<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-dark-patterns-in-interfaces
description: >-
  Detect deceptive design patterns (dark patterns) in user interfaces that
  manipulate consent, obscure privacy choices, or violate GDPR transparency
  requirements, the EU Digital Services Act, and FTC guidelines.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - dark-patterns
  - deceptive-design
  - gdpr
  - dsa
  - ftc
  - ui-audit
  - transparency
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Detecting Dark Patterns in Interfaces

## Overview

Dark patterns are deceptive UI/UX designs that trick users into unintended
actions: granting excessive consent, sharing data, or failing to exercise
privacy rights. The EU Digital Services Act explicitly prohibits dark patterns
(Art. 25), GDPR requires freely given consent (Art. 7), and the FTC has taken
enforcement action against deceptive interfaces. This skill detects common
dark pattern taxonomies in UI flows and produces compliance findings.

Mode: `[MODE: PRIVACY]` — Deceptive design detection and transparency audit.

## Prerequisites

- Python 3.10+ with `json`, `re` modules
- Screenshots or HTML source of target interfaces
- UI flow documentation for consent, subscription, and account deletion
- Dark pattern taxonomy reference (Mathur et al., Gray et al.)

## Key Concepts

### Dark Pattern Taxonomy

| Pattern | Category | Regulation |
|---------|----------|------------|
| Confirm-shaming | Emotional manipulation | GDPR Art. 7 |
| Hidden unsubscribe | Obstruction | DSA Art. 25 |
| Pre-selected options | Default manipulation | GDPR Recital 32 |
| Forced continuity | Sneaking | FTC Act S5 |
| Privacy zuckering | Interface interference | GDPR Art. 5(1)(a) |
| Trick questions | Misdirection | GDPR Art. 12(1) |
| Roach motel | Asymmetric effort | GDPR Art. 7(3) |

### Detection Signals

```python
DARK_PATTERN_SIGNALS = {
    "confirm_shaming": [
        "no thanks, I don't want",
        "I prefer to pay full price",
        "I'll stay unprotected",
    ],
    "preselected": [
        "checked_by_default",
        "opted_in_by_default",
    ],
    "asymmetric_effort": [
        "signup_one_click",
        "deletion_requires_call",
    ],
}
```

### Scanning CLI

```bash
# Scan HTML for dark pattern indicators
node scripts/agent.js --action scan-html \
  --input /tmp/consent_page.html

# Analyze consent flow for asymmetric effort
node scripts/agent.js --action analyze-flow \
  --subscribe-steps 2 --unsubscribe-steps 7

# Check for confirm-shaming language
node scripts/agent.js --action check-language \
  --input /tmp/modal_text.txt

# Generate dark pattern compliance report
node scripts/agent.js --action report \
  --findings /tmp/dark_patterns.json
```

## Workflow

### Step 1: Scan Interface HTML

```bash
node scripts/agent.js --action scan-html --input /tmp/consent_page.html
```

### Step 2: Analyze Flow Asymmetry

```bash
node scripts/agent.js --action analyze-flow \
  --subscribe-steps 2 --unsubscribe-steps 7
```

### Step 3: Check for Manipulative Language

```bash
node scripts/agent.js --action check-language --input /tmp/modal_text.txt
```

### Step 4: Generate Report

```bash
node scripts/agent.js --action report --findings /tmp/dark_patterns.json
```

## Verification

- [ ] No confirm-shaming language in consent dialogs
- [ ] Accept and reject options have equal visual prominence
- [ ] No pre-selected consent checkboxes
- [ ] Account deletion effort comparable to account creation
- [ ] Unsubscribe reachable within same number of clicks as subscribe
- [ ] Privacy settings use neutral, non-manipulative language

## References

- [EU Digital Services Act Art. 25 — Dark Patterns](https://eur-lex.europa.eu/eli/reg/2022/2065)
- [EDPB Guidelines 3/2022 on Dark Patterns](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32022-dark-patterns-social-media-platform_en)
- [FTC Report on Dark Patterns (2022)](https://www.ftc.gov/reports/bringing-dark-patterns-light)
- [Mathur et al. — Dark Patterns at Scale](https://arxiv.org/abs/1907.07032)
