Spotting Dark Patterns In Interfaces
A cookie banner shows two buttons. Accept sits in bold colour, while Reject sits in muted grey, styled like a disabled control. Rejection rates fall, and the dashboard celebrates. The interface has crossed a line with a name. Dark patterns are design choices that steer people into decisions they did not mean to take. The CIPT exam expects you to recognise them on sight.
That greyed-out button is documented practice. The United States Federal Trade Commission described this exact interface in its 2022 staff report Bringing Dark Patterns to Light. Users, the report observes, may conclude they have no real choice but to accept.
What dark patterns do
The mechanism is asymmetry. An honest interface makes the privacy-protective option and the data-hungry option equally easy to see, understand and click. A dark pattern tilts the field: one path is short and bright, the other is long, dull or hidden. The harm lands on decisions, which is why privacy scholarship files these designs under decisional interference. A person still makes the click, but the design has already narrowed what that click can mean.
Consider pre-ticked boxes, or confirmshaming text along the lines of “no thanks, I prefer paying full price”. Consider a cancellation flow of five screens where sign-up took one. Each works by making the honest option cost more effort or more self-respect than it should.
Two catalogues of dark patterns
Regulators on both sides of the Atlantic have published taxonomies, and exam questions borrow their vocabulary.
The EDPB’s categories
The European Data Protection Board adopted the final version of its Guidelines 03/2022 on deceptive design patterns in February 2023. These guidelines walk through the life cycle of a social media account. They sort the patterns into categories such as overloading, skipping, stirring and obstructing. A renaming happened along the way: version one said dark patterns, version two says deceptive design patterns. An exam question may use either term. Under the GDPR, the analysis rests on transparency, fairness and data protection by design and by default.
The FTC’s four tactics
The FTC report groups common tactics into four families. Design can mislead or disguise advertising. Subscription traps resist cancellation. Important terms and junk fees get buried. Interfaces trick people into sharing data. In the United States these practices count as unfair or deceptive practices under consumer protection law, since no dedicated federal privacy statute covers them.
Designing the honest alternative
Recognising dark patterns is half the CIPT skill, and naming the design to emulate is the other half. Symmetric choices give accept and reject equal prominence. Privacy-protective defaults make the least intrusive setting the starting position, so inaction never enlarges processing. Just-in-time explanations put the consequence of a choice next to the choice itself. Cancellation matches sign-up in effort. All of this is ordinary interface work with the thumb taken off the scale.
Predictability, one of the three privacy engineering objectives, gives the same idea an engineering vocabulary. People should be able to form reliable assumptions about what happens to their data. An interface that manipulates the choice breaks the assumption before any code runs.
How the CIPT exam tests dark patterns
The Body of Knowledge, the IAPP’s published outline of exam coverage, places dark patterns in the domain on privacy risk management. They sit inside the competency on intrusion and decisional interference. Questions typically describe an interface and ask what it exemplifies, or ask which redesign removes the manipulation. Learn the named patterns well enough to match a description to a term. Learn the honest counterparts well enough to pick the fix.
One habit helps under time pressure. Ask who benefits from the friction. If every extra click, pre-selection and colour choice serves the platform’s appetite for data, the deceptive design options are live.
A study step that fits this subject: the CIPT Exam Question Masterclass at 195 euros teaches the question method for this exam, including the interface-description items this competency produces.
