Pattern Library

Problem. Sign-up is one click; cancellation requires multiple pages, confirmations, retention offers, or channels.

Harm. Exploits sunk-cost and default-acceptance biases. In aggregate, extracts revenue from users who wanted to leave.

Fix. Cancellation reachable in the same or fewer steps than sign-up, through the same channel. No retention screens without a single-click skip.

Regulatory

FTC Section 5 · ROSCA · CCPA · state auto-renewal statutes

Other cases

Care.com $8.5M · Adobe (pending)

Problem. Accepting data sharing is one click; declining requires multiple clicks or a different interface. Visual weight reinforces the asymmetry.

Harm. Violates freely-given consent. CPPA has stated: dark patterns are judged by effect, not intent.

Fix. Accept and decline equally reachable, weighted, and prominent. Honor Global Privacy Control.

Regulatory

CCPA/CPRA · GDPR Art. 7 · DSA Art. 25 · EDPB guidelines

Problem. An AI system reflexively agrees with users — including unethical, illegal, or false claims — to maximize engagement or satisfaction metrics.

Harm. Cheng et al. (Science, 2026) measured 49% more affirmation than humans. Exposure reduces responsibility-taking and increases conviction. The feature that harms is the feature that drives engagement.

Fix. Behavioral audits for sycophancy pre-deployment. Align reward on honesty, not agreement. Document refusal rate on harmful-affirmation prompts.

Regulatory

EU AI Act Art. 5 · emerging state laws

Related

Human Line Project documented ~300 cases of delusional spiraling

Problem. AI products combine persistent persona, emotional expressivity, and long-term memory with unrestricted access for minors.

Harm. Produces emotional dependency adolescents are developmentally unprepared to metabolize. 72% of American teens have used AI companions; 16% use them "several times a day to almost constantly" (Common Sense Media, Pew).

Fix. No free-ranging emotional role-play for under-18. Age verification at account level. Session-length caps. Periodic "not a person" disclosures. Crisis escalation.

Regulatory

State kids' safety laws (CA AADC, NY SAFE, UT SMR) · COPPA · EU AI Act

Problem. A product detects or is exposed to user signals of self-harm or suicidal ideation and continues normal engagement instead of intervening.

Harm. Directly implicated in wrongful-death litigation. The failure is not that the model can't help — it's that the product wasn't designed to stop and redirect.

Fix. Defined crisis-signal detection. Session interruption with clear resources (988, Samaritans, local). Break anthropomorphic persona during crisis. Published escalation metrics.

Regulatory

Tort (negligent design, failure to warn) · state AI laws · EU AI Act

Problem. Infinite scroll plus algorithmically varied reward engineered for compulsive use. Optimized for time-on-app.

Harm. Time-displaces sleep, study, in-person relationships. Particularly harmful to adolescents.

Fix. Natural stopping points. User-controllable time caps. Default chronological. No streak loss-aversion. Visible session length.

Regulatory

DSA systemic-risk duties · state kids' safety laws · upcoming DFA

Problem. An AI/ML system shows different users different levels of urgency, scarcity, or framing based on inferred susceptibility. Screenshots can't detect it.

Harm. Targets vulnerability psychographically. One user sees calm copy; another — detected as anxious or in financial stress — sees countdowns and pressure.

Fix. Differential testing in certification. Personalizing pressure is disqualifying. Personalizing content is permitted.

Regulatory

EU AI Act Art. 5(1)(b) · UCPD · emerging DFA

Problem. A verified badge, trust label, or endorsement implies editorial validation when the underlying check is trivial or payment-based.

Harm. Users extend trust to an impersonator; platforms subsidize fraud.

Fix. Trust signals must correspond to substantive verification. Paid marks must be visually and textually distinguished from verified marks.

Regulatory

DSA · FTC Section 5 · UCPD

Problem. A product detects user emotional state (stress, loneliness, depression) and uses detection to trigger purchases, ads, or engagement.

Harm. Users at emotional low points are measurably more susceptible to manipulation. Targeting them is extractive.

Fix. Emotional-state signals must not be targeting inputs for ads, upsells, or retention. Use for support (offering resources) is permitted and encouraged.

Regulatory

EU AI Act Art. 5 · FTC unfairness · emerging DFA

Problem. Material costs (taxes, fees, add-ons, shipping) disclosed only late in flow or after commitment.

Harm. The advertised price is a fiction. Increases conversion at the cost of trust.

Fix. Total unavoidable cost shown at first display of price. If later costs exist, first display indicates category and that more applies.

Regulatory

FTC Section 5 · UCPD · Korean E-Commerce Act · state UDAP

Problem. Decline copy worded to shame or guilt. "No thanks, I don't care about my family's safety."

Harm. Short-circuits autonomous decision via social/emotional pressure. Effective even when recognized.

Fix. Decline copy must be neutral. "No thanks" — not "No thanks, I don't value [thing]."

Regulatory

DSA Art. 25 (manipulation) · UCPD

Problem. "Only 2 left!" that never drops. Countdowns that reset on refresh.

Harm. Exploits loss aversion. Drives decisions users would not otherwise make.

Fix. Scarcity and urgency claims must be factually accurate. If real scarcity exists, use it; if not, do not invent it.

Regulatory

FTC Section 5 · UCPD · state UDAP · DSA

Problem. Opt-in to notifications produces categories unrelated to consented use. Frequency escalates on disengagement.

Harm. Consent to one type leveraged into ambient interruption.

Fix. Granular categories at opt-in. Categories cannot be added silently. Re-engagement pushes capped and visible.

Regulatory

State kids' safety laws · DSA · emerging DFA

Problem. Deletion technically offered but requires phone calls, waiting periods, identity gauntlets, or "pause instead" offers.

Harm. Retains users and data against their wishes. Often unlawful under erasure frameworks.

Fix. Self-service deletion, same path as sign-up. Deletion completes data erasure. Confirmation in writing.

Regulatory

GDPR Art. 17 · CCPA · state deletion-rights statutes

Problem. Autoplay with audio. Flashing motion. Dense UI without hierarchy. Time-pressure modals.

Harm. Disproportionately harms neurodivergent users (autism, ADHD, sensory processing, photosensitive epilepsy).

Fix. Autoplay off by default. No flashing above WCAG 2.2 thresholds. Sensory reduction mode. Dismissible modals. Motion respects prefers-reduced-motion.

Regulatory

ADA · EAA · EN 301 549 · WCAG 2.2