# Deceptive Patterns

Deceptive patterns (also known as “dark patterns”) are tricks used in websites and apps that make people do things they didn’t mean to — like buying or signing up for something. deceptive.design, founded by Dr Harry Brignull in 2010, catalogues the recognised types of deceptive pattern, the laws that govern them, real-world enforcement actions taken by regulators, and a reading list of academic research. This file links the core taxonomy and reference pages.

## Key pages
- [Types of deceptive pattern](https://deceptive.design/types/): The recognised taxonomy of deceptive patterns used in websites and apps.
- [Laws](https://deceptive.design/laws/): Laws that govern the use of deceptive patterns across the EU, UK and US.
- [Enforcement actions](https://deceptive.design/enforcement/): Legal cases and enforcement actions taken against companies for using deceptive patterns.
- [Reading list](https://deceptive.design/reading-list/): A reading list of academic papers, reports and articles on deceptive patterns.
- [Read the books](https://deceptive.design/read-the-books/): Books on deceptive patterns by Harry Brignull and Mark Leiser.
- [About](https://deceptive.design/about-us/): About deceptive.design and the team behind it.
- [How to cite this website](https://deceptive.design/how-to-cite-this-website/): Citation formats (APA, BibTeX, MLA, Harvard) for referencing the site.

## Types of deceptive pattern
- [Hard to cancel](https://deceptive.design/types/hard-to-cancel/): The user finds it easy to sign up or subscribe, but when they want to cancel they find it very hard.
- [Sneaking](https://deceptive.design/types/sneaking/): The user is drawn into a transaction on false pretences, because pertinent information is hidden or delayed from being presented to them.
- [Trick wording](https://deceptive.design/types/trick-wording/): The user is misled into taking an action, due to the presentation of confusing or misleading language.
- [Obstruction](https://deceptive.design/types/obstruction/): The user is faced with barriers or hurdles, making it hard for them to complete their task or access information.
- [Nagging](https://deceptive.design/types/nagging/): The user tries to do something, but they are persistently interrupted by requests to do something else that may not be in their best interests.
- [Preselection](https://deceptive.design/types/preselection/): The user is presented with a default option that has already been selected for them, in order to influence their decision-making.
- [Hidden costs](https://deceptive.design/types/hidden-costs/): The user is enticed with a low advertised price. After investing time and effort, they discover unexpected fees and charges when they reach the checkout.
- [Comparison prevention](https://deceptive.design/types/comparison-prevention/): The user struggles to compare products because features and prices are combined in a complex manner, or because essential information is hard to find.
- [Currency Confusion](https://deceptive.design/types/currency-confusion/): The user is misled about how much they are really spending, because real money is converted into a virtual currency that obscures the true cost.
- [Forced action](https://deceptive.design/types/forced-action/): The user wants to do something, but they are required to do something else undesirable in return.
- [Hidden subscription](https://deceptive.design/types/hidden-subscription/): The user is unknowingly enrolled in a recurring subscription or payment plan without clear disclosure or their explicit consent.
- [Addictive Design](https://deceptive.design/types/addictive-design/): The user interacts with the product excessively, because its design exploits psychological vulnerabilities to foster compulsive behaviour.
- [Visual interference](https://deceptive.design/types/visual-interference/): The user expects to see information presented in a clear and predictable way on the page, but it is hidden, obscured or disguised.
- [Fake social proof](https://deceptive.design/types/fake-social-proof/): The user is misled into believing a product is more popular or credible than it really is, because they were shown fake reviews, testimonials, or activity messages.
- [Fake urgency](https://deceptive.design/types/fake-urgency/): The user is pressured into completing an action because they are presented with a fake time limitation.
- [Confirmshaming](https://deceptive.design/types/confirmshaming/): The user is emotionally manipulated into doing something that they would not otherwise have done.
- [Disguised ads](https://deceptive.design/types/disguised-ads/): The user mistakenly believes they are clicking on an interface element or native content, but it's actually a disguised advertisment.
- [Fake scarcity](https://deceptive.design/types/fake-scarcity/): The user is pressured into completing an action because they are presented with a fake indication of limited supply or popularity.

