim, and social proof ethics examines what a number owes the reader who trusts it.
Common questions
Where exactly do regulators draw the line?
At three points: material terms before payment, affirmative consent kept apart from other agreements, and an exit as easy as signing up. A design that passes all three can still push hard and stay legal.
Does a pre-checked box count as consent?
No. Regulators treat a pre-selected option as the business choosing for the customer. Consent has to be an affirmative step the buyer takes, and it cannot be bundled with unrelated terms.
Can a subscription renew without a reminder?
It can, when the terms were disclosed clearly at sign-up and the cancellation path is simple. Renewal notices help, but they do not repair a disclosure that was buried at the start.
Is persuasion itself a problem?
No. Persuasion that informs a buyer and design that deceives a buyer are treated differently. The FTC targets hidden terms, false urgency and forced consent, not persuasive writing.
Does guidance from a state attorney general carry the weight of law?
Not on its own. The statute binds, and guidance signals where an office intends to look. Authority compared with expertise separates that formal power from a reputation for toughness.
