Skip to content

Dark Patterns: Check the Rule, Not Just the Headline

The FTC’s 2024 click-to-cancel rule was vacated. Separate existing laws, the EU DSA, and India’s CCPA guidance still need careful, jurisdiction-specific review.

By THEYDIDNTASK
Dark Patterns: Check the Rule, Not Just the Headline
Dark Patterns: Check the Rule, Not Just the Headline

TL;DR

  • —The vacated 2024 FTC rule must not be presented as an enforceable universal one-click cancellation standard.
  • —EU DSA Article 25 has a defined platform scope and does not replace every other consumer or data-protection rule.
  • —India’s 2023 dark-pattern guidelines came from the Central Consumer Protection Authority, not MeitY.
Correction — October 14, 2026. The earlier version treated a vacated FTC rule as enforceable, misidentified the Indian authority, and promised screenshots that were not present. This version separates the jurisdictions and fixes the comparison table. It is general information, not a legal compliance opinion. A cancellation maze or misleading permission prompt can be a serious design problem. Calling it a “dark pattern” does not, by itself, identify the applicable law or prove a violation. United States: the 2024 rule is not the current standard The FTC's March 2026 announcement expressly distinguishes the vacated 2024 rule from the existing rule. It opened an advance notice of proposed rulemaking asking whether to amend current requirements, adopt provisions from the vacated rule, or pursue alternatives. A request for public comment is not a new final rule. The FTC's accompanying guidance identifies other legal bases, including Section 5 of the FTC Act, the Restore Online Shoppers' Confidence Act (ROSCA), and the Telemarketing Sales Rule. Their scope matters. Removing the 2024 rule does not make misleading enrollment or obstructive cancellation automatically lawful. European Union: Article 25 has boundaries Article 25 of the Digital Services Act addresses interfaces that deceive, manipulate, or materially impair informed decisions. Its examples include repeatedly asking for a choice already made and making termination harder than subscription. It is not a provision limited only to very large platforms. However, Article 19 provides a micro- and small-enterprise exclusion with qualifications, and Article 25 excludes practices covered by the Unfair Commercial Practices Directive or GDPR. Check the service and practice against the actual scope rather than treating Article 25 as a universal website checklist. India: the CCPA issued the guidelines The Department of Consumer Affairs' government record identifies the Central Consumer Protection Authority (CCPA) as the issuer of the 2023 guidelines. It names 13 patterns, including false urgency, basket sneaking, subscription traps, disguised advertisements, and nagging. The earlier attribution to MeitY was incorrect. A practical interface review These are review prompts, not guarantees of compliance: Interface problem / What to inspect / A user-respecting change Hidden recurring charge / What appears before enrollment / Show the charge, frequency, and trial end clearly. Cancellation maze / Every step needed to stop billing / Remove unnecessary detours and confirm the outcome. Repeated permission prompt / What happens after a refusal / Respect the decision instead of asking again immediately. Disguised advertisement / Whether the paid placement is identifiable / Label it clearly where it appears. Test the entire flow, including mobile layouts, keyboard access, failure states, and confirmation messages. A button that looks clear can still lead to a broken cancellation or a silently reversed choice. Record what you observed and which rule you checked. A short signup and a short cancellation flow are useful design goals, not proof that every legal obligation has been met. For this site's data-handling choices, see the privacy policy.

Sources