## Laws
- [GDPR - Article 37](https://deceptive.design/laws/gdpr-article-37/): Outlines the appointment of a Data Protection Officer (DPO) for certain organizations.
- [GDPR - Article 24 ](https://deceptive.design/laws/gdpr-article-24/): Requires data controllers to implement appropriate measures to ensure data protection and to demonstrate compliance with GDPR.
- [Romanian Data Protection Act (Law No 677/2001) - Article 32 ](https://deceptive.design/laws/article-32-law-no-677-2001-of-the-romanian-data-protection-act/): Imposes fines ranging from 10 million to 250 million ROL for contraventions involving the processing of personal data in breach of specific provisions.
- [Fair Credit Reporting Act - 15 U.S.C. §§1681-1681](https://deceptive.design/laws/fair-credit-reporting-act---15-u-s-c-ssss1681-1681/): Mandates consumer reporting agencies to implement fair and accurate procedures for handling consumer credit information, ensuring confidentiality and relevance while upholding consumer rights.
- [Consumer Financial Protection Act](https://deceptive.design/laws/consumer-financial-protection-act/): CFPA prohibits unfair, deceptive, and abusive acts and practices when offering or providing consumer financial products or services.
- [Directive 95/46 - Article 7 ](https://deceptive.design/laws/article-7-directive-95-46/): Sets out the legal grounds for processing personal data, including consent, contract, legal obligations, vital interests, public interest, and legitimate interests, while protecting the rights of the…
- [Unfair Terms in Consumer Contracts Regulations, 1999](https://deceptive.design/laws/unfair-terms-in-consumer-contracts-regulations-1999/): Aim to protect consumers against unfair standard terms in standard term contracts.
- [GDPR - Article 09](https://deceptive.design/laws/gdpr-article-9/): Outlines the rules and restrictions surrounding the processing of sensitive personal data.
- [California’s False Advertising Law, CAL. BUS. & PROF CODE § 17500](https://deceptive.design/laws/california-s-false-advertising-law-cal-bus-prof-code-ss-17500/): Prohibits the dissemination of any false or misleading statements in advertising.
- [Electronic Commerce (EC Directive) Regulations 2002](https://deceptive.design/laws/electronic-commerce-ec-directive-regulations-2002/): Establish the legal framework for online retailers and service providers to comply with while conducting business with consumers.
- [GDPR - Article 58](https://deceptive.design/laws/gdpr-article-58/): Empowers supervisory authorities to carry out investigations and order controllers and processors to comply with the regulation.
- [Codice Privacy - Article 130 ](https://deceptive.design/laws/article-130-codice-privacy/): Prohibits the use of automated calling and communication systems for unsolicited promotional purposes, except with the prior consent of the data subject or for legitimate interest of the data controll…
- [GDPR - Article 03](https://deceptive.design/laws/gdpr-article-3/): Defines the territorial scope of GDPR
- [Federal Trade Commission Act - Section 5(a), 15 U.S.C. § 45(a)](https://deceptive.design/laws/section-5-a-of-the-ftc-act-15-u-s-c-ss-45-a/): Prohibits deceptive acts or practices that misrepresent or omit material facts.
- [GDPR - Article 39](https://deceptive.design/laws/gdpr-article-39/): Outlines the role of the Data Protection Officer (DPO) within organizations.
- [Spanish Data Protection Law (LOPDGDD) - Article 11 ](https://deceptive.design/laws/article-11-of-the-spanish-data-protection-law-lopdgdd/): Related to transparency and information to the affected party, and it requires the controller to provide certain information to data subjects when collecting their personal data.
- [Consumer Protection Cooperation (CPC) Regulation (2006/2004/EC)](https://deceptive.design/laws/consumer-protection-cooperation-cpc-regulation-2006-2004-ec/): Promotes cooperation among EU member states to enforce consumer protection laws.
- [Privacy and Electronic Communications (EC Directive) Regulation 2003 - Regulation 22](https://deceptive.design/laws/regulation-22-of-the-privacy-and-electronic-communications-ec-directive-regulations-2003/): Regulates the use of electronic communications for direct marketing purposes, including requirements for consent, opt-out options, and cookie disclosure.
