In a SaaS product the dark patterns that carry real legal exposure sit in three flows, cancellation, pricing and onboarding, and the rules that reach them today are ROSCA in the US [1], California’s AB 2863 for anyone selling to consumers in California [8], and Article 25 of the EU Digital Services Act for products that qualify as online platforms [5].
One rule you have probably read about isn't on that list.
The FTC’s 2024 click-to-cancel amendment to the Negative Option Rule took effect on 14 January 2025, and the Eighth Circuit then vacated it in its entirety on 8 July 2025, six days before the deferred compliance deadline of 14 July 2025 [3]. So no part of it binds you now. Every example below is checked against what was in force when we read the sources, on 15 October 2026, and each rule carries its date.
You get the pattern named, the shape it takes in a SaaS product, and a checklist for each of the three flows.
This is a design checklist and not legal advice. It shows where to look in your own product, and your counsel says what that means.
What is a dark pattern, and which examples show up in SaaS products?
A dark pattern is an interface built so the easy action and the honest action are different actions.
Sneaking, Confirmshaming and the rest of the types are defined in public by the taxonomy that named the category [7].
In a subscription product most of them land in one of three places: the way people leave, the way they see a price, and the way they start.
Here's the whole set in one table.
Pattern names in the left column follow the taxonomy’s current wording, with the older community name beside it where you're more likely to have heard that one [7].
Treat the right column as our reading of which requirement a pattern runs into, not as a finding about your product or anyone else’s.
| Pattern | Flow | What it looks like in a SaaS product | Rule it runs into |
|---|---|---|---|
| Hard to cancel (roach motel) | Cancellation | Signing up takes one click, leaving takes a support ticket | ROSCA simple mechanism [1], AB 2863 same medium [8] |
| Obstruction | Cancellation | Retention offers and surveys stacked between the user and the exit | DSA Recital 67 [5] |
| Confirmshaming | Cancellation | The cancel button is labelled as a confession of carelessness | DSA Article 25 [5] |
| Hidden costs (drip pricing) | Pricing | Seat fees, overage and taxes arrive one screen at a time | ROSCA material terms [1] |
| Preselection (sneak into basket) | Pricing | Add-ons or extra seats sit pre-ticked in the checkout | ROSCA express informed consent [1] |
| Comparison prevention | Pricing | Plans bundle features so that no two tiers can be compared line by line | DSA Article 25 [5] |
| Hidden subscription (forced continuity) | Onboarding | A free trial turns into a charge with no stated consent step | ROSCA express informed consent [1] |
| Forced action | Onboarding | Marketing consent bundled into the step that opens the product | DSA Article 25 [5] |
| Nagging | Onboarding | The same permission prompt returns until somebody accepts it | DSA Article 25 [5] |
Nine rows, three flows. After the law section, three sections take them one flow at a time.
What is an example of a dark pattern?
Hard to cancel is the clearest one. In the taxonomy it is the case where a user “finds it easy to sign up or subscribe, but when they want to cancel they find it very hard” [7]. In a SaaS product that usually isn't a deliberate wall. It's a sign-up flow that got polished repeatedly and a cancellation flow that nobody ever reviewed, so the only route out runs through a support inbox that answers on weekdays.
Who coined the term dark pattern?
Harry Brignull. He launched the site that carried the term, then called darkpatterns.org, in 2010 [6].
Both the site and the term were later renamed, to deceptive.design and to “manipulative, deceptive and coercive patterns”, on advice from the Tech Policy Design Lab of the World Wide Web Foundation [6]. Its own account says the terminology has since been adopted into laws including the EU Digital Services Act and the California Privacy Rights Act [6].
People still search for the old phrase, which is why it's the one in this title.
What is the psychology behind dark patterns?
What follows is how regulators describe the mechanism, not a laboratory finding, and that distinction matters because the regulators' own words are the part with legal weight.
