Predatory Design & Public Policy

If the internet were a city, most of us would learn its streets by getting lost. We would follow the big green “Accept” button because our bus is leaving, try to cancel a subscription only to find the exit sign hidden behind a call center, and click “Continue” on a checkout flow that quietly grew three fees in the last screen. That is not user error; it’s a kind of urban planning. The term “predatory design” (sometimes called “dark patterns”) is shorthand for interfaces tuned to steer you—through friction, defaults, and timing—toward choices you wouldn’t make if the path were straight. Regulators have moved from shrugging at this as “clever UX” to naming and prohibiting it. The law in 2025 is changing fast, sometimes unevenly, and that volatility can be intimidating. This guide grounds you in what predatory design is, how and why the rules are shifting, and, crucially, the channels where an individual complaint or comment still moves the needle.

What “predatory design” means in practice

Start with a simple picture: you face a fork in a digital path and one branch has a paved downhill lane while the other is gravel and uphill. That asymmetry—defaults, color, copy, order, and friction—nudges human behavior at scale. The Federal Trade Commission’s staff synthesis pulled years of research and cases into a single frame and gave the field a vocabulary: roach motels that make it easy to get in and hard to get out; confirm-shaming that frames refusal as failure; drip pricing that reveals the true cost late; misdirection that buries material terms; and sludge, the accumulation of small obstacles that turn consent into attrition. The report’s through-line is simple: design that obscures or impairs a user’s ability to make free and informed choices can be deceptive or unfair under U.S. law. (Federal Trade Commission)

Europe drew crisp lines years earlier and keeps sharpening them. The EU’s Consumer Rights Directive bans pre-ticked boxes for paid extras at checkout; if a trader wants your money for an add-on, you must actively say yes. That bright-line rule is why European checkout often feels cleaner. (Bird & Bird) In the privacy sphere, the Court of Justice’s Planet49 decision nailed down a related principle: pre-checked boxes are not valid consent for cookies; consent must be an affirmative act under the GDPR standard. That is not a vibe; it’s black-letter law cited by courts and enforcers across the bloc. (Curia, Bird & Bird)

The UK’s competition and privacy regulators have converged on the same diagnosis. Their “online choice architecture” work explains how labeling, layout, and timing systematically skew outcomes and why “harmful design” is as much a consumer-protection problem as a data-protection one. The UK’s new Digital Markets, Competition and Consumers Act (DMCC) converts that thinking into direct enforcement powers and new content, including explicit prohibitions around fake reviews and drip pricing. The tone is no longer “don’t be naughty”; it is “here is what’s unlawful,” with penalties that can reach into a firm’s global turnover. (www.drcf.org.uk, GOV.UK Assets, Reed Smith)

The point of gathering these strands is not academic. It’s to see that predatory design is a policy target now, not just a UX meme. You feel it when a cookie banner finally gives “reject all” the same prominence as “accept all,” when a subscription lets you cancel where you signed up, and when the checkout total is all-in rather than a shell game of fees revealed at the last possible click. The rules are trying to push the internet’s street grid back into human scale.

The 2025 snapshot: what the law actually says, and where it’s moving

The U.S. federal baseline is a mix of case law and targeted rules. Section 5 of the FTC Act is the big umbrella: design that deceives or unfairly impairs users can be illegal even if no one wrote “no pre-ticked boxes” into a statute. The Commission’s 2022 “Bringing Dark Patterns to Light” report is both a roadmap for companies and a hint to courts of what the agency will argue is deceptive. In parallel, the Restore Online Shoppers’ Confidence Act (ROSCA) sets guardrails for online negative-option offers: clear, conspicuous terms, express informed consent before a charge, and a simple mechanism to stop recurring billing. (Federal Trade Commission)

One fast-moving piece is cancellation parity. The FTC finalized a “click-to-cancel” update to the Negative Option Rule in 2024 to hard-wire the common-sense expectation that canceling should be at least as easy as signing up. In July 2025, the Eighth Circuit vacated that update on procedural grounds. That ruling did not bless sludge; it sent the agency back to its older tools—ROSCA, the 2021 policy statement, and case-by-case enforcement—while states keep raising their own floors. If your experience is “one-click in, phone-queue out,” you are still seeing a pattern regulators target; the vacatur changed the route, not the destination. (Federal Trade Commission, CCPC)