- [Arizona Consumer Fraud Act, A.R.S. § 44-1521](https://deceptive.design/laws/arizona-consumer-fraud-act-a-r-s-ss-44-1521/): Prohibits deceptive practices, fraud, and misrepresentations in the sale or advertisement of merchandise.
- [ePrivacy Directive - Article 5(3)](https://deceptive.design/laws/eprivacy-directive-article-5-3/): Requires website operators to obtain user consent before storing or accessing information on the user's device through cookies or similar technologies.
- [Unfair Competition Law, CAL. BUS. & PROF CODE § 17200](https://deceptive.design/laws/unfair-competition-law-cal-bus-prof-code-ss-17200/): Prohibits unfair and unlawful business practices that deceive or mislead consumers in California.
- [GDPR - Recital 32](https://deceptive.design/laws/gdpr-recital-32/): Consent should be specific, informed, unambiguous, cover all processing activities, and not inferred from silence or pre-ticked boxes, must be clear, concise and non-disruptive.
- [California Consumers Legal Remedies Act, CAL. CIV. CODE § 1750](https://deceptive.design/laws/california-consumers-legal-remedies-act-cal-civ-code-ss-1750/): Provides consumers with a private cause of action for relief from deceptive or unlawful practices in transactions for goods or services.
- [GDPR - Article 25](https://deceptive.design/laws/gdpr-article-25/): Mandates that data protection must be incorporated into the design of systems, and that privacy must be a default setting for all data processing activities.
- [Privacy and Electronic Communications (EC Directive) Regulation 2003 - Regulation 2(1)](https://deceptive.design/laws/regulation-2-1-of-the-privacy-and-electronic-communications-ec-directive-regulations-2003/): Provides definitions of various terms used in the Privacy and Electronic Communications
- [Italian Consumer Code - Article 24](https://deceptive.design/laws/article-24-of-the-italian-consumer-code/): Requires advertising to provide information about potential health and safety risks associated with products.
- [Privacy Rule, 16 C.F.R. Part 313 (Recodified at 12 C.F.R. § 1016)](https://deceptive.design/laws/privacy-rule-16-c-f-r-part-313-recodified-at-12-c-f-r-ss-1016/): Requires financial institutions to notify customers about privacy policies, sets conditions for disclosing information to third parties, and provides opt-out rights to customers.
- [Unfair Commercial Practices Directive - Article 6 ](https://deceptive.design/laws/article-7-of-the-unfair-commercial-practices-directive/): Outlines what constitutes a misleading commercial practice that could deceive the average consumer into making a transactional decision they would not have otherwise taken.
- [Dutch Civil Code (Unfair Commercial Practices) - Section 6.3.3A](https://deceptive.design/laws/section-6-3-3a-of-the-dutch-civil-code-unfair-commercial-practices/): Prohibits unfair commercial practices, including misleading and aggressive practices, and provides remedies for consumers who have been harmed by such practices.
- [GDPR - Article 33](https://deceptive.design/laws/gdpr-article-33/): Requires controllers to notify the supervisory authority without undue delay if a personal data breach is likely to result in a risk to the rights and freedoms of individuals.
- [GDPR - Article 13](https://deceptive.design/laws/gdpr-article-13/): Controllers must provide identity, contact details, processing purposes and legal basis, recipient information, retention period, and data subject rights when collecting personal data.
- [French Data Protection Act - Article 82](https://deceptive.design/laws/french-data-protection-act-article-82/): Users must give informed and unambiguous consent and receive clear information about cookies, including processing purposes and data controller identity, according to the law.
- [Directive 95/46 - Article 2(h)](https://deceptive.design/laws/article-2-h-directive-95-46/): Defines "data subject's consent" as freely given, specific, and informed indication of agreement to personal data processing.
- [German Competition Act - Section 19a(2)](https://deceptive.design/laws/german-competition-act---section-19a-2/): Empowers the Bundeskartellamt to designate influential undertakings vital for competition across markets, enforcing regulations to prevent unfair practices and periodically reviewing its impact.
