While privacy issues have been on lawmakers’ radars for decades, their focus on these deceptive designs have only come to fruition in recent years. California formally addressed dark patterns as part of an update to the state’s digital-privacy legislation in 2021, while a bipartisan group of federal lawmakers wrote a bill seeking to ban these sorts of practices this past summer.

What are ‘dark patterns’?

Even if you’ve never heard the term dark pattern before, you’ve almost certainly come face to face with one somewhere on the web.

Technologist Harry Brignull coined the term in 2010 to codify “manipulative or deceptive design decisions” that aim to get end users to take some sort of action that they might not have taken of their own free will. Certain subscription services, for example, have been accused of using dark patterns to discourage people from deleting their accounts once their free trials have expired. Others have slapped the dark-pattern label on ads that disguise themselves as independent content in order to goad a web surfer into clicking.

These are just a two of the dozen different flavors of deceptive design that Brignull has catalogued on his website over the past decade. In some cases, a dark pattern might try to get a shopper to spend more on a purchase — either by sneaking an item into their basket or by bringing up a slew of unexpected delivery or tax charges toward the end of the checkout process. Other dark patterns might be aimed at getting site visitors to agree to more onsite tracking than they might be comfortable with, or make it nearly impossible to opt out of that tracking.

According to the FTC’s complaint, Epic was caught using dark patterns to charge “Fortnite” players without getting their express consent. For more than a year after Epic began offering in-app purchases, the docket explained, young “Fortnite” players were allowed to buy different costumes and accoutrements for their in-game avatars “by simply pressing buttons” — no password or PIN from a cardholding parent required.

“Many parents have been surprised to learn that Epic charged them hundreds of dollars for kids’ in-app activities that they did not authorize,” the FTC wrote, going on to detail the complaints of one parent who expressed disappointment that an 10-year-old had made roughly $500 in in-app purchases “so easily.”

On top of that, the FTC detailed that Epic used other dark patterns to make it difficult to cancel purchases, or to ask for refunds. The agency observed that soon after introducing a “cancel purchase” button in 2019, the company pushed the button toward the bottom of the screen and made it smaller. The FTC also explained that Epic “deliberately require[d] consumers to find and navigate a difficult and lengthy path to request a refund through the Fortnite app,” and also asked players to jump through “several unnecessary steps” to submit a refund request at the end.

While Epic is being held to account over its practices, there are countless other actors across the web still pulling similar stunts. In one study that surveyed 11,000 online stores in 2019, researchers found roughly 1 in 10 engaging in some sort of deception to get shoppers to spend more than might recognize. Another survey of the 240 most popular free apps in the Android app store found that 95% can be found using some sort of dark pattern, typically to get users to click on ads within an app. If the FTC intends to crack down on these sorts of deceptions at scale, then the agency has its work cut out for it.