Avoiding Dark Patterns on Business Websites and Apps

What dark patterns are

The FTC's staff report Bringing Dark Patterns to Light (2022) describes dark patterns as "design practices that trick or manipulate users into making choices they would not otherwise have made and that may cause harm".

The CMA uses a wider term. Its paper Online Choice Architecture: how digital design can harm competition and consumers (2022) says "choice architecture is a neutral term": good design helps people "choose between suitable products" and "make transactions faster", but design can also "hide crucial information" or "set default choices that may not align with our preferences".

So the test is not whether a design persuades, but whether it deceives people or makes it hard for them to do what they want.

Which rules apply

• United States. The FTC report warns firms that "where these practices violate the FTC Act" or other laws, the FTC will act. For online subscriptions, the Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403, sets specific duties, covered below.
• United Kingdom. The Digital Markets, Competition and Consumers Act 2024 lists banned practices in Schedule 20, in force since 6 April 2025. The CMA can now decide itself whether consumer law has been broken and, in its words, fine businesses "up to 10% of global turnover".
• European Union. Article 25 of the Digital Services Act bans interfaces that deceive or manipulate users, but it applies to "providers of online platforms", such as marketplaces and social networks, and not to practices already covered by the Unfair Commercial Practices Directive or the GDPR. For an ordinary business website, those two laws are the ones that apply.

Fake urgency and scarcity

The FTC report lists these urgency and scarcity patterns:

• Baseless countdown timer: "a fake countdown clock that just goes away or resets when it times out";
• False limited time message: a deal "without a deadline or with a meaningless deadline that just resets when reached";
• False low stock message: "saying inventory is low when it isn't";
• False activity messages: claims such as "24 other people are viewing this listing" that are not true.

In the UK, Schedule 20 bans "falsely stating that a product will only be available for a limited time" in order "to elicit an immediate decision". In November 2025 the CMA opened investigations into, among other things, whether retailers' "time-limited sales ended when they said they would", and said it had reached no conclusions at that stage.

Real deadlines and stock levels are fine; a timer's offer must actually end at zero.

Hidden costs and drip pricing

The FTC report describes "drip pricing", where firms "advertise only part of a product's total price" and add "other mandatory charges until late in the buying process".

The CMA's price transparency guidance (CMA209) and its summary say:

• "It's illegal to hide additional fees, taxes or other charges that the customer will have to pay until later in the purchase process";
• a page on your website can be an "invitation to purchase", which must give "the total price of the product";
• the total should "normally include any unavoidable or 'mandatory' charges", such as a booking fee, delivery fee or VAT;
• a "from" price is allowed, for example for "photography services", if it includes mandatory charges and "does not mislead customers about what the price covers".

For service businesses, that means a "from" price on a service page must be a price someone can really get. Our e-commerce launch checklist covers prices at checkout, and our guide to showing prices on a service business website covers ranges, VAT and "from" prices.

Pre-ticked boxes and defaults

The CMA defines a default as "a predefined setting that the consumer must take active steps to change".

The FTC report lists two default tricks:

• Preselection: "preselecting a default that's good for the company, but not the user", such as add-ons like insurance or an extended warranty "automatically tacked on to a purchase";
• Sneak-into-basket: "automatically adding items to the shopping cart without a shopper's permission", or using "a pre-checked box".

The CMA's November 2025 investigations include retailers suspected of "automatically opting consumers in for optional charges". Leave optional extras, newsletter sign-ups and paid upgrades unticked, so people choose them.

Pressure, shaming and nagging

Wording and layout can push as hard as a timer. The FTC report names:

• Confirmshaming: "using shame to steer users away from certain choices", for example a decline link reading "No, I don't want to save money";
• False hierarchy: "using contrasting visual prominence" to steer people, such as a bright button for the option you prefer and a pale grey link for the other;
• Nagging: "asking repeatedly and disruptively", or offering only "Yes" or "Not Now" instead of "Yes" or "No".

The Digital Services Act names the same problems for platforms: "giving more prominence to certain choices" and "repeatedly requesting" a choice already made, "especially by presenting pop-ups". Label the decline option plainly, give both options similar weight, and remember a "no" for a sensible period.

Signing up and cancelling

The FTC report lists "roadblocks to cancellation": making it "easy to sign up but hard to cancel", for example letting people sign up online but "making them use another means to cancel", or hiding the cancellation phone number.

In the US, the Restore Online Shoppers' Confidence Act says a business charging for an online subscription must:

• disclose "all material terms of the transaction before obtaining the consumer's billing information";
• get the consumer's "express informed consent" before charging;
• provide "simple mechanisms for a consumer to stop recurring charges".

The Digital Services Act lists "making the procedure for terminating a service more difficult than subscribing to it" as a pattern the Commission may address. A good rule anywhere: if someone can sign up online, they can cancel online, in a similar number of steps. For app subscriptions, our guide to in-app purchases and subscriptions covers what Apple and Google require.

Privacy and cookie choices

The FTC report lists cookie and privacy tricks among its examples: "the accept tracking cookies box is prechecked", and "subverting privacy" by "tricking users into sharing more" information than they intended. Where the GDPR or UK GDPR applies, consent must be a real choice, so these patterns can make it invalid. Our guide to cookie consent banners covers equal "accept" and "reject" buttons and what regulators expect.

Checking your own site or app

Dark patterns often arrive one small change at a time. Walk through your main journeys as a customer would:

• from an advert or search result to a price: is the first price the real one?
• checkout or booking: is anything added that the person did not choose?
• every pop-up and banner: can it be declined in one plain step, and does it stay closed?
• signing up, then cancelling and deleting the account: are they comparable?
• every timer, stock count and "people viewing" message: is it true, and where does the number come from?

Test on a phone too. If you run experiments, our guide to A/B testing explains measuring real enquiries rather than clicks.

A checklist

• Every countdown, deadline and stock or activity message is true.
• Prices shown first include all mandatory fees and taxes; "from" prices are real.
• No optional extra, upgrade or sign-up is pre-ticked or added automatically.
• Decline options use plain words and similar weight to accept options.
• A refused prompt is not shown again on every page.
• Cancelling is as easy as signing up, through the same channel.
• Subscription terms are shown before payment details are taken.
• Cookie and privacy choices are equal, and nothing optional is on by default.

Frequently asked questions

What is a dark pattern?

The FTC describes dark patterns as design practices that trick or manipulate users into making choices they would not otherwise have made and that may cause harm.

Are countdown timers illegal?

Not if they are true. A timer for an offer that really ends at zero is fine. In the UK, falsely stating that a product or price is only available for a limited time to rush a decision is a banned practice, and the FTC lists fake timers that reset among dark patterns.

Can I show a 'from' price on my service pages?

Yes. The CMA's price transparency guidance allows an indicative or 'from' price, giving photography services as an example, as long as it includes mandatory charges and does not mislead customers about what the price covers.

Does the Digital Services Act apply to my business website?

Article 25 of the Digital Services Act applies to online platforms, such as marketplaces and social networks, and not to practices covered by the Unfair Commercial Practices Directive or the GDPR. For an ordinary business website in the EU, those two laws set the rules on misleading design and consent.

Do the same rules apply to mobile apps?

Yes. The FTC and CMA look at the design of websites and apps alike. Subscription apps must also meet Apple's and Google's store rules.

Planning a new website? Whoever builds it, the domain and your content should always be in your name, and our projects end with a short handover so your team can edit content. See our website development service and all our services, or email [email protected].