1 Introduction

Every day, millions of users encounter dark patterns in information systems (IS) (Adams and Sarah 2022). Dark patterns refer to user interface design elements that benefit organizations by deceiving and manipulating users (Brignull 2010; Narayanan et al. 2020). Specifically, dark patterns are designed to infringe on user autonomy by preventing informed choices (Loewenstein et al. 2014; Sunstein 2015). In the context of IS, user autonomy can be defined as self-governance that leads to independent choices and the expression of free will among users (Levy 2006). For example, Instagram, a social networking service, deceives users to activate app notifications by providing a modal dialogue with the options “Not Now” and “OK.” Thus, user autonomy is compromised because the necessary option to decline the activation is not provided. As a result, usage frequency increases because more and more users are notified about recent updates (Gray et al. 2018). Consequently, users share their frustrations in online forums such as Reddit (r/assholedesign) and Twitter (#darkpattern) by denouncing organizations that utilize dark patterns (Mathur et al. 2021).

Dark patterns in the IS context can be found across multiple industries and services. (Narayanan et al. 2020; Mathur et al. 2021). Organizations implement dark patterns to increase their revenue, collect data, and steer users’ attention (Narayanan et al. 2020). For example, a study by Mathur et al. (2019) shows that around eleven percent of e-commerce websites utilize dark patterns. Surprisingly, well-known websites are more likely to take advantage of dark patterns than little-known websites (Mathur et al. 2019). To protect users and to ensure fair market competition, regulators are taking steps to govern dark patterns (Akhtar 2021). However, regulating dark patterns is challenging because there are already over 100 identified manifestations, and that number continues to grow (Mathur et al. 2019). To protect users against dark patterns, research on digital nudging has proposed several countermeasures, including design principle recommendations and ethical guidelines that aim to guide user interface design processes and ensure user autonomy (Weinmann et al. 2016), but these recommendations and guidelines are neither uniformly mandatory nor enforceable. Consequently, there is only limited research into this potentially dangerous form of user manipulation and deception, despite the need for IS researchers and practitioners to better understand the full scope of dark patterns and to curtail their application by organizations to protect users (Narayanan et al. 2020).

2 Evolution and Significance of Dark Patterns

Initially, manipulation and deception techniques were predominantly applied in brick-and-mortar retail advertising to increase sales (Troisi et al. 2020). With the increasing digitization of sales and advertising processes, organizations also started utilizing manipulation and deception techniques in the digital space. During the first decade of the twenty-first century, organizations implemented so-called growth hacking techniques to grow and retain their user base and gain exposure (Narayanan et al. 2020). An example of growth hacking is exploiting user data by inviting everyone in a contact list to use a service without prior permission or notice (Mathur et al. 2021). Over the years, manipulation and deception techniques have also been used for additional purposes, such as to increase revenue, collect data, or steer users’ attention (Narayanan et al. 2020).

In 2010, Harry Brignull first coined the term dark patterns, which refers to “tricks used in websites and apps that make you do things that you didn’t mean to, like buying or signing up for something” (Brignull 2010). Dark patterns (also referred to as deceptive designs) deceive (Narayanan et al. 2020) and manipulate (Westin and Chiasson 2021) users using elements of the choice architecture, which is defined as structure and presentation of choices (Thaler and Sunstein 2008), and the exploitation of psychological vulnerabilities (Mathur et al. 2021). An example for a psychological vulnerability represents the status quo bias, which states that users tend to favor and keep preselected default options (Schneider et al. 2018). Consequently, organizations utilize the status quo bias in dark patterns for instance to foster newsletter subscriptions through preselection of the option to subscribe to the newsletter (Mathur et al. 2021; Weinmann et al. 2016).

However, the initial definition of dark patterns by Brignull (2010) is deficient because it suggests that the subversion of users’ intentions is an essential characteristic of dark patterns. Lukoff et al. (2021) enhance Birgnull’s definition by investigating dark patterns utilized to maximize the time spent on IS. Here, dark patterns such as infinite scrolling, autoplay, and pull-to-refresh are in line with the user’s intention but foster technology addiction (Monge Roffarello and De Russis 2022), which represents an impairment of user autonomy (Levy 2006). In order to provide a more comprehensive definition of dark patterns, we define dark patterns based on Mathur et al. (2021), Weinmann et al. (2016), and Sunstein (2015) as user interface design elements that compromise user autonomy by preventing informed choices and that may lead to adverse outcomes for the user, such as invasion of privacy, financial loss, and technology addiction.

