The dark patterns regulators are actually fining companies over in 2026 come down to a short, recognizable list, tricking people into sharing data, hiding fees until checkout, making cancellation a maze, guilt-tripping them out of the "no," disguising which button does what, forcing actions they never wanted, and asking questions engineered to confuse. The reassuring part is that once you can name these seven, you can spot them in your own product in an afternoon, because they hide in plain sight as "normal" design choices. The uncomfortable part is that the FTC no longer needs to prove you meant to deceive. If your interface has the effect of manipulating people, that is enough. This article walks through all seven with real examples, explains why each one draws enforcement, and shows you how to find them before a regulator does.
We look at a lot of websites, and the thing that surprises people most is how ordinary these patterns look from the inside. Nobody on the team ever says "let's build a dark pattern." Someone just makes the "Accept" button a little bolder, or moves the cancel link somewhere quieter, or pre-checks a box because it lifts a metric. Each choice feels harmless on its own. Stacked together, they are exactly what the FTC now treats as a standalone category of illegal conduct. Let us go through the seven so you can recognize them for what they are.
What are dark patterns, and why is enforcement rising in 2026?
A dark pattern, or "deceptive design" in the regulators' preferred phrasing, is an interface choice built to steer you into a decision you would not otherwise make. It works by exploiting ordinary human tendencies, our reliance on defaults, our aversion to friction, our discomfort with saying no, and turning them against the user to serve a business metric. The key point is that it is engineered. These layouts are A/B tested and optimized, which is exactly why regulators treat them as deliberate rather than accidental.
The enforcement picture changed in a way worth understanding. The FTC has been building precedent against deceptive design since 2022, and it now treats dark patterns as a standalone category of unfair or deceptive practice under Section 5 of the FTC Act, meaning the design itself can be the violation rather than just the fine print around it. According to the FTC's own report on the rise of dark patterns, these tactics show up across ecommerce, cookie banners, children's apps, and subscription sales, and the agency has catalogued design tricks like pre-checked boxes, hard-to-find disclosures, and confusing cancellation policies as tools to get consumers to give up money or data.
The stakes are no longer theoretical. Amazon settled its Prime subscription case for $2.5 billion in September 2025, the largest dark pattern enforcement action to date, and Epic Games paid $245 million in 2022 over deceptive purchase flows in Fortnite. And this is not only federal. According to the law firm Reed Smith's analysis of the enforcement spotlight, state attorneys general and state privacy and AI laws now expressly prohibit dark patterns for obtaining consent, and even business-to-business companies are facing scrutiny. The through-line, which matters enormously, is that the FTC does not require proof of intent: if your design has the effect of deceiving or manipulating consumers, you can face enforcement regardless of whether anyone meant to.
The 7 manipulative designs regulators are targeting
Here are the seven, drawn from what regulators have actually pursued and what their published guidance flags. For each one, the test is the same: does the design make the choice the company wants easy and the choice the user wants harder?
1. Steering people into sharing more data than they meant to
This is the privacy dark pattern, and it is the FTC's first-named category. The interface is presented as giving you a choice about your data, but every visual and structural cue nudges you toward the option that shares the most. The "share everything" button is bright and prominent; the "limit sharing" option is greyed out, buried a click deeper, or written in confusing language. The choice is technically there, which is what makes it feel legitimate, but the design is engineered so that the path of least resistance gives away the most.
Regulators care because consent obtained this way is not really consent. The California Privacy Protection Agency has specifically criticized designs that make consumers jump through confusing hoops or solve puzzles to exercise a privacy choice. If protecting your privacy takes five clicks and giving it away takes one, that asymmetry is the violation.
2. Pre-checked boxes and opt-out-by-default consent
The pre-checked box is the oldest deceptive pattern in the catalogue, and it is still everywhere. A checkbox for marketing emails, data sharing, or an add-on service arrives already ticked, so a user who does nothing has "agreed." It relies entirely on inertia: most people do not uncheck things, and the business knows it.
