Yes — dark patterns are illegal in many situations under existing U.S. law, even though no single federal statute uses that phrase in its title. The Federal Trade Commission treats manipulative interface design as a deceptive or unfair trade practice under Section 5 of the FTC Act, a dedicated federal rule now requires subscription cancellation to be as easy as sign-up, and several state privacy laws name dark patterns by name and void any consent obtained through them. The framework has real teeth, and enforcement penalties have climbed into the billions. It also has gaps, which matter if you’re trying to figure out whether a specific design you encountered crosses the line.
What Counts as a Dark Pattern
A dark pattern is an interface design that steers you toward a choice you wouldn’t make if the options were presented honestly. The FTC has adopted the term in its enforcement actions and its 2022 staff report.1Federal Trade Commission. Bringing Dark Patterns to Light – FTC Staff Report Common examples include:
- Confirmshaming — guilt-tripping you into opting in (“No thanks, I don’t want to save money”).
- Roach motels — easy sign-up, buried cancellation.
- Drip pricing — mandatory fees revealed only at checkout.
- Disguised ads that look like content or navigation.
- Forced continuity — silently converting a free trial into a paid subscription.
- Privacy traps — defaulting to maximum data sharing with opt-outs hidden in nested menus.
Whether any particular design is unlawful depends on which of the laws below it runs into.
The Federal Laws That Make Dark Patterns Illegal
Section 5 of the FTC Act
The broadest tool is Section 5, which declares “unfair or deceptive acts or practices in or affecting commerce” unlawful.2Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful; Prevention by Commission The language is intentionally flexible. The FTC doesn’t need a statute that specifically names confusing button layouts or hidden cancellation flows. If a design tricks consumers into spending money or giving up data they wouldn’t have surrendered with honest disclosure, it fits within Section 5.
The FTC’s 2022 staff report cataloged how dark patterns function and put companies on notice that the agency views them as deceptive business practices.3Federal Trade Commission. FTC Report Shows Rise in Sophisticated Dark Patterns Designed to Trick and Trap Consumers
ROSCA
The Restore Online Shoppers’ Confidence Act targets negative option marketing: any online transaction where your silence or inaction gets treated as agreement to recurring charges. Under ROSCA, a seller must clearly disclose all material terms before collecting your billing information, obtain your express informed consent before charging you, and provide a simple way to stop recurring charges.4Office of the Law Revision Counsel. 15 U.S. Code 8403 – Negative Option Marketing on the Internet Dark patterns that obscure subscription terms or make cancellation deliberately confusing violate all three requirements.
The Click-to-Cancel Rule
The FTC finalized its click-to-cancel rule in late 2024, and regulated businesses were required to comply by May 2025.5Federal Register. Negative Option Rule The core requirement is straightforward: canceling a subscription must be as easy as signing up for one. Sellers cannot force you through a maze of retention screens, phone calls, or chat queues when you could sign up with a single click.6Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Making It Easier for Consumers to End Recurring Subscriptions and Memberships The rule also requires clear disclosure of all material terms before billing information is collected and prohibits misrepresenting facts related to negative option features.
How the FTC Has Actually Enforced This
Enforcement is where the theory becomes real, and the penalties have climbed sharply.
In 2023, the FTC finalized an order requiring Epic Games, maker of Fortnite, to pay $245 million in consumer refunds. The agency found that Fortnite’s confusing and inconsistent button layouts caused players to make unintended purchases with a single accidental press, and that children racked up unauthorized charges without parental involvement.7Federal Trade Commission. FTC Finalizes Order Requiring Fortnite Maker Epic Games to Pay $245 Million for Tricking Users into Making Unwanted Charges
In September 2025, the FTC secured a $2.5 billion settlement against Amazon over its Prime subscription practices. The agency alleged that Amazon designed confusing interfaces to enroll millions of consumers in Prime without genuine consent, then created a deliberately complex cancellation process to prevent them from leaving. The settlement included a $1 billion civil penalty, the largest ever in a case involving an FTC rule violation, plus $1.5 billion in refunds for an estimated 35 million affected consumers.8Federal Trade Commission. FTC Secures Historic $2.5 Billion Settlement Against Amazon Amazon was also required to redesign its enrollment and cancellation flows, add a clear “decline” button, and ensure cancellation is available through the same method used to sign up.
