Dark Patterns: An S-Tier Behavioral Designer’s Guide

Every product team I have ever worked with has, at some point, sat in a meeting where someone leaned over the table and said the phrase just bump conversion a little, and what they actually meant was: take an existing feature people sort-of want, and then nudge, hide, sneak, time-pressure, confirmshame, or pre-check until enough of them say yes by accident. That nudge is rarely written down anywhere. It is rarely on the roadmap. It is almost never owned by a single person. And the cumulative effect, across thousands of micro-decisions over a single quarter, is the modern internet: an environment so saturated with manipulation patterns that researchers have to invent a vocabulary just to name them.

Harry Brignull invented the original vocabulary in 2010 on a personal blog called darkpatterns.org. He named twelve patterns, drew the categories with a designer’s eye, and walked away expecting it to be a niche concern for the UX community. Sixteen years later the European Union has banned them by name in the Digital Services Act, the United States Federal Trade Commission has issued a 32-page enforcement report, the California Privacy Rights Act has codified them as illegal in consent flows, and the academic literature has produced large-scale audits showing that more than 1,200 of the top 11,000 shopping sites use them with statistical regularity. Brignull’s personal blog became, accidentally, the field’s anchor.

I have been arguing the same fight from a different angle for over a decade. The Octalysis Framework I built in 2012 explicitly named three Core Drives as the “Black-Hat” half of the human motivation map: Scarcity & Impatience, Unpredictability & Curiosity, and Loss & Avoidance. The whole point of separating Black-Hat from White-Hat was to give designers a way to see, before they shipped, whether a system was extracting behavior they would later regret extracting. Dark patterns are what happens when you take the Black-Hat half of Octalysis, divorce it from the user’s actual interest, and weaponize it in a checkout flow. This guide is the long-form version of that argument — the actual research, the actual taxonomies, the place where the construct stops being useful, and the way I think every behavioral designer should layer Brignull’s vocabulary on top of an Octalysis design audit so the resulting product is something humans want to keep using rather than something they tolerate until they can escape it.

Speed Run Notes

• Dark patterns are deliberate interface choices that manipulate users into decisions they would not knowingly choose. Brignull coined the term in 2010 and named twelve.
• The Princeton 2019 audit (Mathur et al.) found dark patterns on 11% of the top 11,000 shopping sites, and that count was a lower bound, not an upper one.
• The EU banned named dark patterns in the Digital Services Act (2022); the FTC issued enforcement guidance the same year; California’s CPRA prohibits them in consent flows.
• In Octalysis terms, dark patterns weaponize the three Black-Hat Core Drives by aiming them at the business: Core Drive 6 (CD6): Scarcity, Core Drive 7 (CD7): Unpredictability, and Core Drive 8 (CD8): Loss & Avoidance.
• The construct’s limits: the dark / persuasive boundary is contested, effect sizes vary across populations, and most cases trace to business-model incentives.
• The S-tier move is not to memorize the twelve names. It is to ask: would the user still click this if they fully understood what it was doing to them?

Table of Contents

About Yu-kai Chou

What Dark Patterns Actually Are

Harry Brignull’s original 2010 definition was the cleanest the field has had: “A dark pattern is a user interface that has been carefully crafted to trick users into doing things, such as buying overpriced insurance with their purchase or signing up for recurring bills.” The definition has three load-bearing pieces, and almost every later disagreement about the construct has been a fight over one of those three.

Carefully crafted. Dark patterns are not accidents. The interface choice is deliberate, even if no single decision-maker would describe it as manipulation. A countdown timer on a hotel-booking page that resets every page load was designed by someone, approved by someone, and pushed to production by someone — even when none of those someones admit to building a manipulation device. The phrase “carefully crafted” is the part of the definition that makes the construct moral rather than aesthetic. A confusing interface is unfortunate. A deliberately confusing interface that makes the company more money is something else.

Trick users. The user is being moved toward a decision they would not have made if the interface had presented the situation accurately. The trick word matters because it carves dark patterns away from ordinary persuasion. A bold call-to-action that says Buy now is persuasion. A button that says Continue to checkout but actually adds an opt-in to a $14.99 monthly subscription is a trick. The first gives the user accurate information about what will happen. The second does not.

Things they did not intend to do. The user’s preference, properly informed, would have produced a different action. This is the part that makes dark patterns measurable. If you can show that a user, given a clean interface, picks option A 80% of the time, and the same user, given the manipulated interface, picks option B 60% of the time, you have a dark pattern with a measurable effect size. The Princeton audit, the Luguri-Strahilevitz consent-flow experiments, and most regulatory enforcement actions all rest on exactly this kind of comparative evidence.

The simplest test I teach in Octalysis Certification is the full-disclosure test. Imagine the interface element is replaced with a perfectly accurate, plainly worded description of what the element actually does. Would the user still click it? If yes, the design is persuasive. If no, the design is a dark pattern. A loyalty banner that says Save 5% by joining our rewards program (we will email you 2 promotional offers per week, you can opt out at any time) is persuasive design. The same banner with the email-frequency disclosure stripped out and replaced with cheerful language is a dark pattern, even if every word is technically true.

The Original Twelve and What Came After

Brignull’s original 2010 taxonomy — recovered from his Internet Archive captures of darkpatterns.org and reproduced in his 2023 book Deceptive Patterns — listed twelve specific patterns. The twelve are still the cleanest entry point to the field, and most subsequent taxonomies are extensions or refactorings of this same list.

