IT 
EN 
The trick that's now a crime: Dark Patterns, the DSA and design built to deceive
Tuesday morning, 12 May 2026. The light slices the room into strips through the half-closed blinds. Outside, the traffic on Via Ferrarecce crawls along, mixed in with the hum of an industrial fridge drifting over from the courtyard. On the table, a cup of coffee gone cold, forgotten next to the laptop.
Sat in front of me is Berto. Big hands, the kind you get from a lifetime running logistics for a Campanian food e-commerce business — Gragnano pasta, jars of San Marzano tomatoes shipped halfway across Europe. We're trying to cancel a SaaS subscription for his newsletter tool. A hundred and twenty euros a month he doesn't need any more.
We're on the sixth click. The first screen asks if we're sure. The second shows us everything we'd lose. The third hides the cancellation link behind tiny grey text. The fourth forces a compulsory questionnaire. The fifth asks for the password again. On the sixth, two buttons: one big, blue, backlit — "Keep my subscription active". Underneath, a microscopic text link: "Proceed with cancellation". We click it. The page reloads: request received, confirmation email within twenty-four hours.
Six clicks in, and Berto's card is still, technically, on the hook.
He gives a bitter little smile and shrugs. To him, this is just how the web works. I turn the laptop round, open the staging site for his new project and show him the newsletter form: a pre-ticked box for profiling, a "reject cookies" button buried in a submenu, grey on grey.
Look at that, Berto. Up until yesterday, we'd have called it a growth-hacker trick. As of now, three different jurisdictions call it one thing only: a crime.
Two weeks earlier, Tuesday 28 April 2026, I was at our London office, City Road EC1V, a stone's throw from the chaos of Shoreditch. I was reviewing a proposal for Bobby, who runs a network of independent driving schools between Manchester and Salford. He wanted to hide a compulsory booking fee until the final step of checkout, to make his lesson prices look cheaper than the competition's. Whilst I was going through his figures, a notification came through on the tablet about the Competition and Markets Authority's action against AA Driving School — the exact same trick, the exact same rude awakening, only this time with a bill running into the millions.
This subject didn't come out of nowhere. It's the flip side of something I wrote a while back on digital accessibility: how inclusion has gone from a legal box-tick to a competitive edge (Accessibilità web 2026: da obbligo di legge a vantaggio competitivo). If that piece was about architecture opening up so nobody's left out, this one looks at that same architecture being twisted to trap people instead. Two sides of the same 2026 regulatory coin: a site can be technically accessible and structurally dishonest in its psychological interface. Transparency isn't a nice-to-have, as I also wrote about honesty in ranking data (Mostrami le ricevute) — and it's the same logic that separates an honest green label from a criminal offence (27 settembre: l'etichetta verde diventa un reato). It's the fault line between a healthy business and one about to be flattened by fines.
What a dark pattern actually is, and why it's not just bad taste
A dark pattern isn't a junior designer's clashing colour scheme. It's sophisticated design, engineered to work a little too well: an interface deliberately built to nudge the user towards choices they'd never make if they were fully informed.
The term dates from 2010. It was coined by Harry Brignull, a British UX researcher, on the site now known as deceptive.design. Brignull's kept at it for fifteen years — in 2023 he published Deceptive Patterns, the industry's reference text. He's also the one who came up with what we now call the symmetry test: if cancelling an action takes more effort than starting it did, the interface is structurally deceptive. Simple as that. If I can sign up with one tap, I should be able to cancel with one tap, in the same spot in the menu — not a phone call to a call centre that's open two hours a day.
Persuasion and manipulation aren't the same thing. Persuasion highlights genuine strengths: if I explain why pasta dried slowly at a low temperature holds up better when cooked, I'm informing a free choice. Manipulation hides information or warps the digital space to take that freedom away: a pre-ticked box at speedy checkout is visual theft, not a conversion shortcut.
For years the industry lived under the illusion that these were tolerable shortcuts — everyone does it, it's just part of the game. Today, regulators aren't interested in the stated intentions in a marketing deck. They're interested in the objective asymmetry of the button.