This one is squarely illegal for consent in most modern frameworks. Genuine consent has to be an affirmative act, a deliberate opt-in, which a pre-ticked box by definition is not. The same logic extends to any "opt-out by default" arrangement where items, subscriptions, or permissions are added to your cart or account automatically and the burden is on you to remove them. If the default state is "yes" and the user never chose it, regulators treat it as manufactured consent.
3. Hidden fees and drip pricing
You have felt this one. A price looks great, you invest ten minutes filling in details, and only at the final step do "service fees," "processing charges," or "resort fees" appear and inflate the total. This is drip pricing, and it has become a major enforcement priority precisely because it works by sunk cost: by the time the real price shows up, you have already committed your time and feel reluctant to start over elsewhere. The same sunk-cost pressure drives fake scarcity and countdown clocks, which regulators treat as a separate deceptive claim.
According to Reed Smith, regulators now treat undisclosed charges introduced late in checkout as material misrepresentations, meaning the FTC views drip pricing as inherently deceptive because it anchors your expectation to a lower number before adding charges that are hard to avoid. The fix is simple to state and apparently hard for some businesses to accept: show the all-in price up front.
4. The roach motel: easy to get in, hard to get out
Named for the trap you can enter but not leave, this pattern makes signing up a delight and cancelling a nightmare. You subscribe in two clicks, but to cancel you must call a phone line open three hours a day, navigate five confirmation screens, or hunt for a cancel link deliberately buried in an account menu. This is the pattern behind the Amazon Prime case, and it is the one the FTC's click-to-cancel push was built to address.
The governing principle regulators apply is symmetry: cancellation should be at least as easy as sign-up, and in the same medium. If you can subscribe online, you must be able to cancel online, without a retention obstacle course. We have written more about this specific area and where the rules stand in our piece on what the FTC click-to-cancel situation means for your subscriptions, because it is the dark pattern with the clearest and most expensive enforcement history.
5. Confirmshaming: guilt-tripping the "no"
Confirmshaming is the pattern where declining an offer requires clicking something designed to make you feel bad. The decline option reads "No thanks, I don't want to save money" or "No, I prefer to pay full price," while the accept button is cheerful and prominent. The mechanism is emotional manipulation: it uses shame and social pressure to override a decision the user has already made.
Regulators treat this as manipulation of autonomy rather than a neutral design choice. The tell is in the language of the rejection: if saying no requires the user to insult themselves or admit to a character flaw, the design is engineered to coerce, not to inform. A neutral "No thanks" is all a genuine choice needs.
6. Visual interference and misleading button prominence
This is the pattern of making the company's preferred option visually dominant and the user's preferred option nearly invisible. In a cookie banner, "Accept all" is a big coloured button while "Reject" is faint grey text that barely reads as clickable. In a checkout, "Add insurance" is bold and "Continue without" is a thin link. Nothing is technically hidden, but the visual hierarchy does the manipulating.
According to the FTC enforcement guidance summarized by attorneys tracking Section 5 trends, the Commission specifically targets misleading button labels where "Accept" is prominent and "Decline" is barely visible, alongside pre-checked consent and confusing opt-out flows. The compliance standard here is symmetry of prominence: the accept and decline options should carry equal visual weight, so the design informs rather than steers.
7. Trick questions and misleading language
The last pattern manipulates through words rather than layout. It uses confusing double negatives ("Uncheck this box if you do not want to not receive emails"), labels that hide what is really happening ("Improve your experience" meaning "Enable advertising tracking"), or phrasing engineered so the fast reader agrees to the opposite of what they intend. It exploits the fact that people skim.
Regulators read these as deceptive because they defeat informed choice by design. If a user has to parse a sentence three times to work out what agreeing actually means, the language is doing the manipulating. Plain, direct wording, "Send me marketing emails," yes or no, is the standard, and anything that requires decoding is a red flag.
How do I know if my website has dark patterns?
This is the practical question, and the honest answer is that you often cannot see your own dark patterns, for the same reason the teams that build them cannot: they look like normal, even sensible, product decisions from the inside. The "Accept all" button is bold because it improves conversion. The cancel link is quiet because nobody wanted to encourage churn. Each choice had a rational-sounding reason, which is exactly why an internal review tends to wave them through.
