Dark Patterns and Consent Interfaces: Design as a Legal Question

"Dark pattern" started as a design term and became a legal one. California's privacy statute defines it as a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice — and then provides that agreement obtained through such an interface is not consent. Colorado's rules go further into specifics, requiring symmetry between the accept and decline paths and barring designs that use guilt, shame, or visual weight to steer the answer.

The consequence is unusual. In most compliance work the document controls. Here the screen controls, and the screen changes every sprint.

The two federal theories, and what they reach

There is no federal statute called the dark patterns act. Enforcement runs through two established routes.

The first is Section 5 of the FTC Act. A design is deceptive when it creates a net impression likely to mislead a reasonable consumer about a material fact — what is being collected, what a button does, whether a charge recurs. It is unfair when it causes substantial injury consumers cannot reasonably avoid and that is not outweighed by countervailing benefits. The "cannot reasonably avoid" element does real work: an interface that hides the decline option behind three screens is precisely an injury the consumer could not reasonably avoid. The Commission's staff report on dark patterns, published in 2022, catalogs the design families it treats as actionable and remains the clearest statement of how the agency thinks about the question.

The second is the Restore Online Shoppers' Confidence Act, which governs negative-option marketing online. ROSCA requires clear and conspicuous disclosure of the material terms before obtaining billing information, express informed consent to the charge, and a simple mechanism to stop recurring charges. The FTC adopted a broader negative-option rule in 2024 — widely described as the click-to-cancel rule — but a federal court of appeals vacated it in 2025 on procedural grounds relating to the rulemaking record. As of mid-2026, ROSCA and Section 5 remain the operative federal hooks, and state automatic-renewal statutes continue to apply independently. Treat the vacated rule's substance as a fair description of enforcement priorities rather than as binding law, and confirm the current posture through the Commission before advising on a subscription flow.

Patterns, and the theory each one attracts

The preference-signal row is the one that has produced the clearest enforcement record. California's attorney general announced a settlement in 2022 with a national retailer over allegations that it sold personal information while failing to process opt-out requests transmitted through the Global Privacy Control. The lesson generalizes: a state can prove that failure from the outside, with a browser and a network log, without any discovery at all. The same is true of most patterns in the table, which is why this area produces sweeps rather than one-off investigations. The state's CCPA resources describe the opt-out mechanics the office tests against.

Symmetry, and what it actually demands

Symmetry in choice is the single rule that resolves most design arguments. Stated plainly: the path to the privacy-protective outcome must be no longer, no harder, and no less prominent than the path to the outcome the business prefers. Applied honestly, it decides questions that otherwise turn into taste debates.

• Equal click counts. If accepting is one tap, declining is one tap — not "manage preferences" followed by seven toggles and a save.
• Equal visual weight. Same button size, same contrast tier, same position in the reading order. A grey ghost button beside a saturated primary is an asymmetry a regulator can measure from a screenshot.
• Neutral wording on both sides. "Accept" and "Decline," not "Accept" and "Continue without the benefits I would otherwise receive."
• No pre-ticked boxes for anything requiring consent, and no bundling of unrelated permissions behind a single control.
• A refusal that persists. If the user declines, the state is recorded and respected across sessions and devices where the account allows it.
• Cancellation in the medium of signup. If the subscription was bought in the app, it can be ended in the app.
• The same rules at every entry point — web, mobile, in-product upsell, and email — since enforcement follows the weakest flow, not the flagship one.

Verify before relying: consent-management platforms are configured, not installed. A vendor's default template frequently fails the symmetry rule out of the box, and the vendor's compliance claims do not transfer legal responsibility to it. Test the deployed banner, not the datasheet.

Where the stakes rise: sensitive data, minors, and money

Three contexts raise the standard applied to an interface.