The taxonomy: patterns every designer needs to spot on sight
Roach Motel — easy in, impossible out
Getting in takes a second, getting out is an ordeal. The most famous case is still Amazon Prime. On 25 September 2025, the federal court for the Western District of Washington — Judge John H. Chun — made a settlement with the FTC enforceable to the tune of $2.5 billion: $1 billion in civil penalties, $1.5 billion in refunds to roughly 35 million consumers, up to $51 per person. Court documents revealed that internally, the cancellation flow was nicknamed the "Iliad Flow", after the epic poem, on account of its sheer length.
The remedy imposed is even more telling than the figure: Amazon can no longer show a button reading "No, I don't want free delivery" to decline Prime, must clearly state all terms before asking for payment details, and cancellation must require the same method as sign-up. The symmetry test, once an ethical principle, is now a court ruling. (Source: official FTC press release, ftc.gov)
Confirmshaming
The copy on the "decline" button guilt-trips whoever clicks it — "No, I'd rather pay full price" instead of a neutral "No, thanks". The design stops being descriptive and starts being judgemental.
Sneaking — hidden costs and drip pricing
A partial headline price, with the real costs only revealed at checkout. In the UK, the Competition and Markets Authority came down on exactly this with AA Driving School and BSM Driving School (Automobile Association Developments Ltd): between April and December 2025, over 80,000 consumers saw a price that excluded a compulsory booking fee, only revealed at payment. The outcome, announced on 17 April 2026: a £4.2 million fine and over £760,000 in refunds. (Source: competitionandmarkets.blog.gov.uk) Not a Silicon Valley giant. A network of driving schools.
Preselection
Pre-ticked boxes for marketing, data sharing, or add-on products in the basket — exactly the mistake I showed Berto. The GDPR is unambiguous: consent has to be an active choice, not inertia interpreted in the company's favour.
Forced action and nagging
Pop-ups that keep coming back and never register a permanent "no". The benchmark case is the Irish Data Protection Commission's (DPC) ruling of 1 September 2023 against TikTok: a €345 million GDPR fine — not DSA, the case covered the period July–December 2020, before the DSA applied — broken down as: €100 million for accounts being set to "public" by default, €65 million for the "Family Pairing" feature, and €180 million for transparency failings. One technical detail confirmed by the DPC's own ruling: the default option for posting a video was shown in darker, bolder text than the alternative — a nudge as tiny visually as it was measurable in its effects.
Fake urgency
Timers and stock counters with no connection whatsoever to real data in the database, resetting on every refresh. If a craftsman in Gragnano writes "only 3 left" on a genuinely numbered batch, that's transparency. If an e-commerce site generates a random number to fake fifteen people looking at the same hotel room, that's commercial fraud.
Visual interference
A big, bold "Accept all" button, with "Reject" in grey-on-grey or tucked away in a corner. It's the most common asymmetry in cookie banners, and the easiest one to put right.
The law's come at this from three fronts — and it's not the same law each time
Portici, a Sunday morning a few weeks on, sat at a bar looking out over the Granatello pier, laptop open on the text of the Digital Services Act. I'm on my third read-through because my first take — "this applies to every website" — was wrong, and I want to be sure before putting it in writing here.
European Union: the Digital Services Act — and the myth worth debunking
Article 25 of the DSA bans dark patterns. But not on every site. It only applies to online platforms in the technical sense — marketplaces, social networks, app stores, services that broadcast content to the public. Article 19 explicitly exempts micro and small businesses from this section of the regulation. And Article 25(2) rules out anything already covered by GDPR and the Unfair Commercial Practices Directive.
In plain terms: if Berto sells pasta directly through his own site, the DSA almost certainly doesn't touch him. What does touch him — and nobody had ever spelt this out to him so clearly — are two other, far more concrete pieces of legislation.