The Brignull Twelve (2010)

1. Trick Questions. A form question that, on quick reading, appears to ask one thing but actually asks another. The double-negative subscribe-uncheck box is the classic example.
2. Sneak into Basket. An item is added to the user’s shopping cart through a side path — a checkbox on a previous page, a default add-on — without an explicit add action.
3. Roach Motel. A flow that is easy to enter and hard to leave. Free-trial signup is one click; cancellation requires phone calls, multiple pages, and confirmation emails.
4. Privacy Zuckering. The user is tricked into publicly sharing more information than they realize. Named for early Facebook privacy-default reversals.
5. Price Comparison Prevention. The interface makes it artificially difficult to compare prices across options, often by withholding per-unit pricing or by varying the units between products.
6. Misdirection. The interface deliberately focuses attention on one element to distract from another. A large green button overshadows the smaller, less-visible escape link.
7. Hidden Costs. Surcharges appear only at the final checkout step after the user has invested attention in the flow. Resort fees, service fees, processing fees.
8. Bait and Switch. The user takes an action expecting one outcome and gets a different one. The notorious Windows 10 upgrade dialog whose close-X button installed the upgrade.
9. Confirmshaming. The opt-out option is worded to make the user feel guilty or stupid for declining. No thanks, I prefer to overpay.
10. Disguised Ads. An advertisement is styled to look like editorial content or a system message.
11. Forced Continuity. A free trial converts to a paid subscription without explicit re-consent. The user has to actively cancel to avoid being charged.
12. Friend Spam. The product asks for the user’s contact list under the framing of finding friends, then mass-mails the contacts in the user’s name.

Gray et al. 2018 — the academic refactor

Colin Gray and his collaborators at Purdue published The Dark (Patterns) Side of UX Design at ACM CHI 2018, the first peer-reviewed taxonomy. They folded Brignull’s twelve into five higher-order categories: Nagging, Obstruction, Sneaking, Interface Interference, and Forced Action. The Gray refactor is the version most academic literature has built on since, and it is the one most regulators cite when they need a structured vocabulary.

Mathur et al. 2019 — the empirical audit

Arunesh Mathur, then at Princeton CITP, led the largest empirical audit the field has produced. The team built a crawler, scraped 11,000 of the most-trafficked shopping sites, and cataloged 1,818 dark-pattern instances on 1,254 of them. Eleven percent of top shopping sites used dark patterns at the time of the crawl, and that number was almost certainly an undercount because the crawler could only catch patterns that rendered without user interaction. The Mathur audit also documented a long tail of third-party providers — companies whose business model is selling pre-built dark-pattern widgets to e-commerce stores — which means dark-pattern adoption is now a supply-chain problem, not just an in-house design problem.

OECD, FTC, EU 2022

The same calendar year produced three regulatory documents that turned the academic taxonomy into law. The OECD published Dark Commercial Patterns in 2022, mapping the academic categories onto consumer-protection statutes across member states. The FTC released its Bringing Dark Patterns to Light staff report in September 2022, citing Brignull, Gray, and Mathur by name. The European Union’s Digital Services Act (Article 25) explicitly prohibits dark patterns on very large online platforms. The legal frame is now downstream of the academic taxonomy in a way it was not at any point in the prior decade.

What Brignull Got Right

Brignull was a working UX designer when he coined the phrase, not a researcher. The frame stuck because he got several things right that the academic literature had been getting wrong for years.

The construct names a moral category, not a feature. Before Brignull, the design community had no shared word for the difference between persuasive design and manipulative design. Donald Norman’s The Design of Everyday Things talked about affordances and forcing functions; B.J. Fogg’s Persuasive Technology talked about computers as persuasive agents; Cialdini’s Influence cataloged the levers of compliance. None of them produced a word that a junior product manager could use in a Slack thread to say this is wrong. Brignull produced that word. The fact that the word lands as a moral judgment, not a technical category, is exactly the source of its usefulness.

The taxonomy is concrete enough to operate on. Each of the twelve patterns names a specific, recognizable, screenshot-able interface choice. A regulator does not have to argue from first principles about whether something is manipulative — they can point at the screenshot and say this is a Roach Motel. Concreteness has been the difference between “dark patterns” entering enforcement law and a dozen earlier, more abstract proposals (Stark’s “rhetorical interfaces,” Akrich’s “scripts,” Verbeek’s “mediation theory”) staying in the academy.

The frame travels across business models. The same twelve patterns recur in e-commerce, mobile gaming, social-network onboarding, B2B SaaS cancellation flows, and government-portal forms. The portability is partly a function of the underlying psychology — these are the levers that always work — and partly a function of how thin the line is between persuasive design and manipulative design. A designer who has memorized the twelve has a cross-domain shorthand that no other UX vocabulary provides.

The frame is bidirectional. Brignull’s catalog is, by construction, a list of things to avoid. But it is also a list of legitimate persuasive techniques used in their disclosed, accurate form. A countdown timer on a flash sale that is actually a flash sale is persuasive design. The same timer with a fake reset is a Misdirection-class dark pattern. The frame names the inflection point between the two, which means designers can use it both as a do-not-do list and as a how-to-do-it-right list.

