Dark patterns have been used to describe design practices that trick or manipulate users into making certain choices. One out of every four internet users experience dark patterns in the digital world. In this paper, all vital guidelines issued by government commissions or authorities across the globe have been studied. These countries include mainly United States of America (USA), South Korea, India, and European Union, along with California, Australia, United Kingdom, Kenya, and Argentina. The comparative analysis of the guidelines for dark patterns from major government commissions or authorities has been performed on basis of national guidelines, types of dark patterns and following norms of guidelines. It is observed that there is a little to no enforcement effort by the required authorities to counter dark patterns. All the countries across the globe should come together to create universal guidelines against dark patterns, with a global authority or commission.
There are about 5.35 billion people using the internet across the globe, which is equal to 66.2% of
the world’s total population [
Another study was conducted by Princeton University, USA in the year 2019. It found 1,818
instances of dark patterns specifically on shopping websites. These instances all together
represented 15 types of dark patterns in 7 broad categories. These dark patterns were found on
1,254 out of around 11,000 shopping websites. It amounts to around 11.1 % of the dataset used. It
also found that there were 22 third-party entities that provided the shopping websites the services
required to create and implement dark patterns. Two of the above entities even publicly advertised
that they can help websites to use deceptive messages [
With such a big issue in hand, several national government commissions or authorities have taken initiatives to counter dark patterns as well as spread awareness of the problems caused by dark patterns. A few government commissions or authorities have taken a direct approach by clearly providing guidelines against the dark patterns. Some other government agencies took an indirect approach to restricting some of the dark patterns by creating amendments to their existing privacy or digital laws. A few other government agencies have taken actions against the violators based on interpretation of the existing laws. Hence, this guideline overview discusses the vital guidelines on dark patterns and aims to shed light on the insufficient effort by the government commissions or authorities.
Following are the four vital national guideline documents or reports on dark patterns. These guideline documents or reports are discussed in chronological order of their publication.
The first document represents a guideline document for dark patterns published in March 2022
by the European Data Protection Board (EDPB) for the countries under the European Union (EU)
region. The scope of this document is to recommend developers and give guidance for the design of
the interface of social media platforms. The document has categorized the dark patterns into 6
categories and 15 sub-categories along with examples [
The second document is a report for dark patterns published in Sept. 2022 by the Federal Trade
Commission (FTC) for the USA. This report discusses key topics from the ‘Bringing Dark Patterns to
Light’ workshop and academic literature. FTC makes practical recommendations for entities, aiding
them when they develop, design, and improve their online interfaces. The report includes the rise of
dark patterns in the digital marketplace and 4 common categories of dark patterns with relevant
examples [
The third document represents a report published in Aug. 2023 by the Korean Fair-Trade
Commission (FKTC) for South Korea. This report establishes a regulatory measure to control online
dark patterns. The authorities involved in this process are KFTC, Korean Communication
Commission (KCC) and the Personal Information Protection Commission (PIPC). The report has
categorized dark patterns into 4 major categories and 19 distinct types and provided
recommendations for each of the types [
The fourth document represents a guideline document that was published in Nov. 2023 by the
Central Consumer Protection Authority (CCPA) in India. It states that the guidelines against dark
patterns prohibit any person, including platforms, from engaging in any form of dark pattern
practice. The report has provided specific types of dark patterns that are prohibited. The report has
categorized dark patterns into 13 different types and provided relevant examples [
Apart from above given national guideline documents on dark patterns, a few other countries have also taken steps to counter the dark patterns in their online ecosystem. These countries do not have any specific guidelines like the four discussed cases in this section.
In California, the California Consumer Privacy Act (CCPA) - 2018 has regulations implemented to
suppress the use of dark patterns. The CCPA prohibits the use of dark patterns that have a substantial
effect on the consumer’s choice to opt-out of the schemes that benefit the companies or entities [
In Australia, the Office of the Australian Information Commission (OAIC) has identified some
entities operating online using dark patterns that are designed to nudge the users. Dark patterns in
trade or commerce are considered as a violation of the Australian Consumer Law (ACL) - 2010. The
Australian Competition and Consumer Commission (ACCC) has also released a guide on ‘Online
Platforms and the Australian Consumer Law’ in 2019, which has outlined the legal requirements for
online platforms for effective consumer protection [
The United Kingdom (UK) has taken steps to address dark patterns. The Competition and Markets
Authority (CMA) has a new phase of 'Online Rip-off Tip-off' campaign. This campaign aims to
encourage users to ‘spot and avoid misleading online sales tactics’ and to report the organizations
involved. The UK government is actively working on reducing the use of dark patterns in online
interfaces [
The National Directorate on Consumer Protection and Consumer Arbitration (DNDCYAC) in Argentina has worked with the United Nations Conference on Trade and Development (UNCTAD) on a report ‘Consumer Education and Business Guidance on Dark Commercial Patterns’ [17]. It has recently issued Resolution 994/2021, that forbids some dark patterns or deceptive clauses, for example, sneaking into a basket and presuming a consent from the consumer [18].
