Dark Patterns at Scale: What Crawling 11,000 Shopping Sites Found

From accusation to measurement

The phrase "dark pattern" was coined by the UX designer Harry Brignull in 2010 to name interface tricks that benefit the business at the user's expense. For most of the following decade the concept circulated as commentary. Practitioners could point to a countdown timer that reset on refresh or a cancellation flow buried three menus deep, but there was no systematic answer to the obvious questions: how common is this, what forms does it take, and is it a fringe abuse or an industry norm?

Mathur and colleagues answered those questions empirically. In "Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites," presented at CSCW 2019 and released with its dataset and code, they built a semi-automated pipeline that simulated a shopper, crawled roughly 53,000 product and checkout pages across about 11,000 sites drawn from a ranking of the most-visited shopping destinations, and then applied human review to classify what the crawler flagged. The design matters: because the method was reproducible and the corpus large, the resulting counts are a defensible estimate rather than a collection of anecdotes.

What the crawl actually counted

The headline figures are specific and worth stating precisely, because they are frequently rounded away in secondary coverage. The crawl identified 1,818 individual dark-pattern instances. Those instances fell into 15 distinct types, which the authors grouped into 7 higher-level categories. The instances appeared on 1,254 of the roughly 11,000 sites in the sample, which is close to 11 percent.

Two framings of that 11 percent are both true and both worth holding. On one hand, the large majority of shopping sites in the sample showed no detectable dark pattern, so the practice is not universal. On the other, the crawler could only detect patterns that leave a machine-readable trace on a product or cart page, so 11 percent is a floor, not a ceiling, and the sites carrying these patterns skew toward the higher-traffic end of the web, meaning a disproportionate share of actual shopping sessions passed through them.

The seven categories, in plain language

The study's lasting contribution is its taxonomy. Naming the categories converts a moral intuition into a checklist an owner can hold a site against. The seven categories the authors defined are below, described in the plain terms a business owner rather than a researcher would use.

• Sneaking: hiding or delaying information the buyer would want before deciding, such as adding items to a cart automatically or revealing fees only at the final step.
• Urgency: imposing a real or fabricated deadline, such as a countdown timer or a "sale ends soon" banner, to rush the decision.
• Misdirection: using visual or verbal framing to steer attention toward the option that serves the business, for example a bright "accept" button beside a grayed-out decline link, or confirmshaming copy that guilts the user for saying no.
• Social proof: presenting activity messages or testimonials, sometimes genuine and sometimes fabricated, to imply that others are buying and the user should too.
• Scarcity: signaling that supply is limited, through low-stock messages or high-demand notices that may or may not reflect reality.
• Obstruction: making a task the business dislikes, most often cancelling or unsubscribing, deliberately harder than the task it prefers.
• Forced action: requiring the user to do something unrelated to their goal, such as creating an account or sharing data, in order to complete the thing they came to do.

The line between deceptive design and honest persuasion

A category name alone does not settle whether a given element is a dark pattern. Scarcity and social proof, in particular, describe both legitimate and manipulative practices, and the difference is not stylistic. It is factual.

A low-stock notice that reports the true inventory count is information the buyer can use. A low-stock notice hard-coded to always read "only 2 left" is a lie dressed as information. A testimonial from a real, verifiable customer is evidence; an activity popup announcing purchases that never happened is fabrication. Robert Cialdini's "Influence" cataloged social proof and scarcity as genuine drivers of human decision-making, and honest marketing is entitled to use them. What Mathur and colleagues measured was the counterfeit version: the same psychological lever, but powered by a claim that is not true. The operative test is simple. If the mechanism depends on the user being misinformed, it is a dark pattern. If it works even when the user knows exactly what is happening, it is persuasion.

Manipulation was being sold as a service

The most consequential finding for how we read the whole picture is not a count of patterns but a count of vendors. The crawl surfaced 22 third-party companies whose product was, in effect, dark patterns as a service: widgets and plugins a store could install to generate fake urgency countdowns, invented low-stock warnings, or fabricated recent-purchase notifications.

This reframes the practice. Widespread dark patterns are not solely the work of individually cynical designers. A supply chain existed to make deception a one-click install, which means many site owners deployed these tactics without building them and, plausibly, without fully registering that the "social proof" popup they enabled was manufacturing evidence rather than reporting it. That does not remove responsibility, but it does explain the scale, and it tells an honest operator exactly which category of off-the-shelf tooling to refuse.

Why this became a compliance surface, not just an ethics one

When the research landed, dark patterns were mostly a reputational risk. That has changed. In September 2022 the Federal Trade Commission's Bureau of Consumer Protection published a staff report, "Bringing Dark Patterns to Light," approved unanimously, that drew directly on the Mathur taxonomy and named four recurring tactics it treats as potentially unlawful under Section 5 of the FTC Act: disguised advertising, obstructed cancellation, buried or junk fees, and forced data-sharing. Three of those four map cleanly onto the study's categories of misdirection, obstruction, sneaking, and forced action.

The regulatory picture carries one important nuance for 2026. The FTC's 2024 "click-to-cancel" negative-option rule, which would have codified cancellation-parity requirements, was vacated by the Eighth Circuit on July 8, 2025, on a procedural ground: the agency had not completed a required preliminary cost-benefit analysis. That vacatur did not declare obstructed cancellation lawful. The Restore Online Shoppers' Confidence Act, state auto-renewal statutes, and the FTC's underlying Section 5 authority all remain in force, and a new rulemaking is in motion. The honesty obligation survived the rule that briefly named it.

Reading the friction research alongside the deception research

Dark patterns are worth avoiding on their own terms, but there is a second, quieter argument for refusing them: the manipulative version of a conversion tactic is usually not even the effective one. The largest documented gains in checkout conversion come from removing friction and disclosing cost honestly, not from adding pressure.

Baymard Institute's checkout research, built on a large usability-testing corpus, finds average cart abandonment near 70 percent, with the single most-cited reason being unexpected costs revealed late at checkout, named by roughly 39 percent of abandoning shoppers, followed by forced account creation at roughly 24 percent. Read against the Mathur taxonomy, those two abandonment drivers are the sneaking and forced-action categories, measured from the buyer's side. The tactics the crawl flagged as deceptive are, in the checkout data, the same tactics that lose the sale. Honest disclosure and a guest-checkout option are both the ethical choice and the higher-converting one.

How to use the taxonomy as a build standard

The practical value of the 2019 study for a small business is that its categories double as a pre-launch audit. Before shipping a checkout, a booking flow, or a subscription, an owner can walk each of the seven categories and ask a factual question of their own site.

• Sneaking: is every cost, add-on, and recurring charge visible before the final confirmation step, and is nothing added to the cart the buyer did not choose?
• Urgency and scarcity: does every countdown, deadline, low-stock, and high-demand message reflect a real, verifiable fact, and does it stay honest on refresh?
• Misdirection: is the option that serves the business given the same visual weight and plain language as the option that serves the buyer, with no guilt-laden decline copy?
• Social proof: is every testimonial from a real, identifiable customer, and does every activity or purchase notification report something that actually happened?
• Obstruction: is cancelling or unsubscribing at least as easy as signing up, in the same channel and the same number of steps?
• Forced action: can the buyer complete their goal without being required to create an account or hand over data that the task does not need?