A product designer reviews the results of a consent-screen A/B test.
Version B wins.
The "Accept" button is larger and more prominent. The decline option is smaller, muted, and takes an extra step to reach.
Acceptance goes up. The growth team calls it a successful experiment.
Then privacy counsel asks: "Did more people choose yes, or did we just make no harder?"
Suddenly, a conversion metric becomes a governance question.
When Removing Friction Becomes Adding Risk
Product teams are trained to remove friction from the actions they want users to take. Privacy and consumer-protection law force teams to examine where they may be adding friction, obscuring information, or creating asymmetry to influence the choice itself.
The FTC has warned that dark patterns can trick or manipulate consumers into purchases, subscriptions, or surrendering personal information. Its enforcement record also demonstrates that regulators can look beyond whether a disclosure or choice technically existed and examine how the overall experience operated.
What Section 5 and the CCPA Actually Prohibit
Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in commerce. Dark patterns are not a separate category of federal violation simply because regulators describe an interface that way — instead, the FTC has used Section 5 and other statutes it enforces to challenge specific deceptive or manipulative designs. The FTC's dark-pattern guidance identifies practices such as obscuring material information, making cancellation difficult, and steering consumers toward privacy choices that disclose more personal information. In 2025, Amazon agreed to pay $2.5 billion to resolve FTC allegations involving Prime enrollment and cancellation practices, with the resulting order requiring clearer enrollment choices and easier cancellation.
California goes further in privacy law. The CCPA expressly defines a dark pattern as a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice. The law also provides that agreement obtained through dark patterns does not constitute consent. CalPrivacy has separately emphasized symmetry of choice when businesses design mechanisms for consumers to exercise their privacy rights.
Five Red Flags to Watch
One button is bright, prominent, and immediate. The alternative is muted, smaller, or buried. The blind spot is asking whether both options technically exist instead of whether consumers can perceive and exercise them with comparable ease. California's enforcement guidance specifically tells businesses to evaluate whether privacy choices are symmetrical.
Consent happens instantly. Refusal requires another screen, additional settings, or repeated confirmation. That difference matters because friction itself can influence behavior. The FTC's Amazon matter involved allegations that consumers were enrolled without adequate consent and then faced a deliberately difficult cancellation process. The resulting settlement requires an easier cancellation mechanism and a clear and conspicuous way to decline Prime.
A higher acceptance rate tells you what consumers clicked. It does not tell you whether they understood the choice. The FTC's Credit Karma action is particularly instructive: the agency alleged deceptive representations and discussed A/B testing that showed which representations drove greater engagement. The resulting order required preservation of A/B testing and other behavioral and usability research.
Critical information sits behind a tooltip, appears in less prominent text, or arrives after the interface has already pushed the consumer toward a decision. The FTC's dark-pattern guidance identifies buried terms and hard-to-find disclosures as recurring concerns.
Legal approves the words. Design approves the interface. Growth monitors conversion. Engineering implements the workflow. But the consumer experiences all of it as one decision. The blind spot is reviewing individual components for compliance while nobody asks whether the combined experience preserves meaningful choice.
Who This Affects and How
Product
A/B testing is not the problem. The governance question is what the experiment is optimizing. If a design increases acceptance because consumers understand the proposition better, that is different from increasing acceptance because refusal became harder to find.
Privacy and Legal
Consent architecture deserves the same scrutiny as the privacy notice. Honda provides a concrete California example: in 2025, CalPrivacy fined American Honda $632,500 in a CCPA enforcement action that included allegations that its privacy-management interface failed to present consumers' choices symmetrically. The Honda matter was a CCPA enforcement action, not a federal FTC case.
Consumers
Small design decisions can influence whether people subscribe, cancel, share personal information, or exercise privacy rights. What looks like a minor interface decision internally can materially affect whether a person meaningfully exercises a choice.
For Organizations
- Compare consent and refusal paths screen by screen.
- Count the steps required to accept, decline, opt out, and withdraw a choice.
- Review prominence, wording, button placement, and visual hierarchy for asymmetry.
- Audit privacy-related A/B tests for comprehension as well as conversion.
- Require privacy or legal review when material changes are made to consent and opt-out flows.
For Individuals
- Look for less-prominent alternatives before accepting optional tracking or data sharing.
- Review whether declining a choice actually changed the relevant privacy setting.
- Revisit privacy settings when a service materially redesigns its interface.
- Report interfaces that appear to obstruct applicable privacy rights through the appropriate regulator or consumer-protection channel.
Myth vs Reality
Myth: If "Accept" and "Decline" both appear somewhere in the flow, consumers received a meaningful choice.
Reality: Regulators can examine the entire interface, including clarity, prominence, wording, and friction, to determine how the choice actually operates.
One-Line Debate Prompt
At what point does removing friction for the business become adding friction for the consumer?
If your highest-converting consent design also makes refusal harder, is that successful UX or a governance failure?
Poll
When does consent design cross the line into manipulation?