In Kenya, the Part VI of the Competition Act No. 12 - 2010, dealing with Consumer Welfare
contains provisions such as false or misleading representations and unconscionable conduct [17].
The Competition Authority of Kenya (CAK) relies upon these provisions to deal with dark patterns.
These specific provisions are on the supply of products, but they are also used by the government for
enforcement against dark patterns [
This section is mainly focused on a comprehensive comparison among the four guidelines
documents of leading G20 countries or regional bodies [
(GDPR)regulation and compliance Recent Enforcements No enforcement till The Italian Data No enforcement till date Protection Authority date (Garante) issued a EUR 300 k (USD 323 k) fine for the use of dark patterns in breach of the EU General Data Protection Regulation (GDPR) and complaints
consumer
In March 2023, FTC ordered Epic Games to pay USD 245 million for violation of ‘Design elements that lead to unauthorized charges’
The vital observations from the comparative analysis of the guidelines on dark patterns given by different commissions or authorities as depicted in table 1, are as follows: • • • • • • •
All four authorities i.e. CCPA, KFTC, EDPB, KFTC focus on ‘Online Consumer Protection’, while formulating the national guidelines for dark patterns. The FTC and EDPB also focus on ‘Data Protection’ and ‘Consumer Consent Issues’.
The guidelines for dark patterns are issued by a specific regulatory authority, in the case of the CCPA and the KFTC; they are also the enforcement authorities. In the case of the EDPB and the FTC, the guidelines for dark patterns are issued by them as broader regulatory authorities; but they do not look into enforcement. The enforcement is taken care of by the related USA state authorities in case of the FTC. And the national authorities in the EU in case of EDPB as per their respective jurisdictions.
The prohibited practices related to guidelines, show the priorities and concerns of the specific regulatory authorities or commissions. For example, CCPA focuses more on dark patterns related with consumer protection like ‘Basket Sneaking’ and ‘False Urgency’; whereas the EDPB focuses more on data protection and consumer consent issues like ‘Language Discontinuity’ and ‘Conflicting Information’.
The CCPA and the KFTC authorities have not given any specific transparency requirements. The EDPB and the FTC have provided specific transparency requirements, which are specifically targeted towards ‘Consent Issues’ and ‘Data Privacy’.
All the guidelines have a wide range of enforcement mechanisms like administrative fines, legal actions, injunctions, and imprisonment. CCPA is the only authority to include imprisonment as an enforcement mechanism in the guidelines.
The approach on updates and amendments related with guidelines differ significantly. Some authorities like the FTC mentions regular updates on emerging issues, while other authorities focus on periodic reviews of technical advancements and user reviews. The KFTC and the CCPA have not made any updates and amendments to their guidelines as these authorities are the latest to issue guidelines on dark patterns.
In recent times, there have been some enforcements, the FTC where they have fined USD 245 million to Epic Games (the makers of Fortnite video game). In another enforcement, the • •
Italian Data Protection Authority (based on the EDPB guidelines) fined EUR 300 k (USD 323 k) to a marketing agency for breach of the dark pattern guidelines.
UK’s Competition and Markets Authority (CMA) held Microsoft Corp. liable for its unclear
upfront terms, difficulty in turning off auto-renewal (Subscription Trap). Their new users
were unknowingly paying for unused services in their game pass membership [
The Swedish Data Protection Authority (IMY) investigated Klarna Bank AB. It is a
multinational company that provides credit and non-credit solutions in 17 countries through
various financial services [
There are a vast variety of dark patterns accessible to companies or entities. All government
commissions or authorities do not recognize all the types of dark patterns. Table 2 gives the
comparative analysis of the different types of dark patterns defined by regulatory commissions or
authorities viz. FTC, EDPB, CCPA and KFTC in their guidelines. The Table 2 is divided into three parts
High-Level, Miso-Level and Low-Level Patterns [
High-Level Patterns: These are the most abstract types of dark patterns. These include general
strategies that use manipulative or deceptive elements. These patterns are not confined to any
specific context and can be applied across various devices or technologies and application types [
Meso-Level Patterns: This type of dark pattern ties the gap between high- and low-level dark
patterns. These include a specific approach at undermining the user’s ability to make an informed
decision. These patterns can be interpreted in a way that is required for a specific context [
Low-Level Patterns: These types of dark patterns are very background dependent and include
precise execution methods that limits the user’s ability to make decision. These patterns are
described in visual or temporal forms or both. These patterns can be detected through various means
which include algorithmic, manual or any technical means [
The essential observations from the comparative analysis of the different types of dark patterns given by commissions or authorities as depicted in table 2, are as follows: • • •
Most of the High-Level Patterns are recognized in their reports or guidelines by almost all the government authorities or commission. Some of the patterns are recognized directly and some are them are inferred indirectly in their documents.