Brignull’s 2023 book Deceptive Patterns consolidates the decade-and-a-half of evolution and is now the canonical reference. The renaming from “dark patterns” to “deceptive patterns” in the book title is itself a small piece of progress — “dark” carries an unfortunate cultural overtone that the field has been trying to retire — but the underlying construct is unchanged.

Where the Dark Patterns Frame Falls Apart

The construct is useful enough that the literature has been reluctant to publish strong critiques. That reluctance is itself a problem, because the construct has at least three serious weaknesses that any S-tier behavioral designer needs to hold in mind alongside the catalog itself.

The boundary between dark and persuasive is contested

The full-disclosure test I gave above sounds clean in the abstract. In practice, every product I have ever audited contains interface elements that pass the test on a slow read and fail it on a fast one — and almost every commercial product is being read fast. A 5-second countdown on a discount banner showing a real-time discount is, by the strict test, persuasive. The same 5-second countdown when most users cannot keep track of whether the underlying discount is real is, in practice, manipulative even if the underlying claim is honest. The boundary depends on the user’s cognitive state, the context, the product, the moment in the funnel, and the population skill distribution. Asking is this a dark pattern in the abstract is the wrong question. The right question is across the population of users actually exposed to this interface, in their actual cognitive state, what fraction would identify the manipulation if asked — and that is an empirical question, not a definitional one.

Luguri and Strahilevitz’s 2021 Journal of Legal Analysis paper Shining a Light on Dark Patterns is the closest the field has to a calibrated answer. They ran experiments with mild and aggressive dark patterns in a fictional consent flow and found that mild dark patterns nearly doubled the consent rate (from 11% to 26%) while aggressive dark patterns more than tripled it (to 42%). The same paper showed that less-educated users were disproportionately affected — a finding the academic literature has not fully internalized, and one that should be load-bearing in any equity analysis of dark-pattern policy.

Effect sizes vary wildly across populations and patterns

The lay summary of the dark-patterns literature implies that dark patterns reliably manipulate everyone. The actual literature does not say that. Mathur et al.’s 2021 follow-up paper, What Makes a Dark Pattern Dark?, documents that a substantial fraction of users notice and resist many of the most common patterns — particularly when the pattern conflicts with a strong prior preference. Sin et al.’s 2022 work measured Confirmshaming and found large effect heterogeneity by user demographics: younger users in the studies often clicked through the shaming language, while older users in the same studies were more likely to read it as condescending and bounce. The implication for designers is unwelcome: there is no single “effect size of dark patterns” number, and any audit that pretends otherwise is overclaiming.

The frame puts blame in the wrong place

Brignull’s original framing put the responsibility on the designer who built the pattern. The framing has become ritual in the UX community, and it has produced a generation of designer-blame discourse on social media. But almost every audit I have done with a real client has surfaced the same finding: the designer who shipped the dark pattern was acting under business-model pressure, with conversion KPIs, with a manager whose performance review depended on the same KPI. The pattern was not a designer’s aesthetic choice. It was a structural output of an incentive system. Naming the artifact dark pattern and pointing at the designer is roughly as useful as naming the smoke black smoke and pointing at the chimney. Both are downstream symptoms. The thing that needs naming is the fire.

Caroline Sinders’ ongoing critical-design work has been pushing the field in this direction since 2019, as has Eli Pariser’s policy advocacy. The current most-promising regulatory move — the EU Digital Services Act’s Article 25 plus the FTC’s 2022 enforcement guidance — explicitly targets the platform operator, not the individual designer, which is a structural shift the academic literature is still catching up to.

The Brain on Dark Patterns

The neuroscience of why dark patterns work is, at this point, well-mapped, and it sits underneath every Octalysis Black-Hat Core Drive. Three mechanisms do most of the work.

Loss aversion (Kahneman & Tversky, 1979). The asymmetry between losses and gains in subjective value is roughly 2:1 — losing $50 stings about twice as much as gaining $50 feels good. Confirmshaming, hidden-cost reveals, streak-loss notifications, and roach-motel cancellation flows all exploit the loss-aversion asymmetry directly. The brain processes the threatened loss faster than it processes the cost of avoiding it, which is why an aggressive Confirmshaming script can shift consent rates by 15 to 25 percentage points even when the underlying offer is identical.

Cognitive load and System-1 default. Daniel Kahneman’s System-1 / System-2 frame predicts that under cognitive load, users default to fast-thinking heuristics — and most dark patterns are designed to land while the user is under load. Misdirection patterns rely on selective attention; trick questions rely on the user being in skim mode; bait-and-switch relies on the close-X heuristic firing before System 2 can intervene. The empirical signature is that dark-pattern click-through rates rise when users are tired, distracted, or operating under time pressure.

Default-effect and choice architecture. The Thaler-Sunstein nudge literature is the same mechanism running in the opposite direction — the cognitive-laziness that makes defaults so powerful is exactly what makes Privacy-Zuckering pre-checked-boxes so effective. Madrian and Shea’s 2001 401(k) work showed that a simple default change moved retirement-savings enrollment by more than 35 percentage points in a population whose stated preferences were unchanged. The same default architecture, redirected toward the company’s interest instead of the user’s, is what dark patterns exploit. Defaults are not neutral. They never were.

