Deceptive patterns, formerly known as dark patterns

Last Wednesday I gave a talk at Ping, Bekk’s student conference in Trondheim. The title was “Nei takk, jeg vil ikke spare penger”, which is Norwegian for “No thanks, I do not want to save money”, and if that sounds familiar it is because you have seen it many times. It is the grey link under the big blue button below, so common in a lot of digital services these days. Such patterns in design have a name: deceptive patterns, formerly known as dark patterns, and below is a rundown of what we talked about.

Bad UX or dark pattern?

A button nobody can find is bad UX. It hurts the user and it hurts the business, so it gets fixed as soon as someone notices. A dark pattern is a different animal. It is design making it cheap to say yes and expensive to say no. This is bad for the user and profitable for the business, thus the temptation of both designing it so and leaving it in.

Persuasion in itself is fine. Informing and persuading people is a large part of my job too, and good marketing and design is persuasive. Even a nudge is fine, as long as it meets the three conditions Richard Thaler, the economist that wrote the book Nudge, set for it:

• Everything is visible.
• Saying no is as easy as saying yes.
• The nudge is good for the one being nudged, not only for the one nudging.

But break one of the three and you have crossed the line.

Harry Brignull, a UX designer with a PhD in cognitive psychology, gave us the dark pattern name in 2010 when he started darkpatterns.org. In 2023 Brignull renamed his subject deceptive patterns, since “dark” makes them sound cooler than they are.

Why they work

Daniel Kahneman describes our mind as two systems. System 1 is fast, automatic and always on. It reads colour before it reads text, and it taps where things are big and blue. System 2 is slow, lazy and expensive to run. It reads the terms, it likes a pause, and it only wakes up when something feels off. A good dark pattern is designed so that nothing feels off. The grey text is never hidden, it is simply not worth System 1’s attention, and System 2 never gets the call.

Six patterns from real sites

Confirmshaming

McAfee, the antivirus for Windows, asks for your email address before you get to the download and gives you two options: “Yes, I want the benefits” and “No, I like paying full price”. Declining takes a whole sentence instead of a word, and to click it you have to feel like an idiot for half a second. Robert Cialdini showed that we act in line with who we think we are, and Jonathan Haidt that the feeling arrives before the reasoning does. Luguri and Strahilevitz tested dark patterns on 1 963 Americans in 2021. The mild patterns doubled acceptance, from 11 to 26 percent, and nobody got annoyed. The aggressive patterns nearly quadrupled it, but then people got angry and left. The mild ones are the dangerous ones, because nobody complains.

False hierarchy

Foodora’s cookie dialog has a big blue “Accept all” button next to a “Save settings” button that looks disabled. Nothing is hidden and every choice is there, they just do not weigh the same. The brain sorts on colour and size in under 250 milliseconds, long before you have read a word. Paul Fitts wrote in 1954 that a big target close to your thumb is hit faster than a small one in the corner. The growth team read the paper in 2019 and turned it upside down. The European Data Protection Board calls this visual interference and says flat out that it undermines consent under GDPR.

Preselection

Gjensidige and McAfee tick the boxes for you. The only box left unticked is “I have read the terms”. Johnson and Goldstein’s 2003 study of organ donors has the best graph I know on the subject. In countries where you have to opt in, between 4 and 28 percent are donors. In countries where you have to opt out, between 86 and 100 percent are. Denmark has 4 percent and Austria 99, and it is not because Austrians are nicer people. Changing something takes a decision, while leaving it alone takes nothing, so it stays. A pre-ticked insurance at 79 kr is the same experiment run on you. Pre-ticked consent has been illegal in the EU since the Planet49 ruling in 2019, and it still shows up everywhere.

Roach motel

Roaches check in, but they do not check out. Joining Viaplay takes two steps and about 30 seconds. Leaving takes multiple steps while they try to wheel you back in. Thaler himself wrote an editorial in Science in 2018 called “Nudge, not sludge” to distance himself from this kind of thing. After five steps you have invested time, so you take the offer rather than waste them. The roach motel only has to win today, since every day you postpone another 129 kr goes out. DellaVigna and Malmendier found gym members paying an average of 17 dollars per visit because they never got around to cancelling. The paper is called “Paying not to go to the gym”.

