The Complaint
Every dark pattern in Meet Doris, the real case behind it, and the fair version.
BENDING MACHINE WORKS RETENTION TRIBUNAL · DOCKET NO. 1-OF-1 · FILED TODAY
In re: Your Attempt to Leave
Plaintiff: You · Defendant: Bending Machine Works, a fictional vending-machine company
There is no recorded game in this tab. You can read every case below without playing.
Leaving should take as many clicks as arriving. Amazon's own cancellation flow, which it called "Iliad", took 6 clicks. Uber One allegedly took up to 32 actions. Both are in the Counts below.
Open a pattern below to see what happened, the real case behind it, and how a fair version would work.
Alleged means claimed, not established; pending means the case is unresolved; settled means the parties resolved it by agreement; fined means a regulator imposed a financial penalty, which may be under appeal; vacated means a court set an order or rule aside. A settlement does not, by itself, establish wrongdoing.
Met one of these for real? The Dark Patterns Tip Line collects examples. In California, the California Privacy Protection Agency takes complaints about opt-outs that do not work.
Count One
What this dark pattern does. Doris’s chat never answers your request, and her unread count keeps rising. Asking to leave twice brings out a Leave site button, which opens a card where Bending Machine Works treats the × as permission to extend your stay. The card’s actual exit is a pale link below the buttons.
Exhibit. In 2016 Microsoft's "Get Windows 10" prompt treated clicking the red × as agreement to a scheduled upgrade. A California travel agent whose work PC upgraded itself won $10,000 in small-claims court; Microsoft dropped its appeal, then changed the prompt and called the old behavior confusing. Status: judgment paid, no admission.
The fair version. The × closes the dialog without accepting the offer. California's CCPA regulations require choices that are symmetrical and not confusing (11 CCR §7004); the EDPB calls this one "Misleading action".
Source: Computerworld, Microsoft backs off the click-the-X trick (2016)
Source: 11 CCR §7004, symmetry in choice
Count Two
What this dark pattern does. Doris rewrites a simple goodbye as an apology, a declaration of devotion, and a promise to stay. She treats her edits as your choice. She accepts the guilt-laden wording, but a letter that promises to stay cancels the cancellation. Restoring the request to leave gets you out; undoing the guilt is your choice.
Exhibits. The FTC's complaint against Amazon quoted the Prime decline link as "No thanks, I do not want fast, free shipping". Amazon settled in September 2025 for $2.5 billion: a $1 billion civil penalty and $1.5 billion in refunds, with no admission. In a 2021 experiment, Luguri and Strahilevitz found that aggressive dark patterns raised acceptance from 11.3% to 41.9%; mild ones reached 25.8%. One real decline line, collected by deceptive.design from a first-aid retailer, read "No, I prefer to bleed to death".
The fair version. Let people cancel without making them explain or apologize. Keep their words unchanged.
Source: FTC, Amazon settlement (September 2025)
Source: Luguri and Strahilevitz, Shining a Light on Dark Patterns (2021)
Source: deceptive.design, Confirmshaming
Count Three
What this dark pattern does. Accepting takes 1 click. Rejecting means searching through 1,037 consent settings, 367 legitimate-interest settings, and purposes hidden inside nested menus. Some switches flip back. Leaving a tab discards unsaved changes. Object all asks whether you are sure. Confirming it twice stops those switches from reverting, but each tab’s choices still need to be saved before leaving it.
Exhibits. In January 2022 France's CNIL fined Google €150 million and Facebook €60 million because refusing cookies took several clicks while accepting took 1. In March 2025 the California Privacy Protection Agency fined American Honda $632,500; opting out took 2 steps and "Allow All" took 1. Nouwens and colleagues checked 680 consent banners in 2020 and found that 11.8% met minimal legal requirements; removing the first-page reject button raised consent by 22 to 23 points.
The fair version. Accept all and Reject all appear side by side at the same size. That is what 11 CCR §7004(a)(2) calls symmetry and what the EDPB's guidelines on deceptive design patterns describe.
Source: CNIL, cookies decisions against Google and Facebook (2022)
Source: CPPA, American Honda decision (March 2025)
Source: Nouwens et al., Dark Patterns after the GDPR (CHI 2020)
Count Four
What this dark pattern does. Bending Machine Works advertises a free exit, then adds fees, preselected insurance, and a trial that renews. It keeps resetting the deadline, and Leave works for only 2 seconds after you untick both extras. An ad poses as the exit and opens another offer. Booking the holiday adds another charge. The reason for leaving is hidden in a country list. The CAPTCHA keeps moving the goalposts: first the exits, then every photo of Doris, then a test asking you to identify human thoughts.