There is one more Octalysis-specific brain layer worth naming. Brignull’s catalog is mostly Left-Brain manipulation: logic-pattern exploits like asymmetric cost reveal, decoy framing, and pre-checked defaults. A smaller subset is Right-Brain: variable-reward extraction and social-comparison shame. The split matters because the failure modes are different. A Left-Brain Black-Hat lever produces resentment when the user finally notices the trick, with the post-discovery experience being anger and churn. A Right-Brain Black-Hat lever produces addiction followed by burnout, with users coming back until something breaks and then leaving without a clear story for why. The audits, mitigations, and replacement levers for each failure mode are different, which is why “is this a dark pattern” is rarely the most useful diagnostic question.

The cumulative neuroscience point is that the brain machinery dark patterns hijack is the same machinery that makes humans cognitively efficient. There is no off-switch. A user cannot “just be more careful” out of dark-pattern vulnerability, any more than they can “just be more careful” out of an optical illusion. The mitigation has to live in the interface, not in the user. This is a load-bearing point that the “just educate the consumer” school of policy has consistently failed to internalize.

Dark Patterns vs Other Theories

Dark patterns sit inside a thicket of related concepts. Distinguishing them is one of the most useful pieces of work an S-tier designer can do, because the regulatory and design implications are different in each case.

Dark patterns vs persuasion. Persuasion (Cialdini’s six principles, Petty & Cacioppo’s Elaboration Likelihood Model) operates by aligning the message with the target’s genuine interest or with accurate information. Dark patterns operate by misalignment or by hiding information. The line is the full-disclosure test above. Persuasive design holds up under disclosure; dark patterns collapse.

Dark patterns vs nudging. Thaler and Sunstein’s nudge framework explicitly defines nudges as choice-architecture interventions that preserve freedom of choice and operate transparently. Dark patterns fail both criteria — they typically narrow effective choice and operate by obscuring the situation. The gray zone, often called sludge in the Sunstein 2022 vocabulary, is the inverted form of nudging where friction is added to discourage a behavior the user would otherwise have chosen. Sludge and dark patterns overlap but are not identical: most dark patterns are sludge, but some sludge is benign (a wise extra confirmation step before a destructive action), and some dark patterns operate without adding friction.

Dark patterns vs manipulation more broadly. Daniel Susser’s philosophy work distinguishes manipulation from persuasion by appeal to whether the influence operates by hijacking the target’s heuristics rather than engaging their deliberate reasoning. Dark patterns are a subset of manipulation that lives specifically in user interfaces. The broader manipulation category includes off-screen techniques (high-pressure phone sales, exit-survey ambush) that the dark-pattern frame does not cover.

Dark patterns vs Black-Hat Octalysis. This is the comparison I have spent the longest building out. Black-Hat Octalysis is the half of the framework powered by Core Drives 6, 7, and 8 — Scarcity, Unpredictability, and Loss Avoidance. Dark patterns are what happens when Black-Hat Octalysis is decoupled from the user’s actual interest. The same Core Drive can power either ethical or manipulative design, depending on whether the user’s informed preferences are aligned with or against the lever. The Octalysis frame predates Brignull’s by two years and is more general; Brignull’s frame is more specific and has had more direct policy impact. The two are complements, not substitutes.

Dark Patterns in the Real World

The empirical record on dark patterns is now thick enough to draw structured conclusions in four domains. I will work through them in order of how thoroughly the academic literature has characterized them.

E-commerce

The Princeton 2019 audit remains the empirical cornerstone. Mathur et al. found that 11.1% of the top 11,000 shopping sites used at least one dark pattern detectable from a passive crawl. The most common patterns were Activity Notifications (fake or unverifiable popups about other shoppers), Low-Stock Messages (sometimes accurate, often not), and Countdown Timers. The audit also found that dark-pattern adoption clustered with specific third-party providers — companies whose business model is selling drop-in dark-pattern widgets to retailers. Booking.com’s long-running urgency-message saturation is the canonical example: the European Commission opened multiple consumer-protection cases against the company between 2019 and 2024, and the company eventually agreed to substantial changes under EU pressure.

The cleanest e-commerce alternative is what Stripe and Shopify have been pushing in their checkout flows since 2021 — what they internally call honest checkout. The pattern stack is the inverse of the dark-pattern stack: explicit total prices, no surprise add-ons, single-click cancellation of recurring billing, plain-language refund policies. Conversion rates are typically 10-15% lower in head-to-head A/B tests against dark-pattern-saturated flows, but lifetime value and repeat-purchase rates are higher, which means the comparison is sensitive to what the company actually optimizes for.

Subscription services and cancellation flows

The FTC’s 2022 enforcement docket is dominated by cancellation-flow cases — the Roach Motel pattern is probably the single most-enforced dark pattern in the United States, partly because the FTC’s “negative option” rule predates the dark-patterns vocabulary by decades. Notable cases include Adobe (2024 lawsuit alleging hidden cancellation fees), Amazon Prime (2023 FTC suit alleging the “Iliad” cancellation flow with four pages and six clicks), and a long string of fitness-app and dating-app enforcements where cancellation required a phone call during business hours. The aggregate consumer-welfare estimate from the FTC report is on the order of billions of dollars per year in unintended subscription fees in the United States alone.