Sensitive data comes first. Where a state classes data as sensitive — health inferences, precise location, a biometric identifier used to identify a person — consent must be opt-in and specific, and a bundled agreement to a general privacy policy will not carry it. An assessment premised on consent for that processing fails along with the interface, which is why the two questions belong in one review; the assessment mechanics are in privacy and data protection assessments.

Minors come second. Where the service is directed to children or has actual knowledge of child users, the federal regime requires verifiable parental consent before collection, and several states add design-duty obligations for teens including limits on nudging toward weaker privacy settings. Those requirements are covered in children's online privacy.

Money comes third. Any flow that ends in a recurring charge is examined against both the disclosure standard and the cancellation standard, and the two are judged together. A flawless disclosure does not cure a cancellation path that requires a retention call. Where the same flow also collects consent to use inputs for model training, the interface question merges with the contract question addressed by a training-data clause — the terms are only as good as the permission the user actually gave, a pairing discussed in contracting with AI vendors.

Reviewing a flow before a regulator does

1. Capture the current state

   Record the live flow end to end on each platform, with timestamps, in an incognito session and again as a logged-in user. You cannot defend a screen you cannot reproduce, and builds change weekly.

2. Count the steps on both paths

   Write down clicks, screens, and seconds for accept and for decline. If the numbers differ, that difference is the finding — no further analysis is needed to know it must be fixed.

3. Test the signal

   Load the site with an opt-out preference signal enabled and inspect what the tags actually do. Many organizations discover the signal is parsed by the banner but never passed to the advertising vendors.

4. Trace the permission downstream

   Confirm that a refusal reaches every system that reads the consent flag. A compliant banner in front of a pipeline that ignores it is worse than no banner, because it documents the promise that was broken.

5. Preserve the evidence

   Keep dated screenshots and configuration exports on a retention schedule long enough to cover the limitations period. When a demand arrives about a flow from two years ago, the archive is the entire defense.

6. Govern experiments

   Route consent-affecting A/B tests through the same review as launches. Growth teams optimize for acceptance rate, which is the exact metric that produces the patterns in the table above.

Structuring that review around a recognized vocabulary helps when the findings go to a board. The NIST Privacy Framework is voluntary, but its treatment of predictability and manageability maps closely onto what the state rules require, and the FTC's privacy and security guidance supplies the federal baseline for claims a company makes about its own choices.

Questions the desk gets

Our banner was built by a well-known vendor. Are we covered?

No. The obligation runs to the business operating the site, and vendor templates ship with defaults tuned for consent rates rather than for symmetry. The recurring failures are a decline path with more steps than the accept path, a preference signal the banner reads but never forwards to advertising tags, and a refusal that resets on the next visit. Test the deployed configuration and keep the test record.

Does a compliant banner fix an interface that already collected consent badly?

Only going forward. Where a state treats consent obtained through a dark pattern as no consent at all, the processing that ran on it was unconsented processing, and fixing the screen does not retroactively validate it. The practical question becomes what to do with the data already collected — whether to re-consent the affected population, restrict the uses that required consent, or delete. That decision should be made with counsel and documented.

Is any friction on the decline path unlawful?

Not inherently. The rules target asymmetry and manipulation, not the existence of a second screen. A confirmation step applied identically to both choices is generally defensible. A confirmation step applied only when the user declines is the paradigm case of what the rules prohibit. When in doubt, ask whether the friction would survive being described out loud in a regulator's complaint.

Sequencing the work

Fix the measurable failures first, because they are the ones a regulator can prove without you: an opt-out link that does not work, a preference signal that is ignored, a cancellation path that leaves the medium of signup. Each is a discrete engineering ticket, and each closes an enforcement theory outright.

Then take the symmetry pass across every consent surface, and put a standing owner on it — the interface will drift back within two release cycles unless someone owns the rule. Last, build the evidence habit: dated captures, configuration exports, and a record of what each cohort saw. Retention for that archive should be set deliberately alongside the rest of the schedule, as covered in data retention schedules and deletion obligations. Related material sits on the Privacy, Cyber & AI desk.