Dark patterns and the EU digital services act: Mapping autonomy violations and design factors

Ahuja, S., Gunawan, J., Bielova, N., & Santos, C. (2025). Dark patterns and the EU digital services act: Mapping autonomy violations and design factors. Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems (CHI ‘26), April 13â•fi17, 2026, Barcelona, Spain. https://doi.org/10.2139/ssrn.5555765

View paper

Summary

This paper builds a “law-to-design” framework that connects HCI scholarship on dark patterns with Article 25 of the EU Digital Services Act (DSA), which prohibits interface designs that deceive, manipulate, or distort/impair user autonomy. The authors qualitatively map 59 meso- and low-level dark patterns from Gray et al.’s unified ontology onto these three autonomy violation types and derive eight underlying design factors, split between an “information space” and a “choice space.” Crucially, the work reverses the usual direction of inquiry — instead of asking how design maps onto law, it operationalizes legal categories into concrete, diagnosable design criteria that can support both enforcement and compliance-by-design.

Key Contributions

• First comprehensive “law-to-design” alignment mapping 59 dark patterns onto the three DSA Article 25 autonomy violation types.
• An eight-factor design vocabulary organized into an Information Space (Availability, Correctness, Framing, Presentation) and a Choice Space (Availability, Effort, Simplification, Presentation).
• Structured, per-pattern reasoning templates explaining why each pattern constitutes a given violation, released as appendix text and a supplementary CSV.
• Demonstration of extensibility to attention-capture damaging patterns and to the live EU Commission case against X over paid blue checkmarks.
• A translational argument that HCI methods can ground a new field of regulatory design auditing.

Methods

The authors used Gray et al.’s (2024) hierarchical dark pattern ontology as their corpus, focusing on 59 meso- and low-level patterns. They adopted Santos et al.’s legal interpretation of Article 25 — defining deception (interfering with perceptions of truth), manipulation (steering behavior), and distortion/impairment (constraining behavior) — as their codebook. Two authors independently coded each pattern for autonomy violations and resolved discrepancies over three consensus rounds. Design factors were inductively derived from coders’ rationale memos, then deductively re-applied to 34 low-level patterns (Cohen’s Kappa = 0.679). External validity was tested against 11 attention-capture damaging patterns and the X blue-checkmark case.

Findings

• 17 of 59 patterns map to a single violation type; 42 implicate multiple, and 11 trigger all three.
• Deception–manipulation is the largest overlap (22 patterns), suggesting a continuum, while manipulation–distortion co-occurrence is rare (2 patterns).
• High-level strategies show internal consistency: all Sneaking patterns involve deception, all Obstruction involve distortion/impairment, all Social Engineering involve manipulation; Forced Action is most diverse.
• Violations co-occur in three modes: separately, through temporal progression (e.g., drip pricing), or by mutual reinforcement (e.g., Sneak into Basket).
• Each design factor drives specific violations — Information Availability/Correctness → deception; Framing, Presentation, Choice Simplification/Presentation → manipulation; Choice Availability/Effort → distortion/impairment.
• Meso-level patterns sometimes carry fewer violation labels than their constituent low-level patterns due to added execution detail.
• Applied to X’s paid blue checkmarks, the framework supports classifying the redesigned verification icon as deception under Article 25.

Connections

This paper sits within the platform-governance strand concerned with operationalizing EU digital regulation, and connects most directly to work on the DSA’s data-access and enforcement mechanisms such as Rieder2026-pp and Rieder2025-ju. Its focus on translating legal categories into auditable design criteria complements broader discussions of platform accountability and researcher/regulator access, though its specific HCI dark-patterns lens is otherwise largely distinct from the misinformation- and coordination-focused papers under this topic.

Podcast

A research-radio episode discusses this paper: 🎧 MP3 · Spotify · Apple Podcasts