So what is a dark pattern? Dark patterns (also referred to as “deceptive patterns”) are design choices that are chosen to lead users into taking actions they may not otherwise make. The designs are deliberately made to exploit human behaviour, tricking the user into making the decision that is most desirable for the website owner, even if it is not in the best interest of the user.
Dark patterns do not only exist in cookie banners, we also see them in email marketing which makes it difficult for a user to unsubscribe, and in hidden costs in checkout processes. In this article we will focus only on the dark patterns seen in cookie banners. In this case, there is one outcome that these dark patterns are pushing users towards… accepting cookies!
Here are some examples that you are likely to see during a short browsing session:
- Using formatting, colours and highlighting to influence choice
This is one of the most obvious ones to spot and is incredibly common. In this dark pattern, the choice of different colours, font sizes and visual design is used to encourage clicks on the Accept button.
For example, you may notice that the “Accept” button is highlighted in green, or in a bright colour, whereas the “Reject” button blends in with the banner in a dull or grey colour.
Similarly, you might see the “Accept” option in a large, interactive, prominent button, with the “Reject” option being presented simply as a small text hyperlink (rather than a button) making it difficult to find.
- No immediate option to reject
Another tactic used to influence users to give more consent than they may like is to remove the option to “Reject” consent on the first layer of the Cookie Banner. This plays on the fact that web users are often short on time and may not take the time to click through to a second layer of the banner in order to reject. In fact, a 2024 report by Austrian privacy activist organization NOYB reported that only 2.18% of data subjects visit the second layer of a consent banner, indicating the massive impact that this dark pattern has on influencing consent status.
- Difficulty to withdraw consent
Once consent has been given, a website user should have the ability to change their consent status at any given time, being able to withdraw consent as easily as they gave it. The consent banner should describe how consent can be withdrawn if the user changes their mind and this process should be easily accessible. However, to avoid consent being withdrawn, some websites use the dark pattern of making it difficult to change or withdraw their consent selection, hiding the withdraw option in small links that are not permanently visible.
The next dark pattern is the use of pre-ticked checkboxes or switches that are already in the ‘ON’ position for non-essential cookies in consent banners. This can cause the user to accept cookies that they otherwise wouldn’t for two main reasons. The first is that having pre-ticked boxes indicates to the users that they ‘should’ accept those types of cookies, making them feel as though they are needed. Secondly, if a consent banner contains pre-ticked boxes, in order to reject cookies, the user must untick each box which is time consuming and requires additional effort compared to accepting all cookies.
Guidelines in several European countries state that consent is not valid if it is collected through pre-ticked checkboxes as it is not an active opt-in from the user.
The European Court of Justice agreed with this in 2019, stating that the use of pre-ticked boxes in consent banners does not constitute consent.
- Confusing or vague language
In some cases, websites may simply choose to confuse! If a consent banner uses vague language, double negatives or complex tech jargon, website users may be tricked into accepting cookies they didn’t want simply due to confusion or misunderstanding.
- Incorrectly classifying cookies as “Essential”
If you browse through a range of websites, you will see that a large proportion of them contain the words ‘essential’ and ‘strictly necessary’ in their consent banner. But do you know which cookies really are essential? Essential or strictly necessary should only be used for cookies that are needed in order for the website to function.
Therefore, as much as they are useful to website owners, marketing and analytics cookies are not ‘essential’ or ‘strictly necessary’ and misclassifying them in this way in order to collect consent is another example of a dark pattern.
Do these seem familiar to you? If so, it is unsurprising, with a research study in 2022 showing that of the 376 sites they reviewed, over 79% used some sort of dark pattern in their Cookie Consent Banner to encourage accepted consent from users.
