Regulating Dark Patterns and Protecting Personal Data

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Dark patterns manipulate the digital choices of millions of users every day, and data due diligence has become essential for companies that want to avoid regulatory sanctions and protect consumer trust.

What Dark Patterns Are and Why They Create Legal Risk

Dark patterns are digital interface design strategies deliberately built to push users into decisions they would not make if they were acting consciously and with full information. These practices range from cancellation buttons that are hidden on purpose to pre-checked forms that authorize the sharing of personal data without the data subject’s real consent. In the context of data protection, these techniques directly undermine the validity of consent, one of the pillars of the Lei Geral de Proteção de Dados (LGPD, Brazil’s General Data Protection Law).

Looking at the Brazilian regulatory landscape, the LGPD requires consent to be freely given, informed, and unambiguous. A manipulative design that confuses users or makes it hard to refuse a particular type of data processing plainly violates those requirements. The Autoridade Nacional de Proteção de Dados (ANPD, Brazil’s National Data Protection Authority) has the power to investigate and sanction these practices, and the Código de Defesa do Consumidor (CDC, Brazil’s Consumer Protection Code) also provides tools to protect against abusive conduct online.

Internationally, regulation is moving quickly. The European Union’s Digital Services Act (DSA) expressly prohibits dark patterns on digital platforms and sets fines that can reach 6% of a company’s global revenue. In the United States, the Federal Trade Commission (FTC) has stepped up enforcement against companies that use deceptive design to collect data or make it difficult to cancel services. This global trend is pushing organizations that operate in Brazil to adopt stricter compliance standards.

The Most Common Types of Dark Patterns in Data Collection

There are several categories of dark patterns that directly affect the protection of personal data. The first and most widespread is known as “confirmshaming,” a technique that uses emotional language to discourage users from refusing to have their data processed. Phrases such as “No, I’d rather not receive exclusive offers” tie refusal to a loss and put psychological pressure on the data subject to consent.

Another important category is the “roach motel,” in which signing up and consenting to the use of data is extremely easy, but canceling or withdrawing consent means clicking through multiple screens, making phone calls, or even sending physical mail. This imbalance between getting in and getting out violates the LGPD principle that guarantees data subjects the right to withdraw consent at any time, through a free and simple procedure.

“Privacy zuckering” also deserves mention. These are designs that set data sharing to the maximum by default, forcing users to dig through complex settings to restrict access to their information. Pre-ticked boxes, which the Court of Justice of the European Union has already ruled unlawful in the Planet49 case, are another common form of this practice online.

Data due diligence is not limited to checking formal compliance with the law: it must also examine whether the design of digital interfaces respects the real autonomy of the person whose personal data is being collected.

Finally, there are “trick questions,” forms that use double negatives or confusing language so that users unwittingly authorize the processing of data they meant to refuse. A prompt such as “Uncheck this box if you do not want to stop receiving communications” is a classic example of this kind of linguistic manipulation, which invalidates consent.

Data Due Diligence as a Preventive Tool

Data due diligence aimed at identifying dark patterns is an audit process that systematically examines digital interfaces, consent flows, and user journeys for manipulative practices. We consider this procedure indispensable for companies that operate online, especially those that collect personal data on a large scale or work in regulated sectors such as health care, finance, and education.

The recommended due diligence process has several stages. The first is a complete mapping of data collection points, identifying every interface where users provide personal information, whether by actively filling in a form or by passively consenting. The second stage analyzes consent flows, checking whether the options to accept and to refuse have equal visual prominence, whether the language is clear and direct, and whether withdrawing consent is as easy as giving it.

In the third stage, we run usability tests with real users to find points of confusion, psychological pressure, or difficulty understanding the interfaces. These tests reveal dark patterns that are not always visible in a purely technical or legal review. The fourth stage reviews privacy policies and terms of use, checking whether they accurately reflect the collection practices actually built into the interfaces.

Finally, the due diligence should produce a compliance report that ranks the risks it identified by severity, offers specific recommendations for fixing them, and sets deadlines for implementation. This document serves both as a roadmap for bringing the company into compliance and as evidence of regulatory good faith before the ANPD in any enforcement proceeding.

Practical Implications for Companies and the Role of Digital Compliance

The consequences of keeping dark patterns in digital interfaces go well beyond the administrative sanctions provided for in the LGPD, which include fines of up to 2% of revenue (capped at R$ 50 milhões per violation), public disclosure of the violation, and the blocking or deletion of personal data collected unlawfully. The damage to a company’s reputation often outweighs the financial cost, especially in markets where consumer trust is a decisive competitive factor.

In corporate transactions such as mergers, acquisitions, and investments, data due diligence focused on dark patterns has taken on strategic importance. Investors and buyers increasingly assess how well target companies comply with data protection law, and finding manipulative practices can significantly affect the valuation of the deal or even make it unworkable. Companies that show ethical design practices and transparency in data collection face lower regulatory risk and, as a result, are more attractive to investors.

Organizations should put digital compliance programs in place that include periodic review of interfaces, training for design and development teams in “privacy by design” principles, and effective channels for users to report difficulties in exercising their rights. Appointing a Data Protection Officer (DPO) with expertise in usability and interface design is an important advantage in this strategy.

We also see “ethical design” becoming a market standard. Companies that adopt transparent data collection practices, with clear interfaces and genuinely free consent processes, tend to build longer-lasting relationships with their customers. Transparency is not just a legal requirement. It is also a competitive advantage that can be measured in customer retention and satisfaction.

Regulatory Trends and the Future of Protection Against Dark Patterns

Regulators around the world are taking a harder line on dark patterns. The European Commission has published specific guidelines on the subject under the DSA, giving concrete examples of prohibited practices and setting objective criteria for identifying manipulative design. The European Data Protection Board (EDPB) has also issued guidance on dark patterns on social media platforms, stressing that consent obtained through manipulative interfaces is void.

In Brazil, the ANPD has put the topic on its regulatory agenda, signaling that specific guidelines on interface design and digital consent should be published in the coming regulatory cycles. The Conselho Nacional de Justiça (CNJ, Brazil’s National Council of Justice) and the Ministério Público (Public Prosecutor’s Office) are also paying growing attention to the issue, especially in cases involving educational platforms, health apps, and digital financial services, sectors where data subjects are particularly vulnerable.

We expect future regulation to move toward requiring independent audits of digital interfaces, compliance certifications for ethical design, and joint and several liability for designers, developers, and data controllers where dark patterns are proven. Companies that start due diligence and compliance work now will be better positioned to face this more demanding regulatory environment, turning compliance into a lasting competitive advantage.

This topic is directly related to data protection impact assessments, which we cover in a dedicated article.

This topic is directly related to sensitive data under the LGPD, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.