The way to see them clearly is to evaluate the interface against the patterns above from the user's side, ideally with something that checks systematically rather than relying on the judgment of the people who built it. This is a dimension we scan for directly, because deceptive design sits alongside accessibility, privacy, and security as a measurable property of a page, not a matter of taste. An automated check can flag a pre-checked consent box, mismatched button prominence, or a missing symmetric reject option consistently across every page, which is where these patterns tend to multiply. You can scan your site for free, up to five pages with no signup, and see which deceptive-design issues show up on your live pages alongside the rule each one implicates.
For teams that want this built into how they already work, there is a newer option worth knowing about. Because the scan is available programmatically, you can connect it to an AI assistant through the Model Context Protocol, so your assistant can run a compliance check and read back the findings, including deceptive-design issues, as part of your normal workflow rather than as a separate audit. If you want to wire that up, our developer documentation covers how to run scans programmatically and integrate them into your own tooling, which is the most direct way to catch these patterns continuously as your product changes.
Common questions about dark patterns and enforcement
Because the topic is moving quickly, a few questions come up repeatedly. These are general explanations rather than legal advice for your specific situation.
Can I be fined for a dark pattern I didn't intend to create?
Yes, and this is the single most important thing to understand. The FTC does not require proof of intent. If your website's design has the effect of deceiving or manipulating consumers, you can face enforcement whether or not anyone set out to trick anyone. This is precisely why "we didn't mean to" is not a defense, and why checking your interface against the known patterns matters even for well-intentioned teams. Good intentions do not change how a buried cancel link functions for the user.
Are dark patterns illegal, or just unethical?
Both, increasingly. What was once purely an ethics-and-trust issue is now a legal one across multiple regimes. The FTC pursues them under Section 5, a growing list of US state privacy laws expressly prohibit them for obtaining consent, and in the EU the Digital Services Act explicitly bans deceptive interfaces while the GDPR governs manipulative consent flows. So the honest framing in 2026 is that dark patterns are a legal risk with an ethical origin, and the size of recent settlements shows the legal side is not hypothetical.
Does this apply to my business if I only sell to other businesses?
Possibly. A common assumption is that dark pattern enforcement is only about consumers, but regulators have signaled that companies using deceptive design elements can face scrutiny even when operating business-to-business. The safer assumption is that if your interface manipulates the person using it, the label on your customer does not automatically put you out of reach.
Isn't a bold "Accept" button just good conversion design?
This is the honest tension every product team feels, and the line is about symmetry, not persuasion. Making your preferred action clear and usable is fine. Making the alternative deliberately hard to find, hard to read, or emotionally costly is what crosses into a dark pattern. The question to ask is not "is our preferred option prominent" but "is the user's option equally available." If a reasonable person would struggle to decline as easily as they can accept, the design has stopped informing and started steering.
The bottom line
The dark patterns regulators are targeting in 2026 are a nameable, findable set: steering people into oversharing data, pre-checked and opt-out-by-default consent, hidden fees and drip pricing, roach-motel cancellation, confirmshaming, visual interference in button prominence, and trick-question language. What ties them together is asymmetry, the company's preferred choice made easy and the user's choice made hard, and what makes them dangerous now is that the FTC treats the effect as the violation, no intent required, with settlements running into the billions. The good news is that the fix for every one of them is the same principle in reverse: make the honest choice as easy as the profitable one. Give equal prominence to accept and decline, show the full price up front, let people cancel the way they signed up, use plain language, and never pre-check consent. Then check your live pages against these patterns regularly, because they creep back in one reasonable-sounding tweak at a time. Design that respects the user's autonomy is not just the compliant choice anymore. In an era of billion-dollar settlements, it is the commercially sensible one. False urgency belongs on the same list: our guide to fake countdown timers shows how to tell a real deadline from a manufactured one.
Sources
Reed Smith, Dark Patterns Lead to Enforcement Spotlight: Key Compliance Steps for Businesses
TOS Lawyer, FTC Enforcement Trends in 2026
This article is educational and reflects Sitejar's point of view. It is not legal advice. For your specific situation, consult a qualified attorney.