- [Unfair Commercial Practices Directive - Article 7](https://deceptive.design/laws/article-6-of-the-unfair-commercial-practices-directive/): Requires traders to provide material information and not to hide or obscure it in any way, in order to avoid misleading consumers and affecting their transactional decisions.
- [Electronic Fund Transfer Act (EFTA)](https://deceptive.design/laws/electronic-fund-transfer-act-efta/): Requires disclosures for consumer financial products or services to be clear, easily understandable, and provided in a format that can be retained by the consumer.
- [GDPR - Article 43](https://deceptive.design/laws/gdpr-article-43/): Mentions certification bodies as a potential entity to provide accreditation and certification for data protection compliance.
- [ROSCA - Section 4, 15 U.S.C. § 8404](https://deceptive.design/laws/section-4-of-rosca-15-u-s-c-ss-8404/): Specifies the enforcement provisions for violations of the Act by the Federal Trade Commission, including penalties and privileges.
- [GDPR - Article 32](https://deceptive.design/laws/gdpr-article-32/): Requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
- [GDPR - Article 42](https://deceptive.design/laws/gdpr-article-42/): Outlines the certification mechanisms available for demonstrating compliance with the regulation.
- [District’s Consumer Protection Procedures Act § 28-3904](https://deceptive.design/laws/district-s-consumer-protection-procedures-act-ss-28-3904/): Outlines various unfair or deceptive trade practices, including misrepresenting goods or services, falsely claiming affiliations, quality, or characteristics, and using innuendo to mislead
- [Consumer Protection from Unfair Trading Regulations, 2008](https://deceptive.design/laws/consumer-protection-from-unfair-trading-regulations-2008/): Prohibit traders across all sectors from using unfair commercial practices that hinder consumers from making informed purchasing decisions.
- [New York Consumer Fraud Statute, N.Y. GEN. BUS. LAW § 349](https://deceptive.design/laws/new-york-consumer-fraud-statute-n-y-gen-bus-law-ss-349/): Prohibits deceptive acts and practices in business or service, allows AG action against violators, and private right of action for injured individuals with increased damages for willful violations.
- [Gramm Leach Bliley Act Act - Section 503, 15 U.S.C. § 6803](https://deceptive.design/laws/section-503-of-the-gramm-leach-bliley-act-act-15-u-s-c-ss-6803/): Requires financial institutions to disclose to customers their privacy notices explaining how their personal information is collected, shared, and protected.
- [GDPR - Article 07](https://deceptive.design/laws/gdpr-article-7/): Valid consent conditions include being freely given, specific, informed, and unambiguous, and the data subject should be able to withdraw it anytime.
- [GDPR - Article 28](https://deceptive.design/laws/gdpr-article-28/): Outlines data processors' responsibilities, including implementing appropriate security measures, processing data based on controller instructions, and maintaining records of processing activities.
- [Dutch Policy Rules Administrative Fines 2019](https://deceptive.design/laws/dutch-policy-rules-administrative-fines-2019/): Outlines the use and calculation of administrative fines for violations of privacy laws.
- [North Carolina Automatic Renewal Statute, N.C.G.S. Section 75-41(a)](https://deceptive.design/laws/north-carolina-automatic-renewal-statute-n-c-g-s-section-75-41-a/): Mandates transparent disclosure and cancellation procedures for contracts with automatic renewal clauses, rendering non-compliance void and unenforceable
- [ROSCA - Section 4, 15 U.S.C. § 8401](https://deceptive.design/laws/section-4-of-rosca-15-u-s-c-ss-8401/): The internet must provide clear and accurate information to consumers, and the use of "data pass" to share billing information with third parties for unwanted memberships undermines consumer confidenc…
- [UK Code of Non-broadcast Advertising, Sales Promotion and Direct Marketing](https://deceptive.design/laws/uk-code-of-non-broadcast-advertising-sales-promotion-and-direct-marketing/): Sets standards for advertising, sales promotion, and direct marketing practices in the UK.
- [GDPR - Article 14](https://deceptive.design/laws/gdpr-article-14/): Specifies required information for data subjects when collecting personal data from other sources, including controller identity, processing purposes, personal data categories, recipients, and retenti…
- [ROSCA - Section 4, 15 U.S.C. § 8403](https://deceptive.design/laws/section-4-of-rosca-15-u-s-c-ss-8403/): Requires companies to obtain consumer's consent before charging their credit or debit cards for goods or services offered through a "negative option feature."