A review of 642 websites and apps offering subscription services, run by 27 authorities from 26 countries between 29 January and 2 February 2024, found that nearly 76% of them used at least one possible dark pattern and nearly 67% used more than one [2]. Sneaking, meaning information hidden or delayed, and interface interference, meaning information obscured or options pre-selected in the seller’s favour, were the two techniques it met most often [2]. That review covered subscription services broadly and not SaaS specifically, and it did not report whether any of the practices broke any country’s law [2].
In the DSA that same idea gets legal language. Article 25(1) covers interfaces that deceive or manipulate, or that “otherwise materially distort or impair the ability of the recipients of their service to make free and informed decisions” [5]. Both descriptions point at the same design decision: the default, the wording and the step order carry the choice, so the user never has to be persuaded of anything.
Which laws apply to dark patterns in 2026?
No single law bans dark patterns as a category.
Specific practices get reached by specific rules, and which rule reaches you depends on where your subscribers live and what your product does.
Three rules are in force as we write this, and one widely cited rule is not.
| Rule | Status on 15 October 2026 | What it requires | Who it binds |
|---|---|---|---|
| ROSCA, Restore Online Shoppers’ Confidence Act (US federal) | In force | All material terms disclosed before billing information is taken, express informed consent before the charge, simple mechanisms for stopping recurring charges [1] | Online sellers running negative-option or continuity plans [1] |
| California AB 2863, amending the state’s automatic renewal law | In force, with its amendments applying to contracts entered into, amended or extended on or after 1 July 2025 [4][8] | Cancellation in the same medium the consumer used, online termination for anyone who signed up online, an annual reminder, and notice before a fee change [8] | Automatic renewal and continuous service offers made to a consumer in California [8] |
| EU DSA, Article 25 | Applicable since 17 February 2024 [5] | No online interface designed, organised or operated so that it deceives, manipulates or materially distorts free and informed decisions [5] | Providers of online platforms, a term defined in Article 3 [5] |
| FTC 2024 Negative Option Rule amendment, the click-to-cancel rule | Vacated in its entirety on 8 July 2025 [3] | Nothing now. It took effect on 14 January 2025 and was vacated six days before the deferred compliance deadline of 14 July 2025 [3] | Nobody today [3] |
Read the table as a map of which requirement sits closest to which flow.
It is not a compliance opinion, and a missing row doesn't mean no rule applies to you.
Is dark pattern illegal?
Not as a category, and that's the honest answer to the question people type. What exists is a set of rules that reach particular practices. A trial that charges a card without express informed consent runs into ROSCA [1]. A cancellation that cannot be done the way the subscription was started runs into AB 2863 in California [8]. An interface that distorts a free and informed decision runs into DSA Article 25, if your product is an online platform under the definition in Article 3 [5].
So the useful question for a product team is not whether dark patterns are illegal.
It's which of your flows touches a rule already in force, and that is answerable in an afternoon.
What happened to the FTC click-to-cancel rule?
The Eighth Circuit vacated it. In Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137, decided 8 July 2025, the court set aside the FTC’s 2024 amendment to the Negative Option Rule in its entirety, six days before full enforcement was due to begin on 14 July 2025 [3]. The rule had taken effect on 14 January 2025, and the FTC had deferred the compliance deadline for certain provisions to that July date, so the vacatur caught it before it was ever enforced in full [3].
Procedure decided it. Once the rule’s estimated annual economic effect was found to exceed 100 million dollars, the FTC had not carried out the preliminary regulatory analysis required of it [3].
Two consequences for your roadmap.
No federal click-to-cancel rule is left to check a flow against [3]. And ROSCA, which the vacatur left untouched, is the operative federal anchor for every cancellation flow you ship [1].
If you find a checklist that tests a product against the 2024 rule, check the date on it. Plenty of good writing on this subject was published while that rule still looked settled.
Does the EU DSA apply to your SaaS product?