State Privacy Laws That Ban Dark Patterns by Name
Several state privacy laws use the term “dark pattern” explicitly and define it, which removes the ambiguity that can complicate a Section 5 analysis.
California’s Consumer Privacy Act defines a dark pattern as “a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice.”9California Legislative Information. California Civil Code Section 1798.140 Any consent obtained through a dark pattern is void under California law.10California Privacy Protection Agency. Enforcement Advisory No. 2024-02 If a company uses a manipulative interface to get you to agree to data collection, the agreement doesn’t count. As of 2025, intentional violations carry penalties up to $7,988 per violation, adjusted annually for inflation.11California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Administrative Fines
Colorado’s privacy regulations prohibit controllers from using interfaces that subvert user autonomy, manipulate consumers into providing consent, or impair their decision-making.12Colorado Secretary of State. Colorado Privacy Act Rules 4 CCR-904-3 Connecticut’s data privacy act defines dark patterns broadly enough to include “any practice the Federal Trade Commission refers to as a dark pattern,” so the definition expands automatically as the FTC identifies new tactics.13Connecticut General Assembly. Public Act No. 22-15 – Connecticut Data Privacy Act Like California, Connecticut voids any consent obtained through dark patterns. Several other states have enacted comparable laws, and the common thread is the same: consent obtained through manipulation isn’t really consent.
Where the Law Still Falls Short
Existing law doesn’t reach every manipulative design, and it’s worth knowing where the edges are before you assume a particular tactic is actionable.
The biggest gap is definitional. Under the FTC Act, conduct has to qualify as “deceptive” or “unfair,” which requires a case-by-case analysis. That works for obvious cases like hiding a cancellation button. It’s less effective against subtler manipulation: a countdown timer that creates false urgency, a pre-checked box for a more expensive option, or a color scheme that makes “accept all cookies” visually dominant while “decline” blends into the background. Whether these cross into deception depends on context, and companies exploit the ambiguity.
Enforcement is also resource-constrained. The FTC can pursue major cases against Amazon and Epic Games, but it cannot police every subscription service and e-commerce site. State attorneys general face the same limits. Most consumers who lose $15 to a hidden charge never file a complaint.
Most of the state statutes that name dark patterns also focus on privacy and consent. Dark patterns that manipulate purchasing decisions, game mechanics, or content engagement fall into a less regulated space unless they rise to the level of traditional fraud or deception. And a company operating nationwide faces different definitions depending on where its users live.
What to Do If a Dark Pattern Cost You Money
If a design tricked you into a charge or a data disclosure, you have several practical options.
File a report at ReportFraud.ftc.gov. The FTC is upfront that it cannot resolve your individual complaint, but reports feed into the Consumer Sentinel database used by over 2,000 law enforcement agencies to detect patterns and build cases.14Federal Trade Commission. Report Fraud The Amazon and Epic Games cases both started with consumer complaints. Volume matters.
For direct financial recovery, most states have consumer protection statutes that let you sue for deceptive trade practices. These laws often provide for damages beyond what you actually lost, including double or triple damages for knowing violations, plus attorney’s fees. That fee-shifting provision is what makes small-dollar cases viable, because it lets attorneys take them on contingency.
If you were charged for a subscription you didn’t intend to start, dispute the charge with your bank or credit card company. Under the click-to-cancel rule now in effect, sellers must provide a cancellation method as simple as the sign-up process.6Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Making It Easier for Consumers to End Recurring Subscriptions and Memberships If they don’t, that’s itself a violation you can report. Document the design with screenshots before you cancel or dispute anything. What looks like a minor annoyance might be the evidence that tips a pattern into an enforcement action.