Drip pricing

Every airline does this. The ticket costs 199 kr. Then comes a service fee, a booking fee, a delivery fee and a payment fee, and you land on 339 kr. The price you saw is not the price you pay, but by now you have spent six minutes on the booking. The first number becomes the anchor, so the brain compares 339 with 199 and not with the competitor who said 329 up front. StubHub tested drip pricing against showing the full price from the start, and drip gave 21 percent more revenue per user. So they know what they are doing. Gjensidige forgets to mention the traffic insurance tax. The EU and the Norwegian Consumer Authority checked 399 web shops in 2023 and found manipulative practice in 148 of them, with hidden costs and fake countdowns among the most common.

Fake scarcity, fake urgency and fake social proof

Three patterns in one screenshot, which is how they show up in real life too. “Only 1 room left!”, “23 people are looking at this right now” and “Offer ends in 09:59”. Reload the page and the countdown starts from ten minutes again. The 23 is a random number between 12 and 40. The last room has always been the last room. Princeton found the same, plus plugins where the shop picks the interval itself. A loss weighs about twice as much as an equal gain, and “missing out” is a loss while “not buying” is neutral. The designer picks which one you feel. Scarcity and social proof were sensible shortcuts on the savannah, and they still are in a shop with a real stock room. Online the stock is a number in a database, and faking it costs nothing.

We still have nagging, sneak into basket, trick questions (“do not untick if you do not wish to not receive offers”), privacy zuckering any many more. Take a look at over at deceptive.design.

How a dark pattern gets born

No designer wakes up one morning wanting to manipulate anyone.

In release 14 the designer moves “no” under the button because it looks cleaner. The A/B test says plus 9 percent conversion, statistically significant, and everyone cheers. The Q3 OKR says 12, so the PM asks if the no-button could be a little smaller. In release 19 the no is grey text reading “No thanks, I do not want to save money”, and that gives another 4 percent. In Q4 the bonus arrives. Every small step makes a little sense on its own, but in the end we’re left with a deceptive user experience. And that is an organizational failure.

Goodhart’s law explains why it keeps happening. The business wants happy customers who complete their purchase, so we optimize for conversion, and when a measure becomes a target it stops being a good measure. The dashboard shows plus 9 percent. It does not show the regretted purchase that never gets returned, the subscription cancelled after two years of irritation, the friend who has to listen to a rant, or the room full of students at Ping who just saw the brand’s sign-up flow on a slide.

It is not necessarily legal either

Article 25 of the DSA bans interfaces that mislead or manipulate choices, for online platforms in the EU and EEA. GDPR requires consent to be freely given and active, and the EDPB guidelines from 2022 list the patterns by name. The Norwegian Marketing Control Act bans misleading and aggressive practice and requires the total price up front, and the Consumer Authority has gone after ticket sellers for drip pricing. Next up is the Digital Fairness Act, the Commission’s proposal expected in 2026, with dark patterns explicitly on the list.

It costs, too. Epic Games paid 245 million dollars in 2022 because Fortnite let kids buy with one tap and made it easy to tap wrong. That was the first time the FTC wrote “dark patterns” in a settlement. Amazon paid 2.5 billion in 2025 for a Prime sign-up with false hierarchy and a cancellation flow they internally called “Iliad”, and 1.5 billion of that goes back to the customers. Under the DSA the maximum fine is 6 percent of global turnover, and TikTok and Meta already have formal cases open where deceptive design is part of the grounds.

Tips to avoid misleading your users

We’ll end with some tips on how we can do better as developers, designers or business people:

• Ask who profits. If the answer is only “us” rather than “the user”, stop.
• Run the symmetry test. Leaving should be as easy as joining. “No” as easy as “yes”, and “reject all” as easy to find as “accept all”. Count the clicks. Swap the button colours in a test, and if conversion drops, the design was doing the selling.
• Read the microcopy out loud. Confirmshaming, double negatives and pre-ticked boxes expose themselves when spoken.
• Do not lie with numbers and time. And not lying to users is a good tip in general.

If you would be embarrassed to explain how a feature works, you are probably looking at a dark pattern.

So what do we do?

What do we do, as consultants, developers and designers, when the business side turns up with a dark idea? The students in the room have not sat in that meeting yet. They will, in about two years. So I ended the talk where it started, with the newsletter sign-up from the first slide, this time drawn with two buttons of equal weight.

We take the user’s side and make a good product instead. “No thanks” should be a perfectly fine answer.