Spotting and Avoiding Dark Patterns: Why Interface Tricks Cost You
Fake countdowns, hidden cancellations, cookie banners without a "Reject" button: why dark patterns cost trust, what EU and German law say, and what fair alternatives look like.
A countdown that restarts at ten minutes every time you reload the page. A button that reads "No thanks, I'd rather pay full price." A subscription you can start in two clicks but can only cancel by calling a hotline. Almost anyone who regularly shops, streams, or fills out forms online has run into tricks like these.
In UX design, they're called dark patterns. In the short term, they often improve a metric. In the long run, they cost trust and are becoming a growing legal risk in the EU and in Germany. This article covers the psychological mechanisms behind them, how to spot typical patterns, what the law says, and what fair alternatives look like.
What dark patterns are
The term dark patterns was coined in 2010 by British UX designer Harry Brignull. He launched a website that collected examples of manipulative interfaces and gave them names. The project is now called "Deceptive Patterns" and lives at deceptive.design. The European Data Protection Board (EDPB) also deliberately uses the term "deceptive design patterns" in its guidelines, because it describes more precisely what this is about.
The term refers to design decisions that lead people to take actions they wouldn't choose if they saw the situation clearly. That might be a purchase, consent to tracking, a subscription, or sharing personal data. What matters isn't the design team's intent but the effect: an interface that systematically misleads people is a dark pattern, even if nobody on the team planned it that way.
It's important to distinguish dark patterns from nudging. A nudge also steers behavior, for example through a sensible default or a well-placed hint. The difference is the direction: a nudge helps people reach their own goals more easily and keeps all options open and understandable. A dark pattern works against the interests of the people using it and hides, obscures, or complicates the alternatives.
Why these tricks work
Dark patterns exploit well-researched quirks of human perception and decision-making. Once you know these mechanisms, you'll spot problematic patterns faster and can use the same levers fairly.
Defaults and inertia
Defaults are enormously powerful because people rarely change them. A default acts like a silent recommendation, and every change takes attention. That's why a pre-checked box often simply stays checked.
Loss aversion
Losses weigh more heavily, psychologically, than gains of the same size. Daniel Kahneman and Amos Tversky described this effect in their research on prospect theory. Interfaces exploit it when they emphasize not the benefit of an offer but the looming loss: "Your discount is about to expire," "You'll lose all your benefits."
Social proof
When people are unsure, they look at what others do. That's why messages like "23 people are looking at this offer right now" or "Bestseller" work. It becomes a problem when the numbers are made up, inflated, or impossible to verify.
Friction and cognitive load
Every extra step, every form field, and every unclear phrase increases cognitive load, the mental effort a task requires. Good UX design reduces this friction wherever people want to get something done. Dark patterns do the opposite: they deliberately add friction when someone wants to decline, cancel, or protect their data, and remove it wherever the company benefits.
Broken expectations
People bring a mental model with them, an internal idea of how an interface works. A green button means "continue," an X in the top right corner closes a window, a search result is a search result and not an ad. Many dark patterns undermine exactly these expectations.
Typical dark patterns and their fair alternatives
For each of the following eight common patterns, you'll find a typical situation, the psychological lever, the long-term costs, and a fair alternative.
1. Fake urgency
An online store shows a red countdown next to a product: "Offer ends in 09:58." The next day, it shows the same time remaining. Messages like "Only 2 left in stock" that appear regardless of actual inventory work the same way.
The lever is loss aversion combined with time pressure. Under pressure, people compare less and decide faster. The costs show up later: once someone sees through the trick, they stop believing genuine offers too. On top of that come returns of impulse purchases that wouldn't have happened after calm consideration.
The fair alternative is simple: show deadlines and stock levels only when they're true. A real promotional period can be communicated calmly and concretely, for example "Sale price valid until Sunday, 11:59 p.m." That creates clarity without causing panic.
2. Confirmshaming
A newsletter pop-up offers two options: "Yes, I want to save" and "No thanks, I don't like bargains." The decline option is worded to make it feel embarrassing or unreasonable. The pattern is called confirmshaming because it uses shame to push people into agreeing.
