FTC Dark Patterns Enforcement: Design Choices as Violations

The 2022 staff report 'Bringing Dark Patterns to Light' catalogs the families: misleading design (fake countdown timers, disguised ads, false scarcity); hard-to-cancel structures (easy one-click enrollment, cancellation through phone trees and retention scripts); hidden costs (drip pricing, fees revealed at the last step); forced action and nagging (repeated prompts until users relent); interface interference (pre-checked boxes, visually dominant 'accept' against buried 'decline', confusing double negatives); and privacy-specific 'confirmshaming' and obstruction (making data-sharing the path of least resistance). The unifying test is effect on reasonable users: design that exploits cognitive bias to procure a choice the user did not intend, whether or not any single sentence is literally false, can be deceptive or unfair.

Epic paid $520 million total in 2022: $275 million in civil penalties for COPPA violations (collecting children's data without parental consent, default-on voice chat for minors), and $245 million in consumer redress for dark patterns, Fortnite's billing interface let a single accidental button press charge stored payment methods, used counterintuitive button mappings that converted preview actions into purchases, and made refunds hard while locking accounts of users who disputed charges. It matters for three reasons: scale (the largest FTC gaming action); theory (interface layout itself, not marketing copy, was the violation); and remedy design (the order requires affirmative consent for charges and bans locking accounts over disputed charges). Design teams, not just legal teams, became compliance owners that day.

The FTC adopted the amended Negative Option Rule in October 2024, requiring cancellation mechanisms as simple as enrollment ('click to cancel'), consent to the negative-option feature separate from the rest of the transaction, and disclosure basics, with most provisions slated for mid-2025 effect. In July 2025 the Eighth Circuit vacated the rule on procedural grounds, the Commission had skipped a required preliminary regulatory analysis, without reaching the merits. The practical landscape after vacatur: ROSCA still requires clear disclosure, informed consent, and simple cancellation for online negative-option plans (with civil penalties); Section 5 still reaches cancellation obstruction, the Amazon and Adobe litigation proceeds on exactly those theories; and states (California's automatic-renewal law and others) impose their own click-to-cancel requirements. Companies that built easy cancellation for the rule should keep it; the liability theories that motivated it never left.

Consent procured through manipulation is not consent, and both federal and state regimes now say so explicitly. The FTC treats manipulative consent flows as deception or unfairness, its health-data orders (BetterHelp, GoodRx) and COPPA matters examine how agreement was obtained, not just whether a checkbox existed. CCPA regulations expressly provide that consent obtained through dark patterns is invalid, and the CPPA's enforcement (including the Honda matter over asymmetrical opt-out flows) polices choice architecture directly; Colorado and Connecticut carry similar provisions. GDPR case law reaches the same end through 'freely given, specific, informed, unambiguous.' Design implications: symmetrical accept/decline prominence, no pre-ticked boxes, no consent walls for unrelated processing, and opt-out paths with the same step count as opt-in.

Treat it as a testable property, not a vibe. Inventory every money and data decision point: enrollment, checkout, consent, permissions, cancellation, deletion. For each, measure symmetry (steps, clicks, prominence, and friction to say no versus yes), honesty (are prices, terms, and data uses disclosed before commitment?), and reversibility (can users undo as easily as they did?). Red flags with enforcement pedigrees: cancellation requiring channels enrollment did not (Amazon), charges without affirmative consent per transaction (Epic), fees disclosed only at termination (Adobe), consent toggles that reset or nag, and 'confirm' buttons doing more than confirming. Document the audit and the fixes: in an FTC investigation, A/B tests and internal metrics become evidence, teams that measured 'retention lift' from added cancellation friction handed the Commission its exhibit list.