The contrast example, again, is Stripe Billing’s default cancellation flow — a single button, a single confirmation, an immediate end-of-billing-period stop. Stripe’s public position is that the easier-cancellation flow reduces churn over the long run because users return to a service they know they can leave. The empirical evidence on that claim is thin but suggestive.

Privacy and consent

The post-GDPR cookie-consent space is the most regulated dark-pattern domain in the world. Nouwens et al.’s 2020 ACM CHI paper Dark Patterns after the GDPR audited 680 of the most-popular UK websites and found that only 11.8% of consent banners met minimum legal requirements. The most common dark patterns were Pre-Ticked Boxes (which the GDPR explicitly prohibits but which 32% of audited sites used anyway), Visual Asymmetry (the “Accept all” button rendered prominently while “Reject all” was hidden behind a multi-click flow or rendered in low-contrast type), and No-Reject-Option (a banner that offers Accept All or Settings, with Reject only reachable through Settings).

The European Data Protection Board’s 2022 guidance turned each of these into a specific enforcement target. France’s CNIL fined Google €150 million and Meta €60 million in 2022 for cookie-consent dark patterns specifically. The EU Digital Services Act 2022 codified the prohibition into pan-European law. The current enforcement wave is unmistakable. In June 2025 the European Consumer Organisation filed a coordinated complaint against SHEIN, joined by twenty-five member organizations across twenty-one countries, citing pre-ticked options, false urgency, and hidden subscription consents; the European Commission flagged the case to national consumer-protection authorities under the DSA Article 25 procedure. Formal proceedings against X (formerly Twitter) under Article 25 are also underway, focused on the deceptive design of the blue-check verification badge. The Commission has signaled a Digital Fairness Act proposal for Q4 2026, which would consolidate the dark-patterns vocabulary across the DSA, GDPR, and Unfair Commercial Practices Directive. The privacy domain is where the dark-patterns frame has had its largest regulatory impact, and where the academic vocabulary has most directly become enforcement law.

Mobile games and free-to-play

Free-to-play mobile games are an outlier domain because the line between persuasive game design and dark-pattern manipulation is contested. Loot boxes, gacha pulls, energy systems, and pay-to-skip mechanics all sit on the boundary. Belgium banned loot boxes in regulated games in 2018 under existing gambling law; the Netherlands enforcement followed; the UK House of Lords Gambling Committee recommended similar treatment in 2020 but the legislation has not advanced. The academic case for treating loot boxes as a dark pattern (Drummond & Sauer 2018; King & Delfabbro 2019) is strong on the gambling-mechanism side and weaker on the user-preference side: many players, when asked, report that they enjoy the variable-reward mechanism even after disclosure.

This is where the Octalysis frame is especially useful as a complement to Brignull. CD7 (Unpredictability & Curiosity) is powerful and produces real engagement when wielded ethically. The same Core Drive becomes a dark pattern when the system aims it at the user’s wallet rather than at their fun. The boundary is Octalysis’s White-Hat / Black-Hat axis, which has more resolution than the binary dark-pattern frame in this specific domain.

The Elephant in the Room

The dark-patterns conversation often skips the part most product teams know but rarely say out loud: dark patterns work, in the short term, and the short term is what most companies are measured on. The Princeton audit’s finding that 11% of top shopping sites use them is not a sign that those companies are unusually unethical — it is a sign that the underlying KPI structure rewards shipping the patterns. Quarterly conversion targets, ARR growth rates, and ad-funded user acquisition cycles all reward the company that extracts the marginal click today over the company that protects the relationship for tomorrow.

The honest version of the conversation is that getting dark patterns out of a product requires reworking the incentive system that produced them. Designers can flag the patterns; researchers can audit them; regulators can fine them. But the only durable mitigation is changing what the company is optimized to do. The companies that have removed dark patterns at scale — Stripe, Shopify, parts of Apple’s App Store guidelines, the mid-2024 Microsoft Store cleanup — have done so under leadership that explicitly recalibrated retention metrics over conversion metrics, gave researcher findings line-item authority over PM roadmaps, and accepted the short-term conversion cost as a brand investment. None of those moves are downstream of the design team. All of them are upstream.

This is the part that the design-discourse version of dark patterns systematically under-weights. Naming a pattern is the easy part. Re-engineering the incentive system that produced the pattern is the hard part. An S-tier behavioral designer is the person who can do both.

How to Apply Dark Patterns with the Octalysis Framework

This is where the dark-patterns vocabulary stops being a regulatory construct and becomes a design tool. The Octalysis Framework gives us eight Core Drives. Three of them sit on the Black-Hat half of the framework — Core Drive 6 (CD6): Scarcity & Impatience, Core Drive 7 (CD7): Unpredictability & Curiosity, and Core Drive 8 (CD8): Loss & Avoidance — and those three are where dark patterns concentrate. Brignull’s twelve patterns map directly onto three of those Core Drives — the three already labeled Black-Hat — and the mapping is more useful than either frame alone, because Octalysis tells you which motivational lever the pattern is pulling, while Brignull tells you where the lever crosses into manipulation.

The mapping is more interesting than it first appears, so let me work through it pattern by pattern.