The psychological lever is the need to see yourself as a reasonable person. Nobody likes clicking a sentence that puts themselves down. In the long run, copy like this comes across as condescending, and that impression sticks. People who feel addressed this way associate the brand with being patronized.
The alternative lies in good microcopy, the short texts on buttons, labels, and hints. Word both options neutrally and as equals: "Subscribe to newsletter" and "No, thanks." The value proposition belongs in the text above, not in the decline option.
3. Roach motel: easy in, hard out
A streaming service takes a minute to subscribe to. Canceling, on the other hand, is hidden in a submenu, leads through several pages of retention offers, and ends with a note telling you to cancel by phone or by mail. Brignull called this pattern "roach motel," after the cockroach trap: easy to get into, almost impossible to get out of. Today, the label "hard to cancel" is also common.
The pattern relies on friction and inertia. Every extra step increases the chance that someone gives up and lets the subscription keep running. The number of cancellations drops, but the costs shift: into frustrated calls to support, chargebacks, bad reviews, and people who will never subscribe to anything from this provider again. In Germany, there's also a hard legal limit, more on that below.
A fair cancellation flow is as easy as signing up. The entry point is clearly visible in the customer account, the flow has just a few steps, and it ends with an unambiguous confirmation. A single, friendly retention offer is fine as long as it can be skipped with one click. A short, optional question about the reason for canceling gives you more insight than any artificially stretched flow.
4. Sneak into basket
When booking a trip, a travel cancellation insurance policy suddenly appears in the cart, even though nobody selected it. Or a store adds "premium packaging" at checkout. The product sneaks into the basket, and anyone who doesn't look closely pays for it.
The mechanism is inattention just before the finish line. At checkout, people want to be done and don't read every line. But the extra revenue comes at a high price: anyone who discovers the extra item on their invoice feels cheated. Complaints, cancellations, and bad reviews follow.
What's fair is an add-on that is clearly presented as an option: with a price, a brief benefit, and an active choice. "Add travel cancellation insurance for €29?" with two equally weighted answers respects the decision and still sells to everyone who actually wants the coverage.
5. Preselected options
During sign-up, the boxes "I'd like to receive offers from partner companies" and "My data may be used for personalized advertising" are already checked. Formally, you have a choice. In practice, it has already been made.
This is the power of defaults at work. Many people accept defaults without checking, either because they overlook them or because they assume the default is the recommended option. The result is mailing lists full of people who never wanted advertising in the first place. That drags down open rates and drives up unsubscribes.
The alternative: anything that means additional data, advertising, or costs starts unselected. Defaults are good when they're in people's interest, such as the most privacy-friendly option or standard shipping at no extra charge.
6. Nagging
An app asks every time it launches whether it may send push notifications. The only options are "Allow" and "Later." A permanent "No" isn't an option. This repeated pestering is called nagging.
The lever is fatigue. At some point, people agree just to make the question go away. But that consent is worth little: people who allowed notifications out of annoyance often turn them off again in their system settings at the next opportunity or uninstall the app.
A better approach is to ask at the right moment, with a concrete benefit and an answer that is respected. For example, after the first order: "Want us to let you know when your package is on its way?" A "No" is saved, and the setting can be changed at any time in the settings.
7. Disguised ads
A download page shows three large green "Download" buttons. Two of them are ads that lead to entirely different programs. On comparison sites, paid placements look like neutral results. The pattern is called disguised ads.
It exploits people's mental model of the page: they expect a button that looks like a control to actually be one. Anyone who has fallen for a disguised ad once will distrust every element on that website from then on, including the real ones.
What's fair is a clear visual and verbal separation. Ads are visibly labeled as "Ad" or "Sponsored," stand apart visually from controls, and don't imitate navigation or download buttons.
8. Cookie banners with a hidden "Reject"
A banner offers a large, colorful "Accept all" button and next to it an inconspicuous "Settings" text link. The option to decline only appears on the second layer, spread across numerous toggles, often without a "Reject all." Some banners color the reject button gray so it looks disabled.