Airline and ticket-fee transparency shows the same tug-of-war. In April 2024, the U.S. Department of Transportation issued a final rule requiring upfront disclosure of baggage and change/cancel fees; courts later stayed portions of that rule and remanded it for procedural fixes, even while other refund protections moved ahead. The net effect for a traveler is choppy: the policy goal—no more surprises at checkout—is clear, but the compliance timeline is staggered by litigation. (Transportation.gov, Reuters, Federal Register)

States are filling gaps with concrete obligations you can feel. California’s Automatic Renewal Law requires conspicuous terms, a retainable acknowledgment that explains how to cancel, and an online cancel path if you enrolled online; New York’s statute likewise compels online cancellation for online sign-ups and pre-renewal reminders on longer terms. Those requirements, backed by enforcement and private actions, are why a growing number of sites now include a plain “end membership” control in the account portal. (Sciences Po, Data Matters Privacy Blog)

Privacy rules are also reshaping defaults. California’s attorney general has said that covered businesses must honor the Global Privacy Control (GPC) signal as a valid “do not sell or share” request, a stance made famous in the Sephora settlement. Colorado went further and formally recognized GPC as its first universal opt-out mechanism under the Colorado Privacy Act, making it mandatory for covered businesses as of July 1, 2024. If you enable GPC in your browser, the law in multiple jurisdictions now treats that as a binding opt-out—design can no longer pretend it didn’t hear you. (California AG, Colorado Attorney General)

Europe’s Digital Services Act (DSA) added a broad ban on “deceptive or manipulative” interface designs that materially impair a user’s free and informed choices. The language is intentionally technology-neutral because the target is behavior, not buttons. That provision sits alongside transparency duties for recommender systems and ads, collectively nudging platforms away from “consent by exhaustion.” (European Parliament)

The UK is pairing a competition lens with consumer protection. The CMA’s online choice architecture work, now reinforced by binding DMCC guidance, frames harmful design as both a fairness problem and a market-function problem. The regime explicitly calls out drip pricing and fake reviews, setting expectations for clear, all-in prices and credible review controls. This is not just interpretive guidance; the DMCC has switched on direct enforcement powers in 2025, including fines sized to matter. (GOV.UK Assets, Baker Botts)

Finally, the AI layer. The EU’s AI Act bans certain manipulative practices outright—systems that deploy subliminal techniques or exploit vulnerabilities in a way likely to cause harm are simply not allowed. That prohibition matters because a chunk of predatory design is now algorithmic: tailored urgency, personalized price ladders, and pressure loops that adapt to your fatigue. The Act draws a red line where design plus inference becomes dangerous manipulation. (Federal Trade Commission)

Why this keeps happening: incentives, experimentation, and the edge of ethics

Predatory design isn’t a conspiracy so much as a spreadsheet. When a team runs A/B tests at scale, tiny frictions that lift conversion by a point or two compound to big dollars, and ethical guardrails tend to lag behind revenue targets. Behavioral design is agnostic; the same craft that can make a sign-up page accessible can make a cancel button hard to find. If a company monetizes recurring revenue, the path of least resistance is to add optimism to the entrance and sludge to the exit.

The tactics also persist because they work differently on different people. Research and regulator evidence reviews have found that “subscription traps” and choice-architecture tricks hit vulnerable consumers harder; the same pause in a cancel flow that a well-resourced user sees as an annoyance can cause someone juggling multiple jobs or caregiving to miss a deadline and absorb a fee. UK evidence reviews commissioned around harmful online choice architecture emphasize that disproportionate impact. When rules aim for parity—“reject all” as easy as “accept all,” cancellation as easy as sign-up—they’re not chasing aesthetics; they’re leveling time and attention across users with wildly different bandwidth. (BIT)

There’s also the surveillance layer. Many checkouts and account pages run analytics tags and, in too many implementations, session-replay scripts that record keystrokes and clicks; poorly configured code can exfiltrate sensitive data from forms. Princeton’s CITP documented this mess years ago and privacy groups still find sloppy deployments in the wild. Awareness matters because the same pages that pressure you to accept are often watching how you resist. (Federal Trade Commission, Reuters)