- [Spanish Law on Information Society Services - Article 22](https://deceptive.design/laws/article-22-of-the-spanish-law-on-information-society-services/): Requires informed consent for the use of data storage and retrieval devices, unless they are strictly necessary for service provision, and mandates clear information provision for such use.
- [Consumer Rights Act, 2015](https://deceptive.design/laws/consumer-rights-act-2015/): Covers various aspects of consumer transactions, including the sale of goods and services, digital content, unfair contract terms, and remedies for faulty goods.
- [Italian Consumer Code - Article 21](https://deceptive.design/laws/article-21-of-the-italian-consumer-code/): Considers all aspects of advertising to determine if it is misleading, including information on products, prices, and the advertiser's attributes and rights.
- [Privacy and Electronic Communications (EC Directive) Regulation 2003 - Regulation 21](https://deceptive.design/laws/privacy-and-electronic-communications-ec-directive-regulation-2003-regulation-21/): Prohibits unsolicited electronic marketing communication without prior consent, except in certain circumstances.
- [GDPR - Article 21](https://deceptive.design/laws/gdpr-article-21/): Gives individuals the right to object to the processing of their personal data in certain situations.
- [GDPR - Article 38](https://deceptive.design/laws/gdpr-article-38/): Requires the appointment of a Data Protection Officer (DPO) in certain circumstances.
- [Gramm Leach Bliley Act Act - Section 502, 15 U.S.C. § 6802](https://deceptive.design/laws/section-502-of-the-gramm-leach-bliley-act-act-15-u-s-c-ss-6802/): Requires financial institutions to provide privacy notices to customers and to safeguard nonpublic personal information.
- [GDPR - Article 12](https://deceptive.design/laws/gdpr-article-12/): Ensures transparent information and easy access for individuals to their personal data processing, with the right to obtain a copy in a clear and common format.
- [Marketing Control Act - Section 6, 8 and 9](https://deceptive.design/laws/marketing-control-act---section-6-8-and-9/): Unfair commercial practices, including misleading and aggressive tactics, are prohibited, targeting vulnerable groups and emphasizing disclosure of material information for informed consumer decisions…
- [Italian Consumer Code - Article 25](https://deceptive.design/laws/article-25-of-the-italian-consumer-code/): Prohibits advertising that encourages behavior that is potentially harmful to children.
- [Spanish Data Protection Law (LOPDGDD) - Article 6 ](https://deceptive.design/laws/article-6-of-the-spanish-data-protection-law-lopdgdd/): Establishes the principles of lawfulness, fairness, and transparency in the processing of personal data.
- [Unfair Commercial Practices Directive - Article 5](https://deceptive.design/laws/article-5-of-the-unfair-commercial-practices-directive/): Prohibits misleading commercial practices.
- [GDPR - Article 04(16)](https://deceptive.design/laws/gdpr-article-4-16/): Defines the term "main establishment" for controllers and processors operating in multiple EU member states.
- [Consumer Fraud Act, New Jersey, Stat. Ann. § 56:8-2](https://deceptive.design/laws/consumer-fraud-act-new-jersey-stat-ann-ss-56-8-2/): Prohibits deceptive acts or unfair practices related to the sale or advertisement of any merchandise.
- [GDPR - Article 08](https://deceptive.design/laws/gdpr-article-8/): Establishes rules for processing personal data of children under the age of 16.
- [ROSCA - Section 4, 15 U.S.C. § 8405](https://deceptive.design/laws/section-4-of-rosca-15-u-s-c-ss-8405/): Allows State attorneys general to bring a civil action in federal court to obtain injunctive relief for alleged violations of ROSCA, with certain requirements and limitations.
- [Italian Consumer Code - Article 20](https://deceptive.design/laws/article-20-of-the-italian-consumer-code/): Defines the terms related to advertising, including misleading and comparative advertising, and identifies the advertiser.