Core Drive 6 (CD6): Scarcity & Impatience

Three of Brignull’s patterns weaponize CD6 directly. Hidden Costs works because the user has invested attention in the flow and the surcharge appears at a moment when restarting the comparison feels expensive — sunk-cost dressed as scarcity-of-time. Forced Continuity exploits the inattention window; the cancellation deadline operates as an invisible timer the user cannot see. Misdirection often relies on a fake urgency signal to lock attention onto the wrong element. CD6 levers in their honest form — a real flash sale, a real expiring promotion, a real waitlist — are some of the most effective design elements in the Octalysis catalog. The dark-pattern transformation is what happens when the underlying urgency is fake, hidden, or amplified beyond the actual situation.

The S-tier audit move on CD6 is to enumerate every urgency signal in the product and ask, for each one, whether the underlying scarcity is real, accurately represented, and verifiable by the user. Failures of any of those three turn a CD6 design element into a dark pattern.

Core Drive 7 (CD7): Unpredictability & Curiosity

Loot boxes, gacha pulls, mystery boxes, surprise discounts, and reveal-based onboarding all live in CD7. The Brignull patterns that overlap with CD7 most cleanly are Bait and Switch (the user expects one outcome, gets a different one) and the gaming-specific cases that Brignull’s 2010 list does not name but that subsequent taxonomies have added (Gray et al.’s “Aesthetic Manipulation” covers some of them; the OECD’s 2022 update adds “disguised reward” explicitly). CD7 in its honest form is one of the most powerful engagement levers we have. The dark-pattern transformation happens when the variable reward is structured to extract money or attention beyond what the user would knowingly trade.

The S-tier audit move on CD7 is to ask whether the variable-reward mechanism would still produce engagement if the underlying expected value were disclosed in plain language. A loot box whose declared expected value is 20% of the purchase price, with full odds disclosure, is a CD7 game technique. The same loot box with hidden odds is a dark pattern. The disclosure test is the boundary.

Core Drive 8 (CD8): Loss & Avoidance

This is where the most empirically-strong dark patterns live. Confirmshaming, Roach Motel, Privacy Zuckering, and many of the cancellation-flow patterns operate by making the user feel that declining or leaving entails a loss — of status, of progress, of identity, of the sunk-cost investment they have already made. CD8 is the Black-Hat Core Drive that the Octalysis literature has the most cautious treatment of, precisely because it is the easiest one to weaponize. The Luguri-Strahilevitz consent-flow experiments measured CD8-driven dark patterns having the largest absolute effect sizes of any pattern category they tested.

The S-tier audit move on CD8 is the inverse of the CD6 move: instead of asking whether the loss is real, ask whether the loss the interface is signaling is one the user would care about if they had thought about it. A streak loss in a learning app is a real CD8 lever — the user values their streak. A confirmshaming script that implies the user is morally inferior for not subscribing is a fake CD8 lever — the user does not, on reflection, care about the company’s opinion of them. The two look identical at the pixel level. The behavioral signature is different.

The White-Hat / Black-Hat axis as the Octalysis dark-patterns boundary

The Octalysis Framework places CD1 (Epic Meaning), CD2 (Development & Accomplishment), and CD3 (Empowerment of Creativity & Feedback) on the White-Hat half, and CD6, CD7, and CD8 on the Black-Hat half. The empirical claim that goes with the labels is that Black-Hat Core Drives produce faster behavior change but worse long-term retention and worse user satisfaction; White-Hat Core Drives produce slower behavior change but better long-term retention and better user satisfaction. Dark patterns are the limit case — Black-Hat motivation aimed at the company’s interest with the user’s interest stripped out of the equation.

The audit-level move I teach in the Octalysis Certification is to score every motivational element of a product on the White-Hat / Black-Hat axis, and then to flag any element that is Black-Hat and aimed at a metric that diverges from user value. The intersection of those two filters is the dark-pattern set in Octalysis vocabulary. It is a more general and more disciplined filter than the Brignull catalog, but it is harder to apply without training. The two together — Brignull’s screenshot-recognition vocabulary plus Octalysis’s motivational-lever vocabulary — produce a more thorough audit than either alone.

Practical Steps to Avoid Shipping Dark Patterns

The construct is only useful insofar as it changes what teams ship on Friday afternoon. Six practical moves do most of the work in real product environments.

1. Run the full-disclosure test on every conversion-critical interface. For each banner, button, modal, default, and form field, write the perfectly-accurate plain-language description of what the element actually does. If the description would change the user’s click rate, the element is, at minimum, on the persuasion-manipulation boundary. Mark it as a dark-pattern candidate and route it to a structured review. This is the single highest-leverage habit a design team can adopt, and it costs roughly 15 minutes per surface.

2. Audit your third-party widget supply chain. Mathur’s Princeton crawler showed that dark-pattern adoption is partly a supply-chain problem — third-party widget providers ship pre-built dark patterns that retailers install without realizing what is in the box. Maintain a list of every third-party UI component your product loads and check each one for embedded dark patterns. The most common offenders are activity-notification widgets, scarcity-banner SaaS, and exit-intent popups.

3. Measure the cancellation flow. The Roach Motel is the easiest pattern to identify and the hardest to fix politically. Count the steps required to cancel and compare to the steps required to subscribe. The asymmetry is the signal. The FTC’s 2024 click-to-cancel rule attempted to codify that constraint at the federal level. The Eighth Circuit vacated the rule on procedural grounds in July 2025, six days before its full-effect date. Cancellation-symmetry obligations are still enforced through Section 5 of the FTC Act, ROSCA, and state auto-renewal statutes. Get there before the regulator does.