This pattern combines visual emphasis, friction, and the impatience of people who just want to read an article. The result is high consent rates that stand on shaky legal ground. Consent obtained through deception is likely invalid, which makes the data based on it a risk as well.
A fair banner places "Accept all" and "Reject all" side by side on the same layer, at the same size and with comparable styling. Next to them, there's a path to detailed settings. The text explains in a few sentences what data is used for what purpose. And the decision can be changed later just as easily, for example via a permanently available link in the footer.
Why tricks don't pay off
Dark patterns usually improve the single metric that's currently being measured. The costs show up in other metrics, often later and in other departments.
The biggest cost is trust. People remember how a product made them feel. Someone who was blocked while trying to cancel will tell friends, forums, and review sites about it. A prevented cancellation isn't a win, it's a person who will leave at the next opportunity and warn others.
Then there are operational costs. Hidden cancellation options generate support requests. Sneaked-in products lead to complaints and chargebacks. Coerced consent fills mailing lists with people who were never interested. And manipulated numbers make data useless: a consent rate achieved through a hidden "Reject" button says nothing about what people actually want.
The legal situation in the EU and Germany
Dark patterns stopped being a purely ethical issue a while ago. The following overview is deliberately simplified and is not legal advice. For your specific product, get legal counsel if in doubt.
Digital Services Act: Article 25
The Digital Services Act (DSA, Regulation (EU) 2022/2065) has applied in full since February 17, 2024. Article 25 prohibits providers of online platforms from designing, organizing, or operating their online interfaces in a way that deceives or manipulates users or otherwise materially distorts or impairs their ability to make free and informed decisions.
Two limitations matter. First, the provision targets online platforms, such as marketplaces and social networks, not every company website. Second, the ban doesn't apply to practices already covered by the EU Unfair Commercial Practices Directive or the GDPR. The DSA also lists examples on which the European Commission may issue guidelines: giving more prominence to certain choices, repeatedly asking users to make a choice they've already made, and making it harder to cancel a service than to sign up for it.
The cancellation button under Section 312k BGB
Since July 1, 2022, Germany has required a so-called cancellation button (Kündigungsbutton). Under Section 312k of the German Civil Code (BGB), any business that lets consumers enter into a contract for a paid ongoing service via a website, such as a subscription, must also provide a cancellation button. It must be clearly legible and labeled "Verträge hier kündigen" ("cancel contracts here") or with equally unambiguous wording. It leads to a confirmation page where the necessary information is entered, and from there to a button labeled "jetzt kündigen" ("cancel now") or equally unambiguous wording. The business must then confirm receipt of the cancellation electronically. If the button is missing or doesn't comply with the law, customers can cancel at any time without observing a notice period. Financial services, among others, are exempt.
Since June 19, 2026, Section 356a BGB has additionally required a withdrawal function for distance contracts concluded online. Here, too, unambiguous labels are required, such as "Vertrag widerrufen" ("withdraw from contract") and "Widerruf bestätigen" ("confirm withdrawal").
Unfair competition law: the UWG
Germany's Act Against Unfair Competition (UWG) implements the EU Unfair Commercial Practices Directive. Its annex lists practices that are always prohibited toward consumers. Several of them match typical dark patterns precisely: falsely claiming that an offer is only available for a very limited time (No. 7), paid advertising disguised as editorial content (No. 11), undisclosed paid placements in search results (No. 11a), fake or misrepresented reviews (No. 23c), and persistent, unwanted solicitation via remote communication channels (No. 26). So a countdown that keeps restarting can be challenged under competition law.
For sneaked-in extra charges, Section 312a(3) BGB is also relevant: an agreement on a payment beyond the price of the main service must be made expressly. In e-commerce, it doesn't become part of the contract if it was brought about by a default setting. The preselected insurance in the shopping cart is therefore simply not validly agreed.