Recent research on dark patterns and related phenomena has focused primarily on specifying dark patterns (e.g., Mathur et al. 2021; Bösch et al. 2016), creating dark pattern taxonomies (e.g., Mildner and Savino 2021; Mathur et al. 2019; Gray et al. 2018), and identifying the ethical considerations of dark patterns (e.g., Gray et al. 2018; Fansher et al. 2018). In addition, several studies investigate dark patterns in the context of privacy violations (e.g., Mager and Kranz 2021; Nouwens et al. 2020). In recent years, the volume of research into dark patterns has increased steadily, which also illustrates its relevance for the scientific community (Lukoff et al. 2021). At the same time, the growing pervasiveness of digital technologies in professional and private environments underscores the need to understand and protect users against the effects of dark patterns (Weinmann et al. 2016).

As user information is often collected, shared, and sold by organizations without users permission, there is also a clear demand that such dark patterns need to be regulated by governmental institutions (Smit et al. 2014). Consequently, institutions worldwide invest substantial effort into regulating dark patterns by law (Nouwens et al. 2020; Narayanan et al. 2020). To date, most regulations aim to protect users’ data privacy rights (Akhtar 2021). In 2016, the European Parliament passed the General Data Protection Regulation (GDPR), the most comprehensive regulation of user information to date (European Parliament 2016). The GDPR forces organizations to ask users for their consent before collecting any data, provide comprehensive and clear information about how and what data will be collected and processed, and give users the free choice to allow or refuse data collection. Furthermore, data collection consent must be given for one or several specified purposes, and pre-ticket boxes or inactivity may not be interpreted as a user choice or implied consent. Consents also require unambiguousness that results in an affirmative choice of the user. Finally, consent requests must be clearly distinguishable from other user interface design elements (European Parliament 2016).

Although regulations such as GDPR help to protect users against dark patterns, they have limitations. Given that GDPR prohibits the omission of relevant information, organizations utilize user interface design elements to persuade users to provide consent to data collection, which consequently undermines user autonomy (Kollmer 2022). In addition, existing regulations only apply to the use of consents, not to dark patterns per se, which extend to many more aspects of IS (Di Geronimo et al. 2020).

3 Conceptualizing Dark Patterns

Our proposed conceptualization aims to establish a comprehensive and unified understanding of dark patterns. Overall, dark patterns compromise user autonomy by preventing informed choices through digital dark nudges and digital sludges. In the following section, we will define and discuss these two terms and their relationship in greater detail (see Fig. 1).

Fig. 1
figure 1

Conceptualization of dark patterns

Full size image

Dark patterns that utilize digital dark nudging and digital sludging apply various manipulation and deception techniques. Manipulation techniques provide complete and accurate options and information to the user but exploit users’ psychological vulnerabilities and prevent informed choices through composition and complication. In contrast, deception techniques include fabrication of false information concerning an option and the intentional omission of relevant information and/or options. Deception techniques may include dark patterns that are not compliant with regulations. For instance, consent walls omit the option to reject the consent and therefore are not compliant with regulations such as GDPR (Gray et al. 2021). In summary, organizations often utilize a mixture of various manipulation and deception techniques to create dark patterns within their IS.

3.1 Digital Dark Nudging and Digital Sludging as Building Blocks for Dark Patterns

Generally, digital dark nudging and digital sludging represent the essential building blocks in the conceptualization of dark patterns. The term nudging was first introduced in behavioral economics by Thaler and Sunstein (2008), who define it as “any aspect of the choice architecture that alters people's behavior in a predictable way without forbidding any options or significantly changing their economic incentives” (Thaler and Sunstein 2008).

In the digital space, the term digital nudging emerged for user interface design elements that guide users’ choices (Weinmann et al. 2016). Thereby, digital nudges activate the non-volitional user agency and facilitate user choices (Meske and Potthoff 2017). Several scholars have proposed nudging principles (e.g., Weinmann et al. 2016) and ethical guidelines (e.g., Renaud and Zimmermann 2018; Sunstein 2015) to “maximize the good of the nudgee, as judged by the nudgee him- or herself” (Renaud and Zimmermann 2018), which can be achieved by promoting user autonomy and informed choices (Sunstein 2015). For instance, a digital nudging principle is the mapping of difficult and complex information to familiar evaluation schemes to simplify the information provided (Weinmann et al. 2016). In addition, ethical guidelines demand that digital nudging should respect users’ expectations of truthful information and should only be utilized for essential options (Acquisti et al. 2017; Jesse and Jannach 2021). Consequently, digital nudging that is aligned with design principles and ethical guidelines promoting user autonomy can be considered digital bright nudging.

In contrast, digital nudging that violates design principles and ethical guidelines and consequently compromises user autonomy is considered digital dark nudging. Specifically, digital dark nudging fosters uninformed choices by complicating, composing, fabricating, and omitting information to manipulate user choices. Digital dark nudging often includes non-essential options during the process. For instance, some European low-cost air carriers undertake digital dark nudging by presenting non-essential options such as travel insurance during the booking process (Weinmann et al. 2016).