Only if your product is an online platform in the regulation’s own sense, which is a narrower thing than a product with users in Europe. Article 25 binds “providers of online platforms” [5], and Article 3 defines an online platform as “a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public”, unless that activity is minor and purely ancillary to another service [5].
A closed B2B tool whose data only ever reaches the account that put it there typically doesn't meet that test. A product with public profiles, public listings, published reviews, a template gallery or a marketplace side should work the test properly with counsel, because public dissemination is exactly what the definition turns on.
Recital 67 is worth reading either way. It names, among the practices Article 25 is aimed at, “making the procedure of cancelling a service significantly more cumbersome than signing up to it” [5]. Even where the Article does not bind you, that sentence is a good test to hold your own cancellation flow against.
Cancellation: the dark patterns that carry the clearest legal risk
Cancellation is the flow to audit first, because it's the one with an operative rule behind it on both sides of the Atlantic. ROSCA requires simple mechanisms for stopping recurring charges [1], AB 2863 requires cancellation in the medium the subscription started in [8], and DSA Recital 67 names a cancellation made harder than sign-up [5]. Four patterns show up here.
Hard to cancel, the roach motel.
Somewhere there is a route out, and nobody can find it. It sits under Billing, several levels deep, behind a link that says Manage, and the in-product search doesn't index it.
Nothing about it is forbidden on its face. It's the effect that ROSCA’s word “simple” is pointed at [1].
Channel mismatch.
People subscribe with a card in your product and cancel by emailing an address or booking a call. This is the pattern AB 2863 addresses most directly: cancellation has to be available in the same medium the consumer used, and a business that lets people accept an offer online has to let them terminate online, at will, with no further steps that obstruct or delay it [8]. If a self-serve plan starts in-app, it has to be able to end in-app.
Confirmshaming on the cancel step.
In the taxonomy this is emotional manipulation into something the user would not otherwise have done [7]. In SaaS it is usually one line of copy: a confirm button that reads like the user is giving up on their own growth. Write both buttons as neutral statements of what they do and the pattern disappears.
Obstruction by retention flow.
A discount offer, then a survey, then a pause suggestion, then the confirm. Each screen tests well on its own. Together they are the practice Recital 67 describes, a cancellation made significantly more cumbersome than the sign-up it mirrors [5]. California is more specific: a business may show a retention offer during an online cancellation only while it displays, at the same time, a prominent direct link or button marked click to cancel [8]. One offer is a retention flow. A stack of them is a maze.
| Check | What passes | Rule it runs into |
|---|---|---|
| Can a user cancel where they subscribed? | Self-serve cancellation in-app for every self-serve plan | AB 2863 same medium and online termination [8] |
| How many screens from settings to confirmed? | A path a new user finds without help or search | ROSCA simple mechanism [1] |
| How many interruptions sit in that path? | At most one offer, with a click to cancel link beside it | AB 2863 in California [8], DSA Recital 67 [5] |
| Does any label editorialise? | Both buttons name the action and nothing else | DSA Article 25 [5] |
| Does the user get a record? | Confirmation on screen and by email, with the end date | No rule in this table names it. It is the evidence you want if anyone asks |
Pricing: dark patterns in plans, totals and add-ons
Pricing is where ROSCA’s first requirement bites, and it is stricter than a lot of pricing pages assume. All material terms have to be disclosed before billing information is taken [1]. Not on the receipt, not in the terms you link, and not on the screen after the card. Four patterns break that order.
Hidden costs, better known as drip pricing.
Up front there is a per-seat price. Then the minimum seat count appears, then the annual commitment, then the overage rate, then tax. Every figure is published somewhere and the total only assembles itself at the end. Under the taxonomy’s own definition that shape is a low advertised price followed by unexpected fees discovered at checkout [7].
Preselection, the SaaS version of sneak into basket.
