Your cookie banner
is lying to users.
We prove it.
AI-powered dark pattern analysis grounded in 14 peer-reviewed sources and 3 scientific taxonomies. Detects 26 deceptive design patterns in consent flows, pricing pages, and user interfaces — with forensic precision and court-ready Ed25519-signed evidence.
| # | Source | Venue / Year | Key Finding |
|---|---|---|---|
| 1 | Gray et al. | CHI 2018 | 5 core strategies: Nagging, Obstruction, Sneaking, Interface Interference, Forced Action |
| 2 | Mathur et al. | CSCW 2019 | 11,000 shopping sites analyzed, 15 pattern types, 1,818 instances found |
| 3 | EDPB Guidelines 03/2022 | EU 2022 | 6 regulatory categories: Overloading, Skipping, Stirring, Hindering, Fickle, Left in the Dark |
| 4 | Nouwens et al. | CHI 2020 | 680 consent banners analyzed — only 11.8% GDPR-compliant. Pre-selected checkboxes increase consent by 83% |
| 5 | Matte et al. | arXiv 2020 | 89% violation rate on TCF-compliant websites |
| 6 | Luguri & Strahilevitz | J. Legal Analysis 2021 | Aggressive dark patterns lead to 4x higher subscription rates |
| 7 | Santos et al. | WPES 2021 | 61% of cookie banners violate purpose limitation, 30% use positive framing |
| 8 | Bollinger et al. | USENIX Security 2022 | Automated cookie consent and GDPR violation detection at scale |
| 9 | Kirkman, Vaniea & Woods | EuroS&P 2023 | DarkDialogs: 10,000 websites, 99% classification accuracy, 89.5% have ≥1 dark pattern |
| 10 | Khandelwal et al. | USENIX Security 2023 | CookieEnforcer: 93.7% automated opt-out success rate |
| 11 | Lin et al. | IST 2024 | DPDGPT: Multimodal LLM for dark pattern detection, 19 types, F1 score 0.88 |
| 12 | Singh, Jin & Kim | arXiv 2026 | UMBRA: 99% detection accuracy, 19 patterns, 14,000-website study |
| 13 | noyb | 2024 | Cookie Banner Report: 422+ formal GDPR complaints with automated scanning methodology |
| 14 | EU DSA | Reg. 2022/2065 | Art. 25(1), Recital 67: Explicit dark pattern prohibition in digital services |
The Problem
Dark patterns are invisible to auditors
- 89.5% of websites use at least one dark pattern (Kirkman et al. 2023)
- Only 11.8% of cookie banners are GDPR-compliant (Nouwens et al. 2020)
- 89% violation rate even on TCF-certified websites (Matte et al. 2020)
- Pre-selected checkboxes increase consent by 83% — manipulating millions daily
- Manual analysis of one consent flow takes 2–4 hours
Automated forensic detection
- AI analyzes DOM structure, button sizes, color contrast, click paths
- 26 pattern types mapped to 3 taxonomies (Gray, Mathur, EDPB)
- Behavioral scoring with false-positive calibration
- Business context analysis reduces noise (legal requirements vs. manipulation)
- Full analysis in under 60 seconds
26 Deceptive Design Patterns
Every pattern is mapped to Gray, Mathur, and EDPB taxonomies with GDPR article references. Grounded in 14 scientific sources.
Consent Manipulation
- Button Asymmetry — “Accept” is large and green, “Reject” is tiny gray text. WCAG luminance analysis.
