What are dark patterns?

A dark pattern is an interface element designed to make someone take a decision they would not have taken had they understood what was happening: the pre-ticked consent box, the refusal button shrunk and grayed out, the cancellation that takes six steps where signing up took one. Italian keeps the English term, which is also the form the national data protection authority uses. The legal reference is Article 25 of Regulation (EU) 2022/2065, the Digital Services Act, which forbids providers of online platforms from designing, organizing or operating their interfaces in a way that deceives or manipulates the recipients of the service, or otherwise materially distorts or impairs their ability to make free and informed decisions. The prohibition is written as an effect rather than as a list: it does not name the screens that are banned, it names the outcome you may not produce.

The line between persuasion and manipulation

Telling them apart is the real question for whoever designs the product. An offer that genuinely expires in two hours is legitimate persuasion: the information is true. A countdown that restarts on every page reload is manipulation: the scarcity it signals does not exist. The criterion is not how hard the nudge pushes: it is whether the interface matches what the system actually does, and whether the two options carry the same weight. If accepting costs one click and refusing costs four, the choice is not free. The EDPB Guidelines 03/2022, in the version 2.0 adopted on 14 February 2023, supply the vocabulary: overloading, skipping, stirring, obstructing, fickle and left in the dark. Here the object is always a single decision and the measure is deception; a mechanic aimed at repeated use over time with variable rewards, such as the casino effect, works on habit, and the measure becomes compulsion. The same line reappears in the AI Act, which bans manipulative techniques capable of distorting behavior.

An enterprise example

A SaaS vendor launches a self-service tier. The signup form pre-ticks the marketing box and the public profile box; cancellation exists but lives in a submenu and requires a phone call; a banner reissues the same consent request every session until the user gives in. Activation goes up and that number enters the plan. Two years later the company opens a section where customers publish projects and reviews visible to anyone: from that moment it is a provider of an online platform, and those screens stop being only a consent question and become a matter of Article 25.

Why it matters for decision-makers

The first question is whether Article 25 reaches you, and the scope is narrower than usually told: it binds providers of online platforms, meaning services that store information at a user's request and disseminate it to the public, not anyone running a website or a checkout. Article 19 further excludes from that section micro and small enterprises, unless designated as very large platforms. The exclusion is not an acquittal: paragraph 2 states that the prohibition does not apply to practices already covered by Directive 2005/29/EC on unfair commercial practices or by the GDPR, and those two reach everywhere. Consent collected through an unbalanced interface is still invalid consent, and supervisory authorities act on that today. On penalties, be precise, because the figure circulates detached from the subject: the ceiling is 6% of annual worldwide turnover, but Member States apply it to providers under their own jurisdiction, while the Commission fines directly only very large platforms and search engines. Then there is the debt: a conversion rate obtained with asymmetric options is not an earned result, it is an advance to be repaid by rebuilding the product once it is mature. It is the same arc described by enshittification, at a different scale: there the object is the platform's economic trajectory, here a single screen.

This entry is informational and does not constitute legal advice: to assess an interface, involve your DPO or legal counsel.