Italy: two regulators, not one
The Garante Privacy (Data Protection Authority), for anything to do with cookies and consent. Legal basis: GDPR Article 83, up to €20 million or 4% of global turnover. Two recent rulings set the standard: on 4 June 2025, a formal warning to an e-commerce site that treated closing the banner with an "X" as implied consent, then asked again on every visit; on 27 February 2025, a caution under GDPR Article 58 for irregularities in tracking practices. Both closed with a warning rather than a fine — but the message is clear: the days of technical leniency are over.
The AGCM — Italy's Competition and Market Authority — covers everything else: hidden prices, fake urgency, subscription traps. Legal basis: the Consumer Code, Articles 20–26. Since 2023, with Legislative Decree 26/2023 transposing the Omnibus Directive, the maximum fine has doubled to €10 million (up from 5). The most significant case is very recent: ruling PS12853, three companies from the eDreams group (Vacaciones eDreams S.L., eDreams International Network S.L., eDreams S.r.l.) fined over the travel portal's Prime subscription — over 600,000 subscribers in Italy, 70% of the Spanish parent company's turnover. For the first time, the AGCM systematically recognised that interface design alone, regardless of the wording used, can amount to an unfair commercial practice. It's the first time an Italian authority has said so this plainly, and for an agency like ours, it's a real turning point. (Source: AGCM ruling PS12853)
Anyone designing a cookie banner only worries about the Garante Privacy. Anyone designing a subscription funnel should be far more wary of the AGCM.
United Kingdom: the Digital Markets, Competition and Consumers Act
In force since 6 April 2025. It gives the CMA direct enforcement powers, no court needed, with fines of up to 10% of global turnover — higher than the GDPR cap. The AA Driving School case, already mentioned, is the first real-world application of the new regime. It's not a one-off: the CMA has sent 54 warning letters over fake reviews, and 90% of the businesses contacted corrected their policy within thirty days.
| Jurisdiction | Law | Maximum fine | Who it actually applies to |
|---|---|---|---|
| EU | DSA Art. 25 | up to 6% global turnover | Platforms only (marketplaces, social networks, app stores) — not a direct e-commerce site, not micro/SMEs |
| Italy — cookies | GDPR Art. 83 | up to €20m or 4% turnover | Garante Privacy |
| Italy — pricing/subscriptions | Consumer Code | up to €10m | AGCM |
| UK | DMCC Act 2024 | up to 10% global turnover | CMA |
What an agency or SME is really up against
Santa Maria Capua Vetere, amongst the warehouses on the outskirts. A local business is digitalising its handmade goods operation. The agency buys an off-the-shelf theme, installs a standard cookie plugin, sets up checkout on the software's default settings. Nobody checks how it actually looks in practice. The "Accept" button is bright green, "Reject" is a small grey cross in the top corner. The basket adds two euros of optional eco-packaging by default, and it's on the customer to untick it.
When the inspection lands — Garante or AGCM, whether prompted by a complaint or a spot check — responsibility falls entirely on the business owner, not the agency that installed the plugin. It's spelt out explicitly in the 4 June 2025 ruling: "delegating responsibility to the technical supplier" is listed as one of the formal failings.
Here, Insight ADV's position is firm, and it doesn't soften just because a client pushes back: we don't design asymmetrical interfaces. Not out of some abstract principle — but because agreeing to a pre-ticked box means building a ticking time bomb into the finances of someone who trusted us. The same goes for Salford: if Bobby tacks on a service fee at the last step of checkout, he's replicating, on a smaller scale, exactly the mechanism the CMA fined AA Driving School for. Size offers no immunity whatsoever.
The fine line: honest persuasion vs manipulation
Brignull's symmetry test should be applied every single day, not just when the inspectors show up. A timer for a workshop in Naples opening at 9am on Friday, with limited spaces genuinely capped by the room's capacity, is honest persuasion — the urgency matches a real constraint. A timer that resets every time the user clears their cookies is a structural lie.
Same logic applies to scarcity: the real number of pieces left from a handmade batch in Gragnano is a service to the customer. A fixed "only 2 left", disconnected from actual stock, is manipulation, and it's fineable.
