Subscription dark patterns face mounting FTC enforcement despite legal setbacks

The FTC has identified a specific type of website design as an unfair business practice: dark patterns—interface layouts that manipulate or deceive consumers into choices they would not otherwise make. The target is subscriptions. An Amazon Prime signup that buttons keep reappearing, a streaming service trial that converts to paid without clear warning