Consent Is a Design Problem

A dark pattern is an interface built to trick you into doing something you would not choose if you saw it clearly. The important shift is that this is no longer opinion. Since 2010 the field has a name, a taxonomy, a decade of research, and regulators who now fine specific interface choices. Consent stopped being a copywriting afterthought and became a design decision with legal weight.

Harry Brignull coined the term dark patterns in 2010 and started cataloguing them at what was darkpatterns.org and is now deceptive.design. That catalogue matters because it moved the argument off the ground of I feel manipulated and onto named, documented patterns anyone can point at. When a thing has a name and a definition, a design review can rule on it. That is the whole game.

The patterns have names, and names are power

Once you learn the taxonomy you cannot stop seeing it. These are not vague complaints. Each has a mechanism, a shape, and a reason it works on a distracted human. Here are the ones that show up most in the products I review.

Notice what unites them. In every case the interface makes the choice that benefits the business easy and the choice that benefits the user hard. That gap is the signal. Hold on to it, because it is also the test that separates a real dark pattern from ordinary friction, which I will come back to.

The mechanism is always the same trick played on attention. A distracted person reads the bold button, not the grey link. They accept the default, because changing it takes thought they did not come here to spend. Confirmshaming adds a pinch of guilt so the moment of doubt costs something. Roach motel spends its effort entirely on the exit, because the business already has what it wanted at the entrance. None of this relies on the user being foolish. It relies on the user being busy, which is everyone.

Regulators started naming and fining them

For years the only cost of a dark pattern was a bad reputation, and reputations recover. That has changed. Specific interface choices are now unlawful in specific places, not merely rude. Europe's GDPR requires that consent be a clear, affirmative act, which makes a pre ticked box legally void. The text is unusually direct about it.

Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

That one line outlaws a design pattern by name. It is why the pre checked marketing box quietly disappeared from compliant European signup forms. The Digital Services Act went further and bans deceptive design on large platforms outright. The California privacy law treats consent obtained through dark patterns as no consent at all. And the US Federal Trade Commission has moved from words to money.

Read those together and a pattern appears. Four different bodies, on two continents, independently arrived at the same idea: that the interface is the contract. It is no longer enough for a privacy policy to say the right thing while the buttons do the opposite. The law now looks at the screen the user actually touched, counts the choices it offered, and asks whether a reasonable person was steered. For a designer that is a strange kind of promotion. The pixels you place are now the thing being judged.

The cookie banner is the clearest live example. European enforcement bodies have repeatedly ruled that if a banner has a one click Accept all but hides Reject behind extra steps, the consent is not freely given and is therefore invalid. The regulator is reading the interface the way a designer would, counting the clicks on each path, and finding the design guilty. That is new, and every product team should feel it.

It is worth being precise about why the banner fails, because the reasoning is a design critique. Consent under GDPR must be freely given, which the regulators read to mean the easy path cannot be rigged toward yes. When accepting is one prominent button and refusing is a trek through a preferences screen with dozens of toggles, the two options are not offered on equal terms, so the yes is not a free choice. The fix is boring and specific: an Accept and a Reject of equal weight, at the same level, one click each. The lawful design and the honest design turn out to be the same design.

The asymmetry test

You do not need to memorise the whole taxonomy to catch most of this in a design review. You need one heuristic. Compare the two paths. If accepting takes one click and refusing takes four, that asymmetry is the pattern. A fair choice offers both options at roughly equal cost and equal prominence. When the effort is lopsided, the interface has already made the choice for the user and dressed it up as their decision.

The test works because it is measurable and hard to argue with. Clicks, taps, prominence and word count are countable. A team can say the accept button is more colourful because it is the primary action, but they cannot easily explain why declining needs a settings page, a second screen, and a scroll. The moment you frame the review as a click count on each path, the conversation stops being about taste.

Not every friction is a dark pattern

Now the part I want to argue against the crowd on. Calling every bit of friction a dark pattern weakens the term until it means nothing. A confirmation dialog before you delete an account is friction. So is a two step checkout, a password strength requirement, an are you sure on a destructive action. None of those are dark patterns. They are guardrails. If we label them the same as confirmshaming, we lose the word we need for the real thing.

This matters beyond pedantry. When a term covers everything, regulators and teams stop taking it seriously, and the genuinely harmful patterns hide in the noise. A designer who hears that all friction is evil learns to ignore the whole category, including the parts that are actually unlawful. Precision protects the term's force. So I am strict about it: friction is neutral, a tool, and the question is never whether friction exists but which way it points.

So the comparison gives you the intuition, but a review needs a rule you can apply in seconds. Here it is, reduced to two questions you can ask about any screen.

When someone asks you to build one

Most dark patterns are not shipped by villains. They are shipped by a designer under pressure from a target, who is told to lift opt in rates this quarter. So the useful skill is not moral outrage. It is knowing how to write the counter proposal in the language that pressure understands, which is business terms and risk.

Start with the legal exposure, because it is now concrete. A pre ticked consent box is not a growth tactic, it is void consent under GDPR and a fine waiting to happen. Then make the trust argument in numbers the team already respects. Dark patterns usually win the short A B test and lose the long game, because the metric they lift, an opt in, a signup, an accidental purchase, is measured in days, while the trust they spend is measured in refunds, cancellations, chargebacks and support load that show up later. A short horizon experiment can call a trap a success simply because it stopped counting too early.

That timing gap is the crux, so name it out loud in the room. An experiment that runs for two weeks sees only the upside of a deceptive default, never the downstream cost, because the cancellation and the angry review land in month two. The design that manipulates is optimised for the window the test happens to watch. This is not a deep dive into experiment design, but it is the one place the two subjects touch: a measurement horizon too short to see the harm will reliably reward the harm. If your only evidence is a fortnight of clicks, you have not measured trust at all.

Keep a house rule and reuse it every time. Present both choices at equal cost. Never pre tick consent. Make leaving as easy as joining. Say the price and the recurring charge before the card field, not after. None of this is radical. It is just the asymmetry test written down as a standard, so the next designer under pressure has something to point at that is not only their own conscience. Put it in the design system next to the button component, review every consent screen against it, and the fair version becomes the default nobody has to argue for twice.