Dark Pattern Regulation

Dark patterns — interface design deliberately built to manipulate users into decisions they wouldn't otherwise make — used to occupy a legal gray zone. In 2026, that gray zone has narrowed considerably on both sides of the Atlantic, with specific, enforceable rules now targeting the most common patterns directly.

The FTC's click-to-cancel rule

The FTC's "Click-to-Cancel" rule, finalized in late 2024, began enforcement through 2025 and into 2026. The core requirement is straightforward and specific: cancelling a subscription must be as easy as signing up for it. The rule directly prohibits deceptive design intended to trap users into subscription, auto-renewal, or free-to-paid conversion flows they didn't clearly consent to or can't easily exit.

The FTC's broader regulatory framework for dark patterns rests on three pillars — transparency, simplicity, and accountability — and subscription services specifically are required to provide cancellation mechanisms that mirror the ease of the original sign-up process. Practically, this means a service that lets someone sign up in two clicks but requires a phone call, a multi-step retention flow, or a buried settings menu to cancel is now operating in clear violation territory, not just a design choice with murky legal standing. The FTC treats dark patterns as a form of deceptive or unfair trade practice under Section 5 of the FTC Act, which gives the agency a well-established enforcement mechanism rather than needing new dedicated dark-pattern legislation to act.

The EU has moved beyond cookie banners

EU regulation around dark patterns has broadened considerably past its original focus on cookie consent banners. The Digital Markets Act (DMA) and Digital Services Act (DSA), both in effect since 2024-2025, extend the scope significantly: the DMA prohibits large "gatekeeper" platforms from using dark patterns in any form across their services, and the DSA mandates fair and transparent interface design more broadly across digital services generally, not just for a specific category of consent flows.

Under GDPR, consent must be freely given and genuinely informed — which means dark patterns that obscure an opt-out option, pre-select consent by default, or otherwise nudge users toward consenting through interface manipulation can invalidate that consent entirely, exposing the company to GDPR enforcement independent of any dark-pattern-specific rule.

A further layer is arriving through updates to the Consumer Rights Directive, which needed to be transposed into national law across EU member states by December 19, 2025, and applies starting June 19, 2026 — adding another enforceable layer specifically targeting deceptive commercial practices in digital interfaces.

The Digital Fairness Act is the next front

Beyond the DMA, DSA, and Consumer Rights Directive updates, the EU's proposed Digital Fairness Act specifically targets dark patterns as a distinct regulatory category, aiming to close gaps that existing consumer protection and platform regulation don't fully cover. This signals the EU's direction is toward increasingly specific, purpose-built dark pattern regulation rather than relying solely on broader consumer protection or platform rules to cover manipulative design indirectly.

What actually counts as a dark pattern under current enforcement

The patterns drawing the most direct regulatory attention in both the US and EU: asymmetric cancellation flows (easy to sign up, hard to cancel), pre-checked consent boxes, confirmshaming (guilt-tripping language on decline buttons), hidden costs revealed only late in a checkout flow, and countdown timers or artificial scarcity claims not grounded in reality. Not every persuasive design technique counts as a prohibited dark pattern — the regulatory line generally sits at design that actively obscures information, reverses a user's clear intent, or creates asymmetric friction between opting in and opting out.

The enforcement numbers that make this concrete

The abstract regulatory frameworks above translate into genuinely large financial penalties, which is worth understanding for anyone assessing how seriously to take compliance. The FTC's Amazon Prime settlement, finalized in September 2025, is the largest dark-patterns enforcement action on record at $2.5 billion total — $1 billion in penalties plus $1.5 billion in consumer refunds — brought specifically over a cancellation flow the FTC characterized as a deliberately confusing multi-page, multi-step process designed to discourage users from completing it. That's the exact pattern the click-to-cancel rule now directly prohibits, and the size of the settlement is a strong signal of how the FTC intends to treat similar violations going forward.

Other recent cases give a sense of the range: Epic Games paid $245 million over confusing, inconsistent button configurations that tricked Fortnite players into unwanted purchases; Publishers Clearing House paid $18.5 million over misleading sweepstakes-entry claims; and Credit Karma paid $3 million for dark patterns that misrepresented users as "pre-approved" for credit offers they weren't actually guaranteed to receive. Combined, FTC dark-pattern cases have produced more than $2.9 billion in penalties and consumer refunds since the agency's enforcement push began in 2022 — and on the state level, California's Attorney General issued a $12.75 million CCPA settlement against General Motors in January 2025, built partly on dark-pattern consent-flow violations, showing that state privacy regulators are pursuing this alongside the FTC, not leaving it solely to federal enforcement.

Practical compliance guidance

• Audit your cancellation flow specifically against the FTC's click-to-cancel standard — this is the single most concretely enforced rule right now, with a clear, testable requirement (cancellation ease must mirror sign-up ease).
• Review consent flows for pre-checked boxes or default opt-ins — both US and EU enforcement treat these as invalidating consent, not just poor practice.
• If you operate in the EU, track the Consumer Rights Directive's June 2026 application date and the evolving Digital Fairness Act — this is an actively expanding regulatory area, not a settled one.
• Treat dark pattern compliance as an ongoing design review process, not a one-time audit — enforcement scope and specific prohibited patterns are still being clarified through both new legislation and case-by-case enforcement actions.

Sources: Cookie-Script — Dark Patterns 2026: The FTC's New Click-to-Cancel Rule, Pandectes — Dark Patterns in 2026: What the FTC's New Rules Mean, Osborne Clarke — Digital Fairness Act Unpacked: Dark Patterns, PageAuditors — FTC Dark Pattern Fines: $245M+ Enforcement Cases (2026), PrivacyTerms — Dark Patterns 2026: Prevalence, Fines and Cases