The design patterns to watch—and how the rules map to them

Drip pricing is the most obvious. The practice is to advertise a base price and reveal mandatory fees late. The UK’s new guidance under the DMCC names unexpected, untrailed mandatory charges as unlawful; the FTC’s Unfair or Deceptive Fees Rule now bans hidden junk fees in lodging and event tickets in the United States. Both regimes are announcing a preference for “all-in” prices where the number you see is the number you pay. (storage02.forbrukerradet.no, California AG)

The “roach motel” is the most resented. You can enroll online in seconds, but you can’t cancel without a phone queue, an upsell gauntlet, or a maze of screens. Even after the Eighth Circuit’s procedural setback to the FTC’s rulemaking, ROSCA’s baseline still requires a “simple mechanism” to stop recurring charges, and states like California and New York hard-code online cancellation for online sign-ups. A clean design—same-medium cancel, immediate confirmation, clear end-of-access date—is both good practice and, increasingly, the law. (Federal Trade Commission, Sciences Po, Data Matters Privacy Blog)

Pre-ticked consent is the laziest trick. In the EU it is flatly invalid for cookies and forbidden for paid extras by the Consumer Rights Directive; in the U.S., the same move often crosses the line into deception because it treats silence as acceptance where clear, affirmative consent is required. The policy direction is unmistakable: if you want a “yes,” design for an actual “yes.” (Curia, Bird & Bird)

Personalized pressure is the newest frontier. When a recommender or paywall adapts the number of clicks between you and “cancel,” or changes the order of choices based on your hesitation, we move from static sludge to dynamic, targeted friction. The DSA’s general ban on manipulative interfaces and the AI Act’s prohibited-practices list are the first broad attempts to neutralize this escalation. Expect more law that talks about “materially distorting behavior” rather than enumerating every trick. (European Parliament, Federal Trade Commission)

Where the rules are trending next

Parity. Refusal must be as easy as acceptance. That principle shows up in cookie banners where “reject all” sits beside “accept all,” in cancellation flows that mirror sign-up, and in reminders that refresh consent before a free trial rolls to paid or a long term renews. California’s and Colorado’s privacy regimes also encode a parallel idea for data: a universal opt-out signal like GPC must be honored across sites rather than forcing individual hunts for tiny links. When consent and opt-out become one-click acts, design loses the ability to harvest silence. (California AG, Colorado Attorney General)

Transparency by default. The UK’s DMCC regime and the FTC’s fees rule both target hidden costs; DOT’s airline rules (some stayed, some in effect) push toward upfront disclosure of ancillary fees and standardized refund rights. Even where litigation slows a rule’s rollout, the direction of travel is agencies forcing total-cost clarity into the first screen rather than tolerating reveals at the end. (GOV.UK Assets, California AG, Federal Register)

Platform accountability. The DSA’s interface provisions and transparency duties put big services on a clock to explain recommender logic and avoid manipulative layouts; the UK’s CMA is already signaling that harmful online choice architecture will be an enforcement priority under its new powers. The point is to move from litigating each bad button to deterring a design culture that treats people as obstacles. (European Parliament, Browne Jacobson)

Children-first design. The UK’s Age-Appropriate Design Code has effectively rewritten defaults for global firms serving young users, and it inspired attempts at similar standards in the U.S., even as California’s version is tied up in court. The lesson for product teams—whether or not they are subject to those rules—is that regulators expect proactive design for vulnerability, not reactive disclaimers. (GOV.UK, Reuters)

Consent as a process. Reminder notices before conversions or long renewals, retainable acknowledgments with cancellation instructions, and audit-ready logs of both enrollment and exit are turning into baseline hygiene in law and practice. A “yes” must be retrievable, reviewable, and revocable. (Sciences Po)

How to push back today, as a person and as a team

As a person, you can take two kinds of action: fight the specific pattern in front of you and contribute to the rules that set the next default. On the first, treat every “accept” and “enroll” screen like a contract. If the page feels slippery, slow down. If you live in a state that recognizes global opt-out signals, switch on GPC in your browser so your refusal travels with you. California treats that signal as binding, and Colorado requires covered businesses to honor it. If you want a quick read on a site’s data hunger, use a scanner like The Markup’s Blacklight to see what trackers and session-replay scripts are present before you hand over your details. If you see pre-ticked boxes for paid extras or cookie consent, untick them on principle; in the EU that’s legally required, and elsewhere it’s a marker of a service that has not updated to modern norms. (California AG, Colorado Attorney General, Federal Trade Commission)