GDPR, TDDDG, and cookie banners
In Germany, cookie banners are governed by Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). Anyone who stores or accesses information on a user's device generally needs consent based on clear and comprehensive information, unless this is strictly necessary for the service the user requested. What counts as valid consent is defined by the GDPR: it must be freely given, specific, informed, and unambiguous, expressed through a clear affirmative action. Withdrawing consent must be as easy as giving it.
In 2019, the Court of Justice of the European Union ruled in the Planet49 case that a pre-checked box is not valid consent to cookies. The EDPB's Cookie Banner Taskforce published its report in early 2023: the vast majority of supervisory authorities consider it inconsistent with the requirements for valid consent when a banner offers an accept option but no way to reject on any layer. For button colors and contrast, the report calls for a case-by-case assessment of whether the design is obviously misleading.
EDPB guidelines on deceptive design patterns
In Guidelines 03/2022, whose final version 2.0 was adopted on February 14, 2023, the EDPB described how deceptive design patterns in social media interfaces can violate the GDPR. The guidelines group the patterns into six categories: overloading (a flood of requests or options), skipping (steering attention away from data protection aspects), stirring (influencing choices through emotions or visual nudges), obstructing (blocking or hindering), fickle (inconsistent, unclear design), and left in the dark (hidden information and settings). Although they're aimed at social media platforms, they and their best practices work as a review framework for any product that processes personal data.
Bright patterns: fair design without losing impact
The counterpart to dark patterns is sometimes called bright patterns or fair patterns. These are design patterns that understand the same psychological mechanisms but use them in people's interest.
A default can be the most privacy-friendly option. Social proof can show real, verifiable reviews. Urgency is fine when it's real. And priming, being influenced by previously perceived stimuli, can be used fairly too, for example when a product page leads with the real benefit instead of artificial scarcity.
A few principles help:
- Symmetry: Accepting and declining, signing up and canceling are equally easy.
- Honesty: Numbers, deadlines, and stock levels are true and verifiable.
- Respect: A "No" is accepted and saved, not renegotiated every day.
- Clarity: Prices, extra costs, and data use appear where the decision is made.
Consent rates may come out lower, but they're real. People who deliberately chose a newsletter actually open it.
How to review your own product
Dark patterns rarely come from a single decision. They creep in through many small optimizations, A/B tests, and targets. That's why a regular, systematic look at your own product pays off.
A good starting point is a walkthrough of the critical flows: sign-up, checkout, cookie banner, newsletter sign-up, notifications, account settings, and cancellation. Go through each flow once with the goal of saying "Yes" and once with the goal of saying "No." Count the clicks, note every spot where one option is visually favored, and read every button label out loud. If the two paths differ significantly, you've found a candidate.
An outside perspective helps too. Have people who don't know the product complete typical tasks, including uncomfortable ones like "Cancel your subscription" or "Reject all cookies." Watch where they hesitate or search. It's also worth looking at support requests, app store reviews, and chargebacks. If people keep describing the same spot, that's a clear signal.
Finally, one simple question helps in design reviews and when evaluating experiments: would we build this solution the same way if the people using it could see exactly how and why it works? If the honest answer is "No," that's a warning sign.
Checklist for your team
- Can every consent be declined with the same effort?
- Is canceling as easy as signing up, and does it meet the cancellation button requirements?
- Are all paid add-ons and marketing consents unselected by default?
- Are all countdowns, stock levels, and usage numbers accurate?
- Are both answers in a dialog worded neutrally, without inducing guilt?
- Is a "No" saved and respected?
- Are ads and paid placements clearly recognizable as such?
- Does the cookie banner offer "Accept all" and "Reject all" as equals on the same layer?
- Do experiments measure cancellations, complaints, and chargebacks alongside conversion?
Conclusion
Dark patterns use the same psychological mechanisms as good design, just in the wrong direction. They deliver short-term numbers but cost trust, create support work, and are an increasing legal risk under the DSA, German civil and competition law, and data protection law. For almost every dark pattern, there's a fair alternative. Honest deadlines, neutral microcopy, symmetric choices, and cancellation without hurdles don't make your product weaker. They make it more credible.