Priority support, an onboarding package or a few spare seats sit in the cart with the box already ticked. Preselection is its own type in the taxonomy, a default chosen for the user in order to influence the decision [7], and a pre-ticked paid add-on is hard to square with the express informed consent ROSCA asks for before a charge [1].
A renewal price that isn't the sign-up price.
Promotional pricing ends, and the real rate lands on an invoice nobody reads. For California subscribers the statute puts a window on it: a clear notice of the fee change, plus how to cancel, no less than 7 days and no more than 30 days before the new fee takes effect, and an annual reminder that names the charges and the way out [8]. Build that notice as a product email with a date on it, not as a clause.
Comparison prevention. Features get bundled across tiers so no two plans can be read side by side, which the taxonomy lists as its own type [7].
This one is rarely deliberate. It is what a pricing page looks like after a few years of packaging decisions that each made sense alone.
Cluma designs pricing and landing pages in the Publish module, and a plan table a buyer can actually compare is usually a structure problem before it is a visual one.
| Check | What passes | Rule it runs into |
|---|---|---|
| Is every material term on the screen before the card? | Price, billing period, minimum seats, commitment, renewal terms | ROSCA material terms [1] |
| Is the total the first number or the last? | A buyer can reach the real monthly figure before checkout | ROSCA material terms [1] |
| Is anything pre-selected in the cart? | Every paid add-on starts off and gets chosen | ROSCA express informed consent [1] |
| Does the renewal price match the sign-up price? | Notice of the new fee, and how to cancel, before it takes effect | AB 2863 fee-change notice [8] |
| Can two plans be compared line by line? | The same feature rows across every tier | DSA Article 25 [5] |
Onboarding and trials: dark patterns in sign-up, consent and conversion
Onboarding is the flow with the most pressure on it, because activation targets live here and so does the trial conversion. Design around ROSCA’s second requirement, express informed consent before the charge [1]. Four patterns in this flow work against it, and the first is the one your growth dashboard likes most.
Hidden subscription, the pattern usually called forced continuity.
A card-up free trial converts on its own, and the user was told once, in grey, on the step before the card. That type is defined as enrolment in a recurring payment without clear disclosure or explicit consent [7]. Fixing it is cheap: state the charge date and the amount on the same screen as the card field, and send a reminder before the trial ends.
Forced action on consent.
Marketing consent, data sharing and the terms get bundled into the step that opens the product, so agreeing is the only way forward. The taxonomy calls this forced action, where the user wants one thing and is required to do something undesirable in return [7]. Separate the two: the product opens, and the optional consents stay optional.
Preselection in the sign-up form.
Pre-ticked boxes for a newsletter, for product analytics, for a partner integration. A default selected on the user’s behalf to influence the decision is a named type on its own [7], and the regulators' own sweep lists pre-selecting options in the seller’s favour under interface interference, one of the two techniques it found most often [2].
Nagging.
Notification, mobile app and upgrade prompts return until somebody taps accept. Nagging is defined there as persistent interruption with requests that may not be in the user’s interest [7]. A declined prompt that stays declined, with a settings page for anyone who changes their mind, costs you nothing you were going to keep.
Flows like these are product design work, which Cluma runs in the Ship module as user flows, wireframes and prototypes.
| Check | What passes | Rule it runs into |
|---|---|---|
| Does the trial state the charge date and amount before the card? | Both on the card screen, plus a reminder email before it charges | ROSCA express informed consent [1] |
| Is consent separable from access? | The product opens without any optional consent | DSA Article 25 [5] |
| Are any boxes pre-ticked? | Every optional box starts off | ROSCA express informed consent [1], interface interference [2] |
| Does a declined prompt stay declined? | One ask per decision, then a settings page | DSA Article 25 [5] |
How to audit your own flows for dark patterns
Run the three flows in the order the rules weigh on them, cancellation first.
You need one afternoon, a test account you're willing to lose, and somebody to write down what happens. No new tool needed.
