Dark patterns: what regulators penalize in 2026

In September 2025, Amazon agreed to pay 2.5 billion dollars to settle a lawsuit brought by the US Federal Trade Commission. The complaint was neither about a defective product nor about a data breach: it was about the design of a few screens. The Prime sign-up flow pushed people into a subscription without saying so clearly and the cancellation flow was so convoluted that the teams had nicknamed it internally the « Iliad », after Homer's epic about a ten-year war. A handful of interface decisions turned into one of the largest settlements in the agency's history.

These screens have a name. They are called dark patterns, or deceptive interfaces. They are design choices built not to help the visitor but to push them into doing what they would not have done had they truly had the choice. Long tolerated as mere conversion tricks, these practices are sliding in 2026 into a high-risk zone, legal first and reputational next.

This article covers the whole question: what a dark pattern actually is and where the line with legitimate persuasion runs, the main families you can spot on any site, the regulatory wall rising on both sides of the Atlantic, Google's real position (more nuanced than people claim) and above all why a site that converts honestly earns more over time than one that manipulates.

The term dates back to 2010. Designer and cognitive scientist Harry Brignull coined it to describe a precise category of interfaces: those built, with a real grasp of human psychology, to serve the company's interest against the user's. Fifteen years on, his catalogue of deceptive patterns (opens in a new tab) has been adopted by regulators, academics and consumer associations around the world.

The whole difficulty lies in one boundary. Highlighting a button, writing a convincing argument, reminding people that a promotion really does end on Sunday: that is persuasion and it is perfectly legitimate. Deceptive design begins elsewhere, the moment the interface strips the visitor of their ability to decide freely and in full knowledge. So the test is not « does it convert? » but « does the visitor understand what they are doing and could they choose otherwise just as easily? ».

This distinction is not just a matter of ethics. It has become the legal criterion. European law does not punish selling well, it punishes distorting a decision. Persuasion leaves the choice intact, manipulation takes it away. Everything that follows flows from that line.

Research has catalogued dozens of variants but the essentials fall into a handful of families. Recognizing them is the first step, because we have seen them so often that they look normal.

The main families of dark patterns and their concrete translation on a site

One area alone concentrates most of these families: the cookie banner. That is why the European Data Protection Board (EDPB) devoted dedicated guidelines (opens in a new tab) to it, adopted in February 2023. They sort deceptive design into six categories (overloading, skipping, stirring, obstructing, fickleness and opacity) and give a clear framework to what had until then been a gray area.

For a long time the dark pattern was a gray zone: not worth attacking, rarely sanctioned. That time is over. Three fronts opened almost simultaneously and they converge in 2026.

Europe: the ban is already here

Article 25 of the Digital Services Act (opens in a new tab), applicable to all platforms since February 2024, explicitly bans designing an interface that « deceives or manipulates » users or that « distorts or impairs their ability to make free and informed decisions ». On top of that sit the GDPR for anything touching consent, the Unfair Commercial Practices Directive and, coming soon, the Digital Fairness Act.

That last one is the missing piece. The European Commission is due to table its proposal in the third quarter of 2026 and its goal is stated plainly: ban dark patterns, regulate addictive design, influencer marketing and abusive personalization, with particular attention to minors. In the public consultation that closed in October 2025, 62% of stakeholders backed stricter rules. The legislative process (opens in a new tab) is under way.

France: the CNIL started with cookies

The French authority did not wait for the Digital Fairness Act. In late 2024, the CNIL issued formal notices to several publishers whose cookie banners relied on dark patterns (opens in a new tab): an « Accept » button pushed forward while « Reject » was hidden, pre-checked boxes, a deliberately complicated refusal path. The rule it restated is simple: refusing must be as easy as accepting. In 2025, its sanctions on trackers and consent ran into the hundreds of millions of euros, including 150 million for a single online fashion player.

United States: the FTC hits the wallet

Across the Atlantic, the Federal Trade Commission has made dark patterns a priority and it aims at the numbers. Its « click-to-cancel » rule, which required being able to cancel as easily as you subscribe, was struck down by an appeals court in July 2025 on a procedural flaw, not on the merits. So the FTC keeps acting under the ROSCA statute and its general power against unfair practices. The figures speak for themselves.

A few recent sanctions targeting dark patterns. In the Epic case, 245 of the 520 million relate directly to deceptive design

The signal common to all three fronts is clear: deceptive design is no longer a consequence-free trick, it is a liability that can be measured in billions.

People often say Google « penalizes » dark patterns. The reality is more nuanced and worth stating correctly. There is no named « dark pattern » penalty in the search algorithm that would sink a page because it hides a refuse button. But three very real mechanisms link these practices to your visibility.

In other words: Google sanctions the most blatant cases directly and the rest indirectly, through the erosion of the satisfaction signals it increasingly values. This is exactly the logic of Core Web Vitals and page experience (opens in a new tab): the engine rewards what truly serves the user.

The dark pattern works, in the short term. That is exactly what makes it tempting. A pre-checked box inflates the average cart, a countdown speeds up the decision, a well-hidden refusal pushes the consent rate up. On a dashboard seen on Monday morning, everything is green.

The problem is that these gains do not vanish, they shift in time and come back more expensive. The wrenched subscription ends in a cancellation request, a one-star review and sometimes a chargeback. The option added behind the visitor's back comes back as a refund request. The purchase rushed by fake urgency ends in a return. Each time, you have traded a fragile sale for a deferred cost: an overwhelmed support team, disputes, churn and, the most expensive of all, a brand that breeds distrust and pays for that distrust on every following sale.

This is where the trade-off flips. Trust is the only resource a site has that compounds instead of depleting. A visitor who feels respected comes back, recommends and buys without bracing. That is the whole job of micro-interactions that reassure at checkout (opens in a new tab): lifting doubt instead of working around it. And depending on what you sell (opens in a new tab), it is often the second order, not the first, that decides profitability. A dark pattern optimizes the first and sabotages the second.

Giving up dark patterns does not mean giving up conversion. For almost every deceptive interface there is an honest version that performs just as well and often better, because it creates no regret. The principle is constant: transparency and symmetry of choice.

For each dark pattern, the fair alternative that converts without creating regret

The throughline meets what makes a good call to action: a CTA that converts (opens in a new tab) is clear and direct, never sneaky. Highlighting the right action is legitimate. Disguising it or trapping the other one is not.

Before a regulator, an unhappy customer or Google does it, run your own site through the filter. Six questions are enough to spot most dark patterns.

If a single answer makes you uncomfortable, you probably have a dark pattern on your site, and therefore a line of risk that is no longer theoretical in 2026.

For years the math leaned toward manipulation: the gain was immediate and the penalty unlikely. In 2026, both terms have flipped. The penalty has become probable and quantifiable, from billion-dollar fines to the deindexing of the most aggressive cases, and the gain has revealed itself for what it was, a loan against future trust.

A site has never had to choose between converting and respecting its visitor. That opposition is false. The most solid conversion levers, clarity, proof, reassurance, the right pace, are also the most honest. Designing a site where every interaction inspires trust rather than suspicion is not giving up a tool, it is building the only asset that compounds sale after sale.