Sources

The catalogue 44

Works cited

What each source is, what this tool takes from it, and what it does not. The last of those is the one that matters: a citation that does not say where its authority stops is lending more than it has.

1. Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites

   paper Arunesh Mathur, Gunes Acar, Michael J. Friedman, Elena Lucherini, Jonathan Mayer, Marshini Chetty, Arvind Narayanan · 2019 · Proceedings of the ACM on Human-Computer Interaction (CSCW)

   An automated crawl of roughly 11,000 shopping sites, and the first large-scale measurement of deceptive interface patterns in the wild. It produced the seven-category taxonomy that most later work, including the OECD report and much of the regulatory vocabulary, is written against.

   What we take

   The taxonomy. Every rule detector names the category its pattern occupies here, so a finding can be placed in a vocabulary a reader may already know. The paper's approach is also the shape of this tool: measure the interface, do not ask the operator what they intended.

   What we do not

   The prevalence figures. They describe one crawl of one market segment in 2019 and say nothing about any page this tool measures.

   Cited by CNS-001 CNS-002 CNS-003 CNS-004 CNS-005 CNS-006 CNS-007 CNS-008 CNS-009 CNS-010 CNS-011 CNS-012 FRC-001 FRC-002 FRC-003 INT-001 INT-002 INT-003 INT-004 INT-005 INT-006 LLM-COPY-CONFIRMSHAMING LLM-COPY-FALSE-URGENCY LLM-COPY-MISDIRECTION LLM-COPY-OBSCURED-TERMS LLM-COPY-TRICK-WORDING LLM-VIS-DISGUISED-CONTROL LLM-VIS-FALSE-HIERARCHY LLM-VIS-PRESELECTION NAG-001 NAG-002 PRC-001 PRC-002 PRC-003 PRC-004 SOC-001 SOC-002 URG-001 URG-002 URG-003 URG-004 URG-005

2. Dark commercial patterns

   report OECD Committee on Consumer Policy · October 2022 · OECD Digital Economy Papers No. 336, OECD Publishing, Paris

   A survey of the evidence on dark commercial patterns across OECD members: what they are, what the experimental literature says about their effect on consumers, and which enforcement powers member states have used. It consolidates several academic taxonomies into one policy-facing set of categories.

   What we take

   The category names used alongside Mathur's, and the framing of these patterns as a consumer-protection question rather than only a privacy one -- which is why the catalogue covers pricing and forced action, not only consent.

   What we do not

   Its policy recommendations. What a regulator should do is not a claim this tool is in any position to make about a page it scanned.

   Cited by CNS-001 CNS-002 CNS-003 CNS-004 CNS-005 CNS-006 CNS-007 CNS-008 CNS-009 CNS-010 CNS-011 CNS-012 FRC-001 FRC-002 FRC-003 INT-001 INT-002 INT-003 INT-004 INT-005 INT-006 LLM-COPY-MISDIRECTION LLM-COPY-TRICK-WORDING NAG-001 NAG-002 PRC-001 PRC-002 PRC-003 PRC-004 SOC-001 SOC-002 URG-001 URG-002 URG-003 URG-004 URG-005

3. Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them

   guideline European Data Protection Board · Version 2.0, adopted 14 February 2023 · European Data Protection Board

   The EDPB's own taxonomy -- overloading, skipping, stirring, obstructing, fickle, and left in the dark -- worked through concrete interface examples, with the data protection provisions each is commonly assessed under. Version 1.0 used the phrase 'dark patterns'; version 2.0 renamed them 'deceptive design patterns' and reworked the guidance after public consultation.

   What we take

   The category vocabulary, and the worked examples, which are the closest thing available to a regulator saying what a specific interface arrangement looks like from the other side.

   What we do not

   Its scope. The guidelines address social media platform interfaces; this tool scans whatever page it is pointed at, so a category name borrowed from them is a vocabulary, not a finding that the guidelines apply.

   Cited by CNS-001 CNS-002 CNS-003 CNS-004 CNS-005 CNS-006 CNS-007 CNS-008 CNS-009 CNS-010 CNS-011 CNS-012 FRC-001 FRC-002 FRC-003 INT-001 INT-002 INT-003 INT-004 INT-005 INT-006 LLM-COPY-CONFIRMSHAMING LLM-COPY-EMOTIONAL-STEERING LLM-VIS-FALSE-HIERARCHY LLM-VIS-PRESELECTION NAG-001 NAG-002 PRC-001 PRC-002 PRC-003 PRC-004 SOC-001 SOC-002 URG-001 URG-002 URG-003 URG-004 URG-005

4. Regulation (EU) 2016/679 (General Data Protection Regulation)

   legislation 2016, applicable from 25 May 2018 · European Parliament and Council

   The EU's general data protection regime. The provisions this catalogue points at are mostly about consent: Article 4(11) on what consent has to be, Article 6 on having a lawful basis at all, and Article 7 on the conditions consent must meet, including that withdrawing it be as easy as giving it.

   What we take

   The provisions a consent indicator is commonly assessed under. Nothing more: this tool measures an interface, and whether a particular arrangement meets Article 4(11) is a judgement for a qualified reader with the full context.

   What we do not

   Any conclusion. A measured asymmetry between two buttons is a fact about pixels.

   Cited by CNS-001 CNS-002 CNS-003 CNS-005 CNS-006 CNS-007 CNS-008 CNS-009 CNS-010 CNS-011 CNS-012 FRC-003 INT-004

5. Directive 2002/58/EC (ePrivacy), as amended by Directive 2009/136/EC

   legislation 2002, as amended 2009 · European Parliament and Council

   The directive governing confidentiality of communications and terminal equipment. Article 5(3) is the provision behind consent banners: storing information on, or gaining access to information already stored on, a user's device requires consent unless it is strictly necessary for a service the user asked for.