- Walk the cancellation flow as a leaving customer. Start in the product, not in the admin panel, and count the screens between the settings page and a confirmed end date. Write down every interruption. If you reach a support inbox, that's your finding.
- Walk the pricing flow as a first-time buyer. Stop at the screen where the card field appears and list every material term you have been shown so far. Minimum seats, commitment, overage and tax either sit on that screen or they sit too late [1].
- Walk onboarding as a new signup. Note every pre-ticked box, every consent bundled into a required step, and whether the trial told you the charge date and the amount before it took the card.
- Mark each step where the easy action and the honest action differ. That's the working definition of the whole category, and it's the only judgement in the audit that needs a human.
- Check each mark against the rule column in the tables above, then split the list in two: the ones touching a rule that's in force, and the ones that are only a trust problem. Both are worth fixing. Only one of them has a deadline attached to somebody else’s calendar.
- Fix cancellation first, because it's the flow with an operative rule behind it in the US and a named practice behind it in the EU [1][4][5]. Pricing second, onboarding third.
- Hand the list to counsel before you hand it to engineering. You're the one who can see the flow, and they're the ones who can tell you which rules reach your subscriber base.
Two things make the audit stick after the first pass. Add the cancellation flow to whatever you already review before a release, so it stops being the one flow nobody opens. And write the pattern names into your own design documentation, because a team that can say preselection out loud catches it in review.
If your patterns differ screen by screen, the underlying problem is usually a design system question rather than a flow question.
If you want to know what to run the walkthrough with, the AI design tools guide covers the prototyping end of it.
Cluma runs this kind of work as design: user flows, wireframes and prototypes in the Ship module, pricing and landing pages in Publish, with pricing published per module.
Everyday graphic design tasks come back in about 48 hours, and bigger product work moves milestone by milestone with progress roughly every 48 hours in a shared board. Your engineers implement it, and your counsel rules on it.
Where this checklist stops
Six limits, and we'd rather print them than let you find them later.
This is a design checklist. It isn't legal advice, and nothing in it tells you that your product is compliant.
Those rule columns say which requirement a pattern runs into, which is our reading and not a lawyer’s opinion on your flow.
Which rule reaches you depends on where your subscribers are.
ROSCA is federal US [1], AB 2863 turns on selling to consumers in California [8], and DSA Article 25 turns on being a provider of an online platform under the Article 3 definition, which has to be answered product by product [5]. A product can sit inside one of the three and outside the other two.
Thresholds in the checklist tables are ours. One skippable offer in a cancellation path, one ask per permission: no rule names those numbers.
They're the lines we'd hold a flow to in a design review, and we'd rather state them as judgement than dress them as law.
Every measured figure here comes from one narrowly scoped review. It describes subscription services in general, not SaaS products, and the authorities behind it did not report whether anything they saw was unlawful [2]. Read it as evidence that these patterns are common, never as evidence that most companies are breaking a law.
US federal law has been unsettled since July 2025, which is why every rule in this post carries a date [3].
If you're reading this well after October 2026, treat the dates as the claim and check the rules again.
We left out any claim about what replaces the vacated rule, because we found no source we could cite for one.
And there's no churn figure in this post. We looked for a credible measurement tying any single dark pattern to retention and found nothing we could stand behind, so there's no number here pretending to be one. More playbooks sit on the Cluma guides page.
References
- Federal Trade Commission, Time for a ROSCA recap: FTC says risk free trial was risky and not free, business guidance blog, page last updated 2 December 2025, read 15.10.2026. Tier 1, government primary source. Those three requirements are the FTC’s own summary of what ROSCA asks of online negative-option sellers. Known weakness: staff business guidance rather than the statutory text, so it is the regulator’s reading of the law and not the law itself. ftc.gov refuses plain HTTP clients from our server, so both FTC pages here were read through a rendering fetch.