- Confirmshaming — “No thanks, I don’t care about my experience” — emotional pressure to force consent
- Preselection — All tracking categories pre-checked (violates CJEU C-673/17 Planet49)
- Hidden Reject — Reject buried 3 clicks deep — CNIL fined Google €150M for this
- Cookie Wall — No access without consent — illegal per EDPB Guidelines 05/2020
- Positive Framing — Banner headline emphasizes benefits of tracking (“best experience”) to nudge consent (Santos 2021, Art. 12 GDPR)
Interface Deception
- Maze Navigation — Deliberately complex settings to prevent opt-out (Art. 12 GDPR)
- Bait & Switch — UI element does opposite of what user expects (§5 UWG)
- Trick Questions — Double negatives and confusing wording to manipulate decisions
- Nagging — Repeated consent prompts until user gives in (EDPB Rn. 54)
- Forced Registration — Account required for basic functionality or GDPR rights (Art. 15/20)
Information Manipulation
- Information Overload — Walls of text to prevent informed decisions (EDPB Rn. 52)
- Hidden Costs — Fees revealed only at final checkout (§5a UWG)
- Deliberate Downgrading — Degraded experience after consent rejection
- Decontextualising — Privacy information placed out of context (EDPB Rn. 58)
- Contradictory Information — Privacy policy contradicts banner settings and actual behavior
Evolved Patterns (2023–2026 Research)
- Revocation Friction — Revoking consent requires significantly more steps than granting it (Art. 7(3) GDPR)
- Pay-for-Privacy — Users must pay to reject tracking — “Consent or Pay” walls (EuGH C-252/21 Meta)
- Multi-Layer Misdirection — Accept on layer 1, reject buried on layer 3+ through nested tabs and accordions
- Legal Ambiguity — Deliberately vague consent language: “may possibly”, “to improve services” (Art. 12(1) GDPR)
- Dark Pattern Masquerading — Marketing cookies disguised as “accessibility features” (DSA Art. 25(1))
Technical Deception
- Implied Consent — No banner present, tracking active by default (§25 TDDDG, Planet49)
- Consent Theatre — Formal consent banner exists but technical implementation ignores user choice — 89% TCF violation rate (Matte 2020)
- Category Manipulation — Marketing trackers hidden under “Essential” category to bypass consent (§25(2) TDDDG)
- Language Discontinuity — Privacy-critical texts in different language than website content (Art. 12(1) GDPR, EDPB Fickle)
- Geo/Device Variation — Different consent flows by country or device — strict in EU, aggressive elsewhere (DSA Art. 25(2))
How Detection Works
DOM Forensics
Headless Chromium captures the full consent flow. Button sizes, colors, contrast ratios, click targets, and z-index layering are measured pixel-precisely. Multi-page crawl with priority-based page classification.
AI Classification
Claude AI classifies each finding against all three taxonomies (Gray, Mathur, EDPB) simultaneously. Business context (industry, legal requirements, Trustpilot reputation) calibrates severity. Confidence threshold ≥70%.
Behavioral Scoring
Each pattern receives a severity score (0–100). False-positive calibration separates standard UX conventions from deliberate manipulation. Page-type weighting prioritizes high-risk pages (pricing, cancellation, rights).
Legal Mapping
Every finding is mapped to specific GDPR articles (Art. 4(11), Art. 7, Art. 12), TDDDG §25, ePrivacy Art. 5(3), DSA Art. 25, and relevant CJEU rulings (Planet49, Meta). Enables both academic and regulatory referencing.
Key Findings from Research
of websites have at least one dark pattern
Kirkman et al. 2023
of cookie banners are GDPR-compliant
Nouwens et al. 2020
higher subscription rate with aggressive patterns
Luguri & Strahilevitz 2021
consent increase from pre-selected checkboxes
Nouwens et al. 2020
TCF websites violate own consent framework
Matte et al. 2020
formal GDPR complaints by noyb in 2024 alone
noyb Cookie Banner Report
Who Uses Dark Pattern Detection
Data Protection Officers
Audit your clients’ consent implementations. Deliver evidence-based reports grounded in 14 scientific sources instead of opinions. Automate what used to take 3 hours per website.
Supervisory Authorities
Batch-scan hundreds of websites for systematic dark pattern violations. Prioritize enforcement actions with objective severity scores. Reproducible evidence for administrative proceedings.
Consumer Protection
Document manipulative consent flows for complaints and legal proceedings. Cryptographically signed evidence (Ed25519) that withstands legal challenge.
Compliance Teams
Monitor your own properties for dark pattern drift after CMP updates. CI/CD webhook integration catches consent regressions before they go live.
Example: What the Report Shows
{
"pattern": "consent_theatre",
"taxonomy": {
"gray": "Sneaking",
"mathur": "Bait and Switch",
"edpb": "Left in the Dark"
},
"severity": 95,
"confidence": 0.92,
"evidence": {
"trackers_after_reject": ["Google Analytics", "Meta Pixel", "Hotjar"],
"trackers_after_accept": ["Google Analytics", "Meta Pixel", "Hotjar"],
"overlap_pct": 100.0,
"source": "Matte et al. 2020 — 89% TCF violation methodology"
},
"gdpr_articles": ["Art. 7(1)", "§ 25 TDDDG"],
"scientific_refs": ["Matte 2020", "Bollinger 2022"],
"edpb_reference": "Guidelines 03/2022, Rn. 73"
}Detect Dark Patterns Now
Standalone Dark Pattern Check €39. Forensic bundle from €119. Ed25519-signed, court-ready. Grounded in 14 peer-reviewed sources.