   What we take

   The provision the pre-consent storage and tracker indicators point at. Article 5(3) is technology-neutral and covers more than cookies, which matters because the detectors read localStorage and network requests as well.

   What we do not

   The strictly-necessary judgement. Whether a particular tag is necessary for a service the user requested depends on what the service is, which this tool does not know.

   Cited by CNS-001 CNS-002 CNS-007 NAG-002

6. Directive 2005/29/EC (Unfair Commercial Practices Directive), Annex I

   legislation 2005, as amended by Directive (EU) 2019/2161 · European Parliament and Council

   The UCPD's general clauses on misleading actions and omissions sit in Articles 6 and 7. Annex I is the separate list of practices regarded as unfair in all circumstances, with no case-by-case assessment of their effect -- which is why an indicator that maps onto an Annex I entry is treated as more serious than one resting on Article 6 alone. Points 7 and 22 cover false claims of scarcity and of activity; points 23b and 23c, added by the Omnibus Directive, cover consumer reviews.

   What we take

   The provisions the urgency, scarcity and social-proof indicators are commonly assessed under.

   What we do not

   The determination. Annex I turns on whether a claim is false, and this tool measures only that a claim is made without any visible basis -- which is a reason to look, not a finding that the claim is untrue.

   Cited by CNS-004 FRC-001 INT-002 INT-003 INT-005 INT-006 LLM-COPY-FALSE-URGENCY LLM-VIS-DISGUISED-CONTROL PRC-001 PRC-004 SOC-001 SOC-002 URG-001 URG-002 URG-003 URG-004 URG-005

7. Directive (EU) 2019/2161 (the Omnibus Directive)

   legislation 2019, applicable from 28 May 2022 · European Parliament and Council

   The modernisation directive that amended the UCPD, the Consumer Rights Directive and the Price Indication Directive together. It added the review-related entries to UCPD Annex I and introduced the rule that an announced price reduction must be stated against the lowest price applied in the preceding period.

   What we take

   The basis for the reference-price and review-provenance indicators, both of which exist because this directive made those specific claims regulated ones.

   What we do not

   The prior-price calculation. The rule turns on price history this tool has never seen: a single capture cannot say what a price was thirty days ago.

   Cited by PRC-003 SOC-001 SOC-002 URG-001 URG-003 URG-004

8. Directive 2011/83/EU (Consumer Rights Directive), as amended

   legislation 2011, as amended by Directive (EU) 2019/2161 · European Parliament and Council

   Pre-contractual information duties and the mechanics of concluding a distance contract. Articles 6 and 8 govern what has to be told to a consumer before they are bound and how it must be presented, including that an order button make plain that the order carries an obligation to pay.

   What we take

   The provisions the auto-renewal and pre-selected add-on indicators point at, both of which are about a commitment presented as less than it is.

   What we do not

   The completeness assessment. Whether the required information was given somewhere is a question about a whole checkout flow; the cold pass sees one page of it.

   Cited by CNS-005 FRC-002 LLM-COPY-OBSCURED-TERMS PRC-001 PRC-002 PRC-004

9. Regulation (EU) 2022/2065 (Digital Services Act), Article 25

   legislation 2022, generally applicable from 17 February 2024 · European Parliament and Council

   Article 25 addresses online interface design directly: providers of online platforms may not design, organise or operate their interfaces in a way that deceives or manipulates recipients, or otherwise materially distorts their ability to make free and informed decisions. It is the first EU provision written about deceptive design as such rather than reached through consumer or data protection law.

   What we take

   The provision that nagging and interference indicators are commonly assessed under for platforms in scope.

   What we do not

   The scope determination. Article 25 binds providers of online platforms as the Regulation defines them, and this tool does not know whether the site it scanned is one. The mapping travels with that qualification attached.

   Cited by NAG-001

10. Web Content Accessibility Guidelines (WCAG) 2.2

    standard W3C Web Accessibility Initiative · W3C Recommendation, 5 October 2023 · World Wide Web Consortium

    The accessibility standard. Two success criteria supply numbers this catalogue uses: 1.4.3 Contrast (Minimum), which sets 4.5:1 for normal text and 3:1 for large text, and 2.5.8 Target Size (Minimum), added in 2.2, which sets 24 by 24 CSS pixels.

    What we take

    Two thresholds, and only as measurements. They are the only numbers in `core/detectors/thresholds.py` that come from a published standard rather than from tuning against the fixture corpus, and the catalogue marks them as cited for that reason.

    What we do not

    Any accessibility conclusion. This is not an accessibility scanner: it borrows two measurements because a control that is hard to see is hard to see, and it reports neither conformance nor its absence.

    Cited by INT-001 INT-002

11. Digital Markets, Competition and Consumers Act 2024

    legislation 2024. Consumer provisions in force 6 April 2025; the subscription contracts regime was still awaiting commencement as at September 2026 · Parliament of the United Kingdom

    The United Kingdom's post-Brexit consumer regime, which replaced the domestic implementation of the UCPD and gave the Competition and Markets Authority direct enforcement powers. It names drip pricing and fake reviews specifically, and carries a subscription regime covering reminders and cancellation whose commencement has slipped more than once.

    What we take

    A pointer, for operators auditing sites that trade into the United Kingdom, that the pricing and review indicators have a separate domestic basis there.

    What we do not

    Any assumption that it is in force as described. Commencement has moved repeatedly; the date above is what was published when this entry was written and it needs re-checking before anybody relies on it.

    Cited by PRC-001 SOC-001