There's a technical link here that few people spot: WCAG criterion 3.2.6, Consistent Help, requires that support channels stay in the same logical position across every page. It's not just an accessibility requirement for people with cognitive disabilities — it's structural respect for everyone. When a designer deliberately shifts a button or flips the conventional meaning of a colour in the cancellation funnel, they're breaching accessibility guidelines and dark pattern rules in one go. Honest design doesn't need to hide the inconvenient options. It trusts the quality of what it's offering.
Before publishing a funnel, cookie banner or subscription flow:
Symmetry test — does cancelling take the same effort as signing up?
Visual balance — do "Accept" and "Reject" have the same colour, size and clickable area?
Zero pre-ticked boxes — does every marketing or data box start unticked?
Consistent pricing — does the price on the homepage match the one at checkout?
Verifiable urgency — is every timer or stock counter tied to real data in the database?
Neutral copy — no text that guilt-trips whoever declines?
Ownership taken — has the business owner personally checked the configuration, not just the plugin?
Empirical test — have you gone through the cancellation journey yourself, in front of a colleague, timing it?
The sun's high over Via Ferrarecce now. Berto's coffee's been cold for a while, and he's stopped looking at the screen. He leans back, takes in the form we've just fixed — boxes unticked, colours rebalanced — and sits quietly for a few seconds. It's not the reaction of someone who feels hemmed in by red tape. It's the recognition of a business owner spotting sound market logic when he sees it.
The argument doesn't soften as we wrap up: deceptive design isn't a reputational risk to be managed in industry forums any more. It's a defined, tracked, punishable offence, enforced by four different authorities — the DSA, the Garante Privacy, the AGCM, the CMA — all moving in the same direction, whether the button in question was designed in Seattle, Shoreditch or Caserta.
Frequently asked questions
What exactly is a dark pattern, and how do you spot one?
A dark pattern is an interface element deliberately designed to manipulate a user's will, pushing them towards choices that work against their own interests. The way to spot one is the symmetry test: if taking an action that benefits the company is quick and easy, whilst undoing it means wading through several steps, you're looking at a deceptive pattern.
What's the difference between honest persuasion and a dark pattern?
Honest persuasion is built on genuine information and respects the consumer's right to decide for themselves. A dark pattern exploits visual asymmetry or false data — timers and stock counters disconnected from the real database, for instance — to force an action that an informed user would never have chosen.
How much risk does an Italian SME run by using a non-compliant funnel or cookie banner?
In Italy, two separate authorities get involved. The Garante Privacy handles cookies and consent, with GDPR fines up to €20 million or 4% of global turnover. The AGCM handles hidden prices, fake urgency and subscription traps, with fines up to €10 million under the Consumer Code as updated by Legislative Decree 26/2023. Plenty of SMEs only worry about the first one and overlook the second, which in practice hits sales funnels more often.
Does the UK apply different rules to the EU?
Yes. The Digital Markets, Competition and Consumers Act 2024 gives the Competition and Markets Authority the power to establish breaches directly, without going to court, with fines of up to 10% of global turnover — a higher cap than the GDPR one. The AA Driving School case, fined in April 2026 for drip pricing, is the first real-world application of the new regime against a medium-sized business.
Who's responsible if the dark pattern comes from a plugin or a pre-configured theme?
Responsibility always sits with the site owner, never the technical supplier. The Garante Privacy spelt this out explicitly in a June 2025 ruling: handing configuration over to a standard plugin isn't a mitigating factor.
Are dark patterns on smartphones different from those on desktop?
Yes, and they're often more effective: a small screen makes it far easier to hide an option out of view or force a full-width button whilst the alternative stays a tiny text link. The symmetry test applies just the same, but it needs checking separately on mobile: a cookie banner that's perfectly balanced on desktop can end up lopsided once it's squeezed onto a vertical screen.
Are timers and time-limited offers always banned?
No. They're legitimate when they reflect real, verifiable data, such as a fixed event date or genuine stock levels for a handmade product. They become dark patterns when they're generated by a script cut off from the database, designed to reset on every page reload purely to manufacture false urgency.
About the author
By accepting you will be accessing a service provided by a third-party external to https://insightadv.it/
Comments