It is observed that FTC has the most well-rounded guidelines in their report amongst all. They have recognized the greatest number of patterns compared to other authorities.
EDPB, CCPA and KFTC have recognized almost equal number of types of dark patterns.
The types of dark patterns that are addressed only in report given by the FTC are: ‘Roach Motel’, ‘Immortal Account’ and ‘High Demand’. The number is small because the guidelines given by the FTC are very similar to the guidelines given by EDPB.
The types of dark patterns that are recognized only in guidelines given by the EDPB are: ‘Dead End’, ‘Adding Steps’, ‘Privacy Maze’, ‘Conflicting Information’ and ‘Wrong Language’. The list is sizable because the EDPB also focused on ‘Data Protection’ and ‘Consumer Consent Issues’.
The types of dark patterns that are specifically covered in guidelines given by the CCPA are: ‘Forced Action’.
The types of dark patterns acknowledged only in guidelines given by the KFTC are: ‘Choice Overload’ and ‘False Hierarchy’. The list is small as the guidelines published by KFTC and CCPA are very similar.
It is very important to write effective guidelines of dark patterns. Effective guidelines will always
play a pivotal role in helping users and guiding developers towards practices that prioritize user
well-being. While writing guidelines for dark patterns, it is important to follow the norms of
guidelines given below [
Start with a Verb: A guideline should start with an actionable verb to convey a specific action or behavior.
Be Concise: A guideline should be brief and to the point, ensuring that it is easy to understand and implement.
One Idea per Guideline: A guideline should focus on a single idea or concept to avoid confusion and maintain clarity.
Use Simple Language: A guideline should use uncomplicated language to enhance accessibility for a diverse audience.
Ensure Actionability: A guideline should be such that it can be easily translated into practical actions.
Length: An ideal guideline should be no more than thirteen words long.
KFTC
Be Concise
Start with a Verb
Length (13 words)
Multi-Language Support Guideline Rank for Compliance
Hindi) 2 + Followed (English Somewhat Followed + 23 EU languages) (Korean + English
Summary) 1 Lacks Compliance
The key observations from the comparative analysis among the guidelines issued by authorities on aspects to keep in mind while writing the regulatory guidelines as depicted in table 3, are as follows:
The rules that are followed by all the guidelines are: ‘Use Simple Language’, ‘One Idea per Guidelines’ and ‘Ensure Accountability’.
None of the guidelines comply with the guideline length which is 13 words.
The EDPB guidelines are the most user friendly as they officially provide the guidelines in English + 23 EU languages, followed by CCPA who provides the guidelines in Hindi + English. KFTC guidelines lack user friendliness as the guidelines are published in Korean and an English summary is available.
EDPB guidelines rank highest in compliance, followed by CCPA guidelines, while KFTC guidelines lack compliance.
A handful number of countries have published guidelines against dark patterns and these guidelines differ from one another. A few numbers of dark pattern types are recognized in these guidelines. The government commissions or authorities of many countries are still using interpretation of the existing laws to tackle dark patterns. This shows that there has been a limited effort taken by several governments to define suitable guidelines against dark patterns.
The comparative study of dark patterns has highlighted several interesting aspects such as a focus on consumer consent, consumer protection, their transparency requirements and norms of guidelines followed. It is observed that there is a little enforcement effort by the required authorities to counter dark patterns. Companies are still openly using these dark patterns and there have been no enforcement actions against them. The respective authorities must understand that even after defining guidelines; they are required to take some serious enforcement action against the violators.
The variation and dissimilarities among different guidelines proposed by commissions or authorities have made it challenging for the companies / entities to comply with guidelines for dark patterns. All the countries across the globe should come together to create universal guidelines against dark patterns, with a global authority or commission.
UNCTAD Working group on Consumer Protection in e-commerce. https://unctad.org/system/files/informationdocument/ccpb_WG_EC_Report_Dark_commercial_patterns_en.pdf. Accessed February 20, 2024.