- Federal Trade Commission with ICPEN and GPEN, results of the review of the use of dark patterns affecting subscription services and privacy, press release, announced 10 July 2024, read 15.10.2026. Tier 1, government primary source. 642 websites and apps offering subscription services, reviewed by 27 authorities from 26 countries between 29 January and 2 February 2024. Known weaknesses, both stated on the page: the scope is subscription services in general and not SaaS products, and the review did not report whether the practices it found were used unlawfully or broke the laws of the affected countries.
- Latham & Watkins, Eighth Circuit vacates FTC click-to-cancel rule days before compliance deadline, client alert, read 15.10.2026. Tier 3, law firm client alert. Source for the case name, the date, the holding and the procedural ground: Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137 (8th Cir. 8 July 2025). Known weakness: a law firm’s summary and not the opinion itself. We cross-checked it against alerts from four other firms reporting the same case name, the same date and the same holding before using it.
- Davis Wright Tremaine, AB 2863 updates California’s automatic renewal law, client alert, October 2024, read 15.10.2026. Tier 3, law firm client alert. Source for the signing date of 24 September 2024 and the effective date of 1 July 2025. Known weakness: a law firm’s summary, and it doesn't state the same-medium, annual-reminder or fee-change requirements this post describes, so those are cited to the statute itself at reference 8 instead. Corroborated against the Consumer Federation of California, which campaigned for the bill and is therefore an interested party, which is why the law firm alert carries the citation.
- European Union, Regulation (EU) 2022/2065, the Digital Services Act, Articles 3, 25 and 93 and Recital 67, EUR-Lex, read 15.10.2026. Tier 1, official EU legal text. Every quoted phrase in this post comes from the regulation itself, including the Article 3 definition of an online platform, the Article 25(1) prohibition, the Recital 67 wording on cancellation, and the sentence applying the Regulation from 17 February 2024. EUR-Lex refuses plain HTTP clients, so this one was rendered in a browser session to read it.
- Deceptive Patterns, About us, deceptive.design, read 15.10.2026. Originator’s own site. Source for the term’s history: the site launched in 2010 as darkpatterns.org, and both it and the term were renamed on advice from the Tech Policy Design Lab of the World Wide Web Foundation. Known weakness: this is the originator’s own account of the project, and we use it for nothing except the history of the term.
- Deceptive Patterns, Types of deceptive pattern, deceptive.design, read 15.10.2026. Taxonomy publisher’s own site. Source for every pattern definition quoted or paraphrased in this post, including hard to cancel, obstruction, confirmshaming, hidden costs, preselection, comparison prevention, hidden subscription, forced action and nagging. Known weakness: the site’s own footer states that nothing on it should be read as legal advice, and the mapping from these pattern names to the rules in this post is ours, not theirs.
- State of California, Business and Professions Code section 17602, as amended by AB 2863 (Stats. 2024, Ch. 515), California Legislative Information, read 15.10.2026. Tier 1, the statute itself. Source for every California requirement in this post. Cancellation in the same medium the consumer used is subdivision (f). Online termination at will, for anyone who accepted the offer online, is subdivision (d)(1). A retention offer shown only beside a click to cancel link is subdivision (e)(2). Notice of a fee change, with how to cancel, no less than 7 days and no more than 30 days before the new fee takes effect, is subdivision (g)(2). The annual reminder and what it has to disclose is subdivision (h). The amendments applying to contracts entered into, amended or extended on or after 1 July 2025 is subdivision (j). Known weakness: none as to authority, and the mapping from a pattern to a subdivision is ours. The site refuses plain HTTP clients and its bill page won't open even to a rendering fetch, so this code section was read in a browser session.
One term in common use is missing from reference 7 on purpose. Privacy zuckering, a name you will see for consent bundled into a required step, isn't one of the taxonomy’s current types.
Forced action and preselection are [7], and reading privacy zuckering as those two is our mapping, not the taxonomy’s.