When a company won’t fix a pattern, use the channels built for leverage. The FTC’s ReportFraud portal routes complaints to the right place and builds the dataset for cases; the CFPB’s complaint system forces financial companies to answer within defined timelines; in the UK the CMA collects intelligence on unfair practices and the ICO handles data-protection complaints; EU cross-border consumer disputes can go through the European Consumer Centres network. None of these are magic-wands, but they are the pipelines regulators actually read. Include screenshots and timestamps; explain how the design impaired your ability to make a free and informed choice; cite the specific obligation if you know it. It is more effective than a tweet, and it teaches companies that a manipulative interface has a cost center. (ReportFraud.ftc.gov, Consumer Financial Protection Bureau, GOV.UK, ICO, European Commission)

You can also show up earlier in the pipeline. Proposed rules live on FederalRegister.gov and Regulations.gov with open comment windows. A short, concrete story that points to a clause and explains a real-world impact is more powerful than a form letter. If you care about cancellation parity, fees transparency, or manipulative UI bans, write it down and submit it where it counts. The comment portals exist to collect exactly your experience, and agencies do read and cite them. (Federal Register, Regulations)

If you work on product or policy inside a company, imagine a design review where the first question is “could the CMA, the FTC, or the ICO watch a screen recording of this flow and agree the path to ‘no’ is as easy as the path to ‘yes’?” Add instrumentation: time-to-cancel, completion rates, missing confirmations. Log consent and cancellation in a way that is both auditable and human-readable. Map your fees to an all-in total early in the journey. Treat GPC as the floor, not the ceiling, for user signals. And if you serve children or mixed audiences, start from the UK code and design upward. Regulators are moving toward “obligations by design”; teams that build like that already will spend less time in remediation and more time shipping.

Advocacy channels that actually work

Many readers ask, “Where can I send something that matters?” If the practice is a scam or an unfair design harming U.S. consumers, tell the FTC at ReportFraud.ftc.gov; if it’s a bank, lender, card, credit reporting, or payments issue, use the CFPB’s complaint portal which forwards to companies and tracks outcomes; in the UK, report market-wide problems to the CMA and lodge data complaints with the ICO; in the EU single market, the ECC-Net is designed for cross-border consumer disputes and will explain your rights and the next steps. This is not busywork; Volkswagen’s diesel scandal, airlines’ refund practices, and multiple subscription “trap” cases all began with small, consistent signals through these funnels. (ReportFraud.ftc.gov, Consumer Financial Protection Bureau, GOV.UK, ICO, European Commission)

For rulemaking, go straight to Regulations.gov or the Federal Register. Agencies are explicit about wanting concrete, information-rich comments rather than volume. If a proposed rule on drip pricing, cancellation parity, or manipulative interfaces opens, tell the story of how a pattern cost you time or money, and point to the clause you want tightened or clarified. Effective comments cite page or section numbers and describe real effects on real people. You do not need a lawyer to be useful; you need a paragraph that a career staffer can quote in the final rule’s “response to comments.” (Regulations, Federal Register)

Bottom line

Predatory design thrives in the fog between what’s technically disclosed and what’s humanly clear. The law is closing that gap—sometimes by banning specific tricks like pre-ticked boxes, sometimes by aiming at outcomes like “no hidden fees,” and increasingly by saying the interface itself cannot be manipulative. The result won’t be a sterile internet; it will be an internet that treats your time and attention as finite resources rather than raw material. In the meantime, you have leverage. You can slow down at the fork in the path, switch on GPC, collect proof, and send complaints and comments through the channels built to hear them. Taken together—and multiplied by thousands of people doing the same—those small acts are how default settings change.

Glossary (plain-English, right where you need it)