- [Federal Constitution (Austria) - Article 8](https://deceptive.design/laws/article-8-of-the-federal-constitution-austria/): German is Austria's official language, but its autochthonous ethnic groups and Austrian sign language are recognized, respected, safeguarded, and supported.
- [Directive 95/46 - Article 6](https://deceptive.design/laws/article-6-directive-95-46/): Outlines the basic principles of fair and lawful personal data processing, including specified and legitimate purposes, adequacy, accuracy, and appropriate safeguards.
- [Austria Data Protection Act (DSG) - Section 24 (6)](https://deceptive.design/laws/section-24-6-of-the-austria-data-protection-act-dsg/): Respondent can remedy alleged infringement while proceedings are pending and complainant must explain why they consider infringement not remedied, otherwise procedure is discontinued.
- [GDPR - Article 04(11)](https://deceptive.design/laws/gdpr-article-4-11/): Consent is a voluntary agreement by an individual for their personal data processing, after being informed of its specific purposes and conditions.
- [Consumer Contracts (Information Cancellation and Additional Charges) Regulations, 2013](https://deceptive.design/laws/consumer-contracts-information-cancellation-and-additional-charges-regulations-2013/): Grant consumers the right to cancel contracts for goods or services made through remote communication channels such as the internet, email, or telephone.
- [GDPR - Article 15](https://deceptive.design/laws/gdpr-article-15/): Grants individuals the right to access their personal data and receive information on how it is processed.
- [GDPR - Article 05](https://deceptive.design/laws/gdpr-article-5/): Requires personal data to be processed lawfully, fairly, and transparently.
- [GDPR - Article 17](https://deceptive.design/laws/gdpr-article-17/): Grants individuals the right to have their personal data erased under certain circumstances.
- [CAN-SPAM Act - Section 5(a)(1) & 15 U.S.C. § 7704(a)(1)](https://deceptive.design/laws/can-spam-act---section-5-a-1-15-u-s-c-ss-7704-a-1/): Prohibits the transmission of electronic messages with materially false or misleading header information, aiming to prevent deceptive practices in commercial email communications.
- [Children’s Online Privacy Protection Act Rule](https://deceptive.design/laws/children-s-online-privacy-protection-act-rule/): Prevents dishonest or misleading actions involving the gathering, utilization, and/or exposure of children's personal information on the Internet
- [Italian Consumer Code - Article 22](https://deceptive.design/laws/article-22-of-the-italian-consumer-code/): Describes the conditions that must be met for comparative advertising to be permitted, including requirements for honesty, fair comparison, non-discrediting of competitors, and clarity regarding speci…
- [ROSCA - Section 4, 15 U.S.C. § 8402](https://deceptive.design/laws/section-4-of-rosca-15-u-s-c-ss-8402/): Prohibits unfair and deceptive Internet sales practices, including misleading representations, failure to disclose material terms, and charging consumers without their express informed consent.
- [GDPR - Article 83](https://deceptive.design/laws/gdpr-article-83/): Outlines conditions for fines and penalties for non-compliance, including up to 4% of global annual revenue or €20 million, whichever is greater.
- [GDPR - Article 57](https://deceptive.design/laws/gdpr-article-57/): Outlines the tasks and powers of the supervisory authorities.
- [GDPR - Article 06](https://deceptive.design/laws/gdpr-article-6/): Legal basis for processing personal data are performance of contract, legal obligations compliance, protection of vital interests, controller's legitimate interests, and data subject's consent.
- [Gramm Leach Bliley Act Act - Section 501, 15 U.S.C. § 6801](https://deceptive.design/laws/section-501-of-the-gramm-leach-bliley-act-act-15-u-s-c-ss-6801/): Requires financial institutions to protect the confidentiality and security of customers' personal information.
- [Washington Consumer Protection Act - Wash. Rev. Code §§ 19.86.010](https://deceptive.design/laws/washington-consumer-protection-act---wash-rev-code-ssss-19-86-010/): Unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce are hereby declared unlawful.
- [Spanish Law on Information Society Services - Article 21](https://deceptive.design/laws/article-21-of-the-spanish-law-on-information-society-services/): Prohibits the sending of commercial communications by email or other electronic means without the prior consent of the recipient.