Exhibits. The FTC and seven states sued Live Nation and Ticketmaster in September 2025 over mandatory fees that added up to 44% and were left out of advertised prices; the court refused to dismiss the case and it is pending. In April 2026 the UK's Competition and Markets Authority fined AA and BSM Driving Schools £4.2 million for a £3 booking fee added late in checkout. The US Department of Justice sued Adobe in June 2024 over an early-termination fee kept in fine print and hover icons; a $150 million settlement was proposed in March 2026. In 2014 Which? reported that Ryanair's "don't insure me" option sat inside the country-of-residence list, between Denmark and Finland. In 2019 six hotel booking sites gave the CMA undertakings over "only 1 room left" claims. Mathur and colleagues found 393 countdown timers across about 11,000 shopping sites in 2019, some of which reset on reload.
The fair version. The first price includes every required fee. You choose any optional extras yourself. A reason field lists reasons for leaving.
Source: FTC v. Live Nation and Ticketmaster (September 2025)
Source: CMA, AA and BSM drip pricing (April 2026)
Source: DOJ, Adobe proposed settlement (March 2026)
Source: Mathur et al., Dark Patterns at Scale (2019)
Count Five
What this dark pattern does. Bending Machine Works presents a 212-page agreement. It preselects "do not not agree" and buries a firstborn clause, a community-service clause, and an actual exit in the terms. The fine print needs a magnifier. Drawing a signature breaks the pencil and starts a 1-second wait for a replacement.
Exhibits. Obar and Oeldorf-Hirsch gave 543 people a fake social network to join. 74% used "quick join"; those who opened the privacy policy spent about 73 seconds on text that needed about 30 minutes. The terms included giving up a firstborn child. In April 2010 the retailer GameStation added an "immortal soul" clause and reported that about 7,500 shoppers agreed. In July 2017 the Wi-Fi provider Purple added up to 1,000 hours of community service, including hugging stray cats and dogs; over 22,000 people agreed and one noticed. McDonald and Cranor estimated in 2008 that reading every privacy policy you meet would take about 201 hours a year.
The fair version. The company uses short terms, leaves the choice to you, and makes the opt-out as visible as the option to agree. California Civil Code §1798.140(h) says agreement obtained through dark patterns is not consent.
Source: Obar and Oeldorf-Hirsch, The Biggest Lie on the Internet
Source: Purple, the community-service clause (2017)
Source: McDonald and Cranor, The Cost of Reading Privacy Policies (2008)
Count Six
What this dark pattern does. Joining takes 1 click online. Cancellation leads through a phone menu, a postal desk, and an office. A letter has to be folded, stamped, and mailed, then comes back for an office seal. The counter skips the visitor's ticket, and ringing the bell closes the desk for lunch. The clerk's direct extension is listed in the office's staff directory, and it works only after the visitor has tried the post and the office.
Exhibits. Amazon's internal name for its Prime cancellation flow was "Iliad". The FTC's complaint described 4 pages, 6 clicks and 15 options; the case settled in September 2025. The FTC sued Uber in April 2025, alleging that canceling Uber One could take up to 23 screens and 32 actions; that case is pending. The Norwegian Consumer Council documented the drifting labels in 2021 (End Membership, Cancel My Benefits, Continue to Cancel, End Now), and in July 2022 Amazon committed to 2-click cancellation across the EU. A New York court found in November 2024 that SiriusXM's cancellation process violated the federal subscription law after cancellations averaged 11.5 minutes by phone.
The fair version. Cancel the way you joined, with no extra hurdles. California AB 2863 requires cancellation through the same medium used to sign up or usually interact, and online cancellation without obstructive steps. It applies to covered subscription contracts entered into, amended, or extended from July 1, 2025; it does not require identical click counts. Separately, GDPR Article 7(3) says withdrawing consent must be as easy as giving it. The FTC's own click-to-cancel rule was adopted in October 2024, set aside by a federal appeals court in July 2025 on procedural grounds, and is back at the advance-notice stage as of 2026.
Source: FTC amended complaint against Amazon (2023)
Source: FTC v. Uber (April 2025)
Source: Norwegian Consumer Council, You can log out, but you can never leave (2021)
Source: New York Attorney General, SiriusXM decision (November 2024)