Dark patterns / predatory design is the family name for interface choices that subvert or impair autonomy, nudging you toward outcomes you wouldn’t pick if paths were symmetric. The FTC’s synthesis organizes common patterns and the legal theories—deception and unfairness—used against them. (Federal Trade Commission)
Drip pricing is the late reveal of mandatory charges. The UK’s new DMCC guidance and the FTC’s Unfair or Deceptive Fees Rule both push toward all-in prices presented early rather than fees tucked into the last screen. (GOV.UK Assets, California AG)
Roach motel describes a flow that is easy to enter and hard to exit. Even with the FTC’s 2025 procedural setback, ROSCA still requires a “simple mechanism” to stop recurring charges, and state laws now compel online cancellation for online enrollments. (Federal Trade Commission, Sciences Po, Data Matters Privacy Blog)
Pre-ticked boxes are defaults that convert inertia into consent. EU consumer law forbids them for paid extras, and EU privacy law deems them invalid for cookie consent after Planet49. The animating principle is that consent must be a clear affirmative act. (Bird & Bird, Curia)
Global Privacy Control (GPC) is a browser signal that communicates “do not sell or share my data.” California treats it as a binding opt-out under the CCPA/CPRA, and Colorado recognized GPC as its first universal opt-out mechanism with mandatory honoring by covered businesses as of July 1, 2024. (California AG, Colorado Attorney General)
Digital Services Act (DSA) is the EU framework that, among other things, prohibits deceptive or manipulative interfaces that materially impair users’ free and informed choices and adds transparency duties for recommender systems and ads. (European Parliament)
DMCC is the UK’s 2024 Digital Markets, Competition and Consumers Act. It updates unfair-practices law, targets fake reviews and drip pricing, and gives the CMA direct consumer-law enforcement powers with significant penalties, backed by guidance published in 2025. (GOV.UK Assets, Baker Botts)
EU AI Act is the first broad framework for AI in Europe. It bans certain manipulative practices outright—subliminal techniques or exploitation of vulnerabilities likely to cause harm—signaling a line between influence and manipulation at the systems level. (Federal Trade Commission)
Session replay is code that records user interactions on a page. Academic work has shown that poorly configured replay scripts can capture sensitive form data, creating privacy and security risks at the very moment a site is asking for trust. (Federal Trade Commission)

Sources & further reading

The FTC’s “Bringing Dark Patterns to Light” is the best single primer on manipulative interface tactics and how they map to U.S. deception and unfairness law. (Federal Trade Commission)
EU foundations on defaults and consent come from the Consumer Rights Directive’s ban on pre-ticked boxes for paid extras and the CJEU’s Planet49 decision confirming that pre-checked cookie consent is invalid under the GDPR standard. (Bird & Bird, Curia)
The DSA’s Q&A materials explain the new prohibition on manipulative interfaces that materially impair users’ free and informed choices, alongside transparency duties for recommender systems and ads. (European Parliament)
The UK’s arc runs from the CMA’s “Online Choice Architecture” work to binding 2025 guidance under the DMCC, including explicit treatment of drip pricing and fake reviews and the switch-on of direct enforcement powers. (GOV.UK Assets, Baker Botts)
On cancellation parity, see the FTC’s 2024 negative-option rulemaking and the Eighth Circuit’s July 2025 vacatur on procedural grounds; on state floors, see California’s and New York’s online-cancellation requirements for online sign-ups. (Federal Trade Commission, CCPC, Sciences Po, Data Matters Privacy Blog)
For fees transparency, pair the FTC’s Unfair or Deceptive Fees Rule for lodging and ticketing with DOT’s 2024 airline refund and fee-disclosure rules and the subsequent court stays that paused pieces of the transparency rule while leaving refund rights moving forward. (California AG, Federal Register, Reuters)
On privacy signals, California’s attorney-general statement and settlement materials around GPC, and the Colorado attorney general’s formal recognition of GPC as the state’s universal opt-out mechanism, show how user-enabled signals are becoming enforceable refusals across jurisdictions. (California AG, Colorado Attorney General)
For evidence on replay scripts and privacy at checkout, see Princeton CITP’s work and advocacy summaries that document how session-replay code can capture sensitive inputs when sites fail to filter. (Federal Trade Commission)
If you want to take action, the FTC’s ReportFraud portal, the CFPB’s complaint system, the UK’s CMA and ICO pages, and the EU’s ECC-Net explain the processes and limits of each channel. For rulemaking, FederalRegister.gov and Regulations.gov provide the official pipelines for public comments. (ReportFraud.ftc.gov, Consumer Financial Protection Bureau, GOV.UK, ICO, European Commission, Regulations, Federal Register)

Note on scope and dates: This article reflects U.S., UK, and EU developments through August 31, 2025. Several items—especially the FTC’s negative-option update and DOT’s fee-disclosure rule—are in active litigation, which affects timing but not the broader direction of travel toward parity, transparency, and design-level obligations.