4. Read the consent flow as a regulator. The cookie-consent space is where the largest dark-pattern fines have landed. Render your consent banner in plain HTML and ask whether a regulator at France’s CNIL would bless the visual symmetry, the option-equivalence, and the absence of pre-ticked boxes. If the answer is no, the banner is enforcement-exposed even if no one has reported you yet.

5. Run the Octalysis Black-Hat scan. List every Core Drive 6, 7, and 8 element in the product. For each one, answer two questions: is the underlying scarcity / unpredictability / loss real and accurately represented? And is the lever aligned with the user’s informed interest, or is it aimed at the company’s metric at the user’s expense? Anything that fails either question is a candidate for replacement with a White-Hat (CD1, CD2, or CD3) lever, even if the conversion math is worse in the short term. The Octalysis Strategy Dashboard is the discipline I teach for this — every quarter, audit which Core Drives the product runs on, and if more than two of the three Black-Hat drives (CD6, CD7, CD8) are doing the structural work, swap one for a White-Hat lever before the next release.

6. Build the structural defense alongside the design defense. Most dark patterns are produced by the incentive system, not by the designer. The structural fix is to add at least one durable retention metric to the dashboard alongside the conversion metric, and to give that metric line-item veto authority on roadmap decisions. Without structural change, every tactical dark-pattern audit is a Sisyphean cleanup that re-fills as fast as it empties.

Closing Thoughts

Brignull’s gift to the field was not the catalog. The catalog has been refactored a dozen times since 2010 and will be refactored a dozen times more. The gift was the moral category — a single phrase that lets a designer, a regulator, a journalist, or a user say this is wrong with shared meaning behind the words. Before dark patterns, that conversation could only happen in long form. After, it can happen in a screenshot reply.

The construct’s limit, sixteen years in, is that the moral category alone does not produce design. It tells you what to avoid; it does not tell you what to build. The Octalysis Framework I have spent the last decade and a half developing is the complementary construct — it tells you the same thing in motivational-lever vocabulary, and it tells you which White-Hat lever to reach for instead. The combined audit, with Brignull’s pattern recognition feeding into Octalysis’s lever-replacement, is the version of the discipline I want every behavioral designer reading this to leave with.

The thing I want most for the next decade of this work is for the conversation to move from individual-designer blame to structural-incentive redesign. The designers who ship dark patterns are usually not the villains. They are the symptom. The companies that have made the structural fix have shown that it is possible to ship products that are commercially successful and ethically defensible at once — Stripe, parts of Shopify, parts of the post-2024 Microsoft Store, the better corners of the App Store guidelines. The path is visible. The next move is yours.

Related Reading

• The Complete Octalysis Framework — the full 8-Core-Drive map, with the White-Hat / Black-Hat axis Brignull’s dark-patterns vocabulary maps onto.
• The Dark Triad — the personality cluster most likely to ship the patterns Brignull catalogs.
• Nudge Theory — the choice-architecture frame that names the inverse of dark patterns.
• Prospect Theory — the loss-aversion math behind the most empirically-strong dark patterns.
• The Behavioral Framework Library — the full hub of S-Tier Behavioral Designer’s Guides.
• Yu-kai Chou’s Books — Actionable Gamification and 10,000 Hours of Play, the White-Hat design playbook for building the ethical alternative to every pattern in this guide.

Frequently Asked Questions

Who coined the term dark patterns?

UX designer Harry Brignull coined the term in 2010 on his personal blog darkpatterns.org, naming an initial set of twelve specific interface patterns. He has since published the canonical 2023 book Deceptive Patterns consolidating the field’s evolution, and the construct has been adopted into European Union law via the Digital Services Act and into United States Federal Trade Commission enforcement guidance.

What are the most common dark patterns?

The Princeton 2019 audit by Mathur and colleagues found that the three most-deployed patterns on top shopping sites were Activity Notifications, Low-Stock Messages, and Countdown Timers. The most-enforced patterns in regulatory action are Roach Motel cancellation flows and pre-ticked consent boxes. Confirmshaming and Forced Continuity round out the most-cited list in academic literature and consumer-protection law.

Are dark patterns illegal?

In the European Union, named dark patterns are explicitly prohibited on very large online platforms under Article 25 of the Digital Services Act (2022). California’s CPRA prohibits dark patterns in consent flows. The United States Federal Trade Commission treats them as deceptive practices under existing statute; its 2024 click-to-cancel rule was vacated by the Eighth Circuit in July 2025 on procedural grounds, with cancellation-symmetry obligations still enforced under Section 5 of the FTC Act, ROSCA, and state auto-renewal statutes. Other jurisdictions are following. The legal frame is now downstream of the academic taxonomy.

What is the difference between a dark pattern and persuasive design?

The distinguishing test is full disclosure. Persuasive design holds up under accurate, plainly-worded description of what the interface element does — the user, fully informed, would still click. A dark pattern collapses under disclosure — the user, fully informed, would refuse. The same psychological lever (urgency, social proof, default architecture) can produce either, depending on whether the underlying claim is accurate and the user’s interest is aligned.

How do dark patterns relate to the Octalysis Framework?