In addition to digital dark nudging, dark patterns also represent excessive or unjustified hurdles that complicate users’ task completion (see Table 1). In the IS context, these hurdles are defined as digital sludges (Kollmer 2022). While digital dark nudging predominantly activates non-volitional user agency, digital sludging impedes volitional user agency and therefore restricts intended user choices (see Table 1). Digital sludging often involves intentional or inadvertent waiting times and obstructions to processes (Sunstein 2020). As a result, sludged options impede users’ free choice and autonomy. For instance, the cancellation process of a leading audiobook provider includes multiple steps that present membership benefits in order to influence the user to reconsider the cancellation (Witman 2020). Besides slowing and extending users’ time for task completion, digital sludging also induces unwanted side effects, such as an increased cognitive load, to manipulate users’ choices (Thaler 2018).

Table 1 Manipulation techniques (based on Sunstein 2020)
Full size table

Mills (2020) identifies a symmetry between digital nudging and digital sludging, showing how a digital nudge that favors one choice option can lead to the respective digital sludging of all other choices and vice versa. In other words, digital dark nudging and digital sludging occur in a simultaneous, mutually dependent relationship. For instance, unsubscribing from a magazine or newsletter often involves digital sludging in the form of an onerous series of checks if users really want to terminate their subscription. At the same time, these obstacles and speed bumps to unsubscribing lead to digital dark nudging favoring the decision option to continue to subscribe (Soman 2020).

3.2 Manipulation Techniques

A focal element of dark patterns are manipulation techniques. Hereby, organizations compromise user autonomy by influencing the composition and complexity of choices in several ways. First, organizations influence the composition of choices to foster uninformed choices among users. To achieve this, organizations often rely on user interface design elements such as color, size, and placement to influence recognition (Faraday 2000). Plain color, small sizes, and placement involving scrolling decrease the likelihood of the user interface design element being recognized. In contrast, bright colors, large sizes, and central placement draw user attention (Faraday 2000). For instance, organizations stimulate users’ fear of missing out by prominently indicating the scarcity of their products in user interface design elements (Westin and Chiasson 2021). The fear of missing out is characterized as a user’s anxious expectation that one is absent from having a rewarding experience that others currently enjoy (Przybylski et al. 2013). Consequently, users develop a feeling of urgency and are darkly nudged into selecting a choice, instantly. The resulting choice is often uninformed because the user did not invest enough time to evaluate the remaining choices (Good and Hyman 2020).

Second, organizations often utilize dark patterns to complicate the processes of the IS by using complex language and challenging vocabulary. Such techniques make it harder for users to comprehend and evaluate the choices provided. As a result, the cognitive effort required to decipher complicated options increases (Münscher et al. 2016). According to the phenomenon referred to as the “law of less work” (Solomon 1948), most people (in this case, users) try to avoid excessive cognitive effort within the decision-making process and prefer simple choices. Table 1 provides an overview of the presented manipulation techniques and indicates an exemplary application.

3.3 Deception Techniques

The other focal element of dark patterns are deception techniques that provide supplemental potentialities for organizations to compromise user autonomy by fostering uninformed choices.

The first deception technique of organizations is to introduce false beliefs through fabricated information and/or options. E-commerce organizations commonly use fabrication to increase revenue (Mathur et al. 2021). For instance, deceptive product reviews in e-commerce platforms use false information about product quality and experiences with the product. As a result, users get darkly nudged into ordering products based on fabricated information. At the same time, all other potentially superior choices are sludged (see Table 2).

Table 2 Deception techniques (based on Gray et al. 2021; Luca and Zervas 2016)
Full size table

Dark patterns can also be utilized by omitting relevant information and choices (Münscher et al. 2016), such as when an organization hides the consequences of a choice by creating a disconnect between choice and consequence. As a result, it is difficult for users to evaluate arguments for or against the choice, which leads to uninformed choices and compromised user autonomy (Münscher et al. 2016). In addition, dark patterns include omitting relevant options all together with the outcome that users are sludged and unable to make the respective choice. Furthermore, organizations take actions without disclosing their actions to the user (Bösch et al. 2016). For example, organizations may intentionally omit the information that an online purchase is part of a recurring subscription to users (Di Geronimo et al. 2020). Consequently, users are darkly nudged into purchasing a recurring subscription (Mathur et al. 2021). Table 2 indicates a short description and an exemplary application for fabrication and omission.

