Dark patterns: what they are and the UK and EU rules against them

Dark patterns, also called deceptive design, are interface choices that push people into decisions they wouldn’t otherwise make: buying more, sharing more data, or staying subscribed. A pre-ticked add-on, a countdown that resets, a “Reject” button hidden behind three menus. They can lift short-term numbers, which is why they spread. They also lose customer trust, and in the UK and EU many of them are now unlawful with large fines attached.

This guide explains the common types, the rules in force as of October 2026, what is coming next, and how to review your own site. It is a practical overview, not legal advice.

Common types of dark pattern

Regulators describe the same handful of tactics again and again. The EU’s Digital Services Act describes dark patterns in recital 67 as practices that materially distort or impair users’ ability to make free and informed decisions, whether on purpose or in effect. Its examples, along with others from UK guidance, include:

UK rules: consumer law and the CMA

The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) replaced the UK’s main consumer protection rules. The CMA’s unfair commercial practices guidance (CMA207) says the new provisions apply to practices from 6 April 2025. Under the Act, the CMA can now decide for itself that consumer law has been broken and, according to its announcement of the new regime, fine companies up to 10% of global turnover.

The DMCC Act lists practices that are always unfair, whatever their effect. Several match dark patterns directly:

• False limited-time claims. CMA207 gives the example of a countdown timer that restarts while the offer continues. A genuine deadline is unlikely to be a problem.
• Fake reviews. Writing, commissioning or publishing fake reviews, or hiding that a review was incentivised, is banned.
• Drip pricing. Showing a headline price and adding mandatory charges later is prohibited.

Beyond the banned list, CMA207 also treats as unfair misleading presentation (such as a “Be quick!” pop-up when stock is plentiful), hiding important information or giving it in a way people are unlikely to see, and aggressive practices. Its examples of aggressive practice include a cancellation process with repeated clicks and unnecessary risk warnings that make it harder to exercise rights.

UK rules: data protection and the ICO

When a dark pattern nudges people to share personal data, data protection law applies too. In a joint article in August 2023, the ICO and CMA called for an end to damaging website design practices. They named tactics such as wording that suggests there is a right or wrong privacy choice, making some options easier to find, and presenting choices to steer users. The ICO singled out cookie banners and said a banner should make it as easy to reject non-essential cookies as to accept them. It said it would take enforcement action if it didn’t see improvements.

EU rules: the DSA and what’s next

Article 25 of the Digital Services Act bans providers of online platforms from designing or operating their interfaces in a way that deceives or manipulates users or materially distorts their ability to make free and informed decisions. The DSA has applied to online platforms since 17 February 2024. Article 25 does not cover practices already governed by the EU’s Unfair Commercial Practices Directive or the GDPR, which deal with many dark patterns through their own rules. The Article names practices the Commission may issue guidance on, including giving more prominence to certain choices, repeatedly asking users to choose after they have already chosen, and making it harder to cancel than to sign up.

More rules are planned. A European Parliament briefing dated 5 October 2026 says the Commission’s proposed Digital Fairness Act had not yet been adopted, was expected in the fourth quarter of 2026, and was then scheduled for mid-November. Consultation topics included dark patterns, addictive design and difficulties cancelling online contracts. Check the current position before relying on it.

What’s coming in the UK

The DMCC Act also creates a subscription contracts regime. A government announcement on 9 August 2026 says the rules take effect in January 2027. Businesses will have to give clearer information up front, send regular reminders and make exiting much easier, and a new 14-day cooling-off period will apply after a free trial ends or a long contract renews. Earlier commentary suggested later dates; the August 2026 announcement is the most recent official statement found. The same announcement said a consultation would open in autumn 2026 on adding fake “was” prices and misleading discount claims to the banned list.

A worked review

An example (illustration only). An online meal-kit company reviews its sign-up and cancellation flow against the rules above. It finds:

1. A “Today only: 50% off” banner that has run every day for months. It is replaced with a dated promotion that ends on the date shown.
2. A delivery fee that only appears at the final step. It moves into the headline price.
3. Cancellation needs a phone call during office hours, while sign-up is online. An online cancel button is added to the account page, reachable in as few steps as sign-up.
4. The cookie banner has “Accept all” as a button and “Manage settings” as a small link. A “Reject all” button of equal size is added.
5. The decline link on the discount pop-up reads “No, I prefer paying full price”. It becomes “No thanks”.

How to audit your own site

• Walk through sign-up, checkout and cancellation as a customer, and count the steps in and out.
• Check every urgency or stock claim is true at the moment it is shown.
• Make sure the price shown first includes all mandatory charges.
• Compare the size, colour and position of “accept” and “decline” options.
• Read every decline message aloud. If it mocks the user, rewrite it.
• Check that defaults are what most customers would choose for themselves.
• Keep a record of changes and the reasons for them.

Persuasive design is not the problem. Clear benefits, honest deadlines, real reviews and a well-placed button are all legitimate. A useful test is whether a customer would still be happy with the decision once they understood exactly how the page was designed. If they would feel tricked, change it. For anything high-risk, such as pricing displays or subscription terms, take legal advice.