Dark patterns weaponize the three Black-Hat Core Drives in Octalysis: Core Drive 6 (Scarcity & Impatience), Core Drive 7 (Unpredictability & Curiosity), and Core Drive 8 (Loss & Avoidance). The same Core Drives can power ethical persuasive design when wielded with disclosure and user-interest alignment. The Octalysis White-Hat / Black-Hat axis names the boundary between the two, and predates Brignull’s vocabulary by two years.

Are dark patterns the same as sludge?

No, but they overlap. Sludge — Cass Sunstein’s 2022 vocabulary — is friction added to discourage a behavior the user would otherwise have chosen. Most dark patterns are sludge (cancellation roach motels are the classic example), but some sludge is benign (extra confirmation before destructive actions), and some dark patterns operate without adding friction (Confirmshaming, Privacy Zuckering). Sludge is one mechanism by which dark patterns operate, not a synonym.

Do dark patterns work on everyone?

No, and this is one of the most-misunderstood points in the popular literature. Luguri and Strahilevitz’s 2021 experiments showed mild dark patterns shifted consent rates by about 15 percentage points and aggressive ones by about 30 percentage points — large effects, but not universal compliance. The same paper documented disproportionate effects on less-educated users, which is a finding the policy literature should be weighing more heavily than it currently does.

What should a designer do when asked to ship a dark pattern?

Run the full-disclosure test in writing: render the requested interface element with a plainly-worded description of what it actually does. Document the predicted change in user click-through under disclosure versus under the manipulated version. Route the document to product, legal, and user-research review before implementation. The structural fix — changing the KPI that produced the request — is upstream of the designer, but the designer can supply the evidence that surfaces the structural conversation.

Are loot boxes dark patterns?

Loot boxes sit on the contested boundary. The mechanism — Core Drive 7 variable rewards — is genuinely engaging when wielded ethically and with full odds disclosure. The dark-pattern transformation happens when the system is structured to extract money or attention beyond what the user would knowingly trade. Belgium has banned them in regulated games under existing gambling law (2018), the Netherlands followed, and the UK House of Lords Gambling Committee recommended similar treatment in 2020. The academic literature treats loot boxes with hidden odds as dark patterns; loot boxes with full odds disclosure remain contested.

What is the Roach Motel pattern?

Roach Motel is Brignull’s name for any flow that is easy to enter and disproportionately hard to leave. Free-trial signup is one click; cancellation requires a phone call during business hours. The pattern is now the single most-enforced dark pattern in United States consumer-protection law, the subject of the FTC’s 2024 click-to-cancel rule, and the subject of high-profile lawsuits against Adobe, Amazon Prime, and most fitness-app and dating-app subscription products. The structural fix is symmetric exit — cancellation should never require more steps than signup.

References

1. Brignull, H. (2010). Dark Patterns: User Interfaces Designed to Trick People. darkpatterns.org. Internet Archive captures.
2. Brignull, H. (2023). Deceptive Patterns: Exposing the Tricks Tech Companies Use to Control You. Testimonium Ltd.
3. Gray, C. M., Kou, Y., Battles, B., Hoggatt, J., & Toombs, A. L. (2018). The Dark (Patterns) Side of UX Design. Proceedings of ACM CHI 2018.
4. Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A. (2019). Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. Proceedings of ACM Human-Computer Interaction, 3 (CSCW).
5. Mathur, A., Kshirsagar, M., & Mayer, J. (2021). What Makes a Dark Pattern Dark? Design Attributes, Normative Considerations, and Measurement Methods. CHI 2021.
6. Luguri, J., & Strahilevitz, L. J. (2021). Shining a Light on Dark Patterns. Journal of Legal Analysis, 13(1).
7. Nouwens, M., Liccardi, I., Veale, M., Karger, D., & Kagal, L. (2020). Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence. CHI 2020.
8. OECD. (2022). Dark Commercial Patterns. OECD Digital Economy Papers, No. 336.
9. U.S. Federal Trade Commission. (2022). Bringing Dark Patterns to Light. Staff Report, September 2022.
10. European Union. (2022). Digital Services Act, Regulation (EU) 2022/2065, Article 25 (Online Interface Design and Organisation).
11. Kahneman, D., & Tversky, A. (1979). Prospect Theory: An Analysis of Decision under Risk. Econometrica, 47(2).
12. Thaler, R. H., & Sunstein, C. R. (2008). Nudge: Improving Decisions About Health, Wealth, and Happiness. Yale University Press.
13. Sunstein, C. R. (2022). Sludge: What Stops Us from Getting Things Done and What to Do About It. MIT Press.
14. Susser, D., Roessler, B., & Nissenbaum, H. (2019). Online Manipulation: Hidden Influences in a Digital World. Georgetown Law Technology Review, 4(1).
15. Madrian, B. C., & Shea, D. F. (2001). The Power of Suggestion: Inertia in 401(k) Participation and Savings Behavior. Quarterly Journal of Economics, 116(4).
16. Drummond, A., & Sauer, J. D. (2018). Video game loot boxes are psychologically akin to gambling. Nature Human Behaviour, 2.
17. King, D. L., & Delfabbro, P. H. (2019). Predatory monetization schemes in video games and internet gaming disorder. Addiction, 113(11).

WOULD YOU LIKE YU-KAI CHOU TO WORK WITH YOUR ORGANIZATION?