4 Recommendations for Future Research on Dark Patterns

As business and information systems engineering (BISE) and IS scholars have become more concerned about the challenges associated with rapid digitization, a common focus is the critical issue of user autonomy (Spiekermann et al. 2022). Our conceptualization of dark patterns demonstrates how manipulation and deception techniques lead to digital dark nudging and digital sludging. In turn, dark patterns compromise user autonomy by preventing informed choices. In the following, we identify specific challenges regarding dark patterns and provide an overview of future research avenues for the BISE/IS community. We structure research opportunities according to three major stakeholders concerned with dark patterns: users, organizations, and regulators.

Users are the individuals exposed to dark patterns and compromised in their autonomy (Sunstein 2015), organizations utilize dark patterns either purposefully or inadvertently in their IS to increase their revenue, collect data, and steer users’ attention (Narayanan et al. 2020). In the same vein, regulators are mainly governmental bodies with an overarching responsibility to ensure fair competition between organizations and to protect users and citizens in general against dark patterns (Mathur et al. 2021). Table 3 summarizes our identified research opportunities within this trifecta of dark pattern stakeholders.

Table 3 Avenues and questions for future research
Full size table

4.1 User Vulnerabilities and Long-term Consequences

As users are targeted by dark patterns and consequently compromised in their autonomy, we suggest investigating user vulnerabilities towards dark patterns and the long-term consequences of dark patterns on users.

Generally, user vulnerability to internet security is highly dependent on their personality profiles (Goel et al. 2017). In the same vein, users’ personality profiles determine users stress levels during the interaction with IS (Pflügner et al. 2021). Therefore, we anticipate that specific personality profiles influence how vulnerable users are to be affected by dark patterns. We thus call for nuanced empirical investigation into dark pattern vulnerabilities based on users’ personality profiles in BISE/IS research.

From a user perspective, existing research predominately focuses on the immediate (short-term) influence of dark patterns on users’ choices (e.g., Bösch et al. 2016). However, utilizing dark patterns can also have long-term consequences for users. For instance, existing research indicates that the dark patterns of infinite scrolling, autoplay, and pull-to-refresh may foster technology addiction among users (Monge Roffarello and De Russis 2022). However, it remains unknown whether dark patterns lead to other potentially harmful long-term consequences for users. Therefore, we recommend future BISE/IS research to examine the long-term consequences of dark patterns for users.

4.2 Organizational Drivers and Long-term Consequences

We recommend future research into the organizational characteristics that lead to the implementation of dark patterns and the negative long-term consequences of dark patterns on organizations.

Previous studies mainly attribute the responsibility for creating dark patterns to the respective user experience (UX) designer (e.g., Fansher et al. 2018). This focus ignores other stakeholders involved in the dark pattern development process, such as requirement engineers, product owners and champions, strategic business executives, and marketing professionals. We recommend that BISE/IS scholars investigate how organizational characteristics such as different stakeholders and their responsibilities, roles, and traits as well as the corresponding corporate culture and processes drive the development and utilization of dark patterns.

In addition, dark patterns can distort free-market competition and create unfair market shares for specific products or services in the short-term (Mathur et al. 2021). But this may also have counter-effects if users recognize and react negatively to the dark pattern techniques utilized. Therefore, future BISE/IS research should investigate the potential long-term negative consequences of dark pattern use for organizations, such as declining user volumes and revenue (Narayanan et al. 2020).

4.3 Unified Design Principles and Regulation Enforcement

The increasing prevalence and ubiquity of dark patterns underscore the crucial role of regulators (Mathur et al. 2019). We encourage future BISE/IS research to investigate the relative effectiveness of mandatory unified design principles in preventing dark pattern use and how these regulations can be enforced.

In order to develop unified design principles, it is necessary to incorporate more ethical considerations into design science methodologies, both in the design process and artifact creation. In particular, engaging in deontological reasoning for design science research contributes to existing design science research within the BISE/IS community (e.g., Haße et al. 2022; Diederich et al. 2020) and may lead to unified design principles that prevent the creation of dark patterns in the first place. This is especially important because technological advancements will lead to novel applications of dark patterns like for example in conversational agents, virtual reality, and the metaverse (e.g., Wohlgenannt et al. 2020).

Additionally, ensuring that organizations comply with dark pattern regulations in IS remains challenging. Currently, most regulations are introduced by governmental bodies and executed as well as enforced by the respective legal authority (Tyler 2001). However, there is significant evidence that many organizations do not comply with dark pattern regulations (Gray et al. 2021; Nouwens et al. 2020). Consequently, we encourage BISE/IS research to investigate the relative effectiveness of various technical measures to enforce organizational compliance with dark pattern regulations. For instance, Mathur et al. (2019) investigate the use of crawlers to identify dark patterns on websites, which could also be used to monitor and enforce organizational compliance with dark pattern regulations.

As there is a keen interest in dark patterns and their implications for various groups in research and society, we encourage BISE/IS scholars to engage in research on dark patterns to guide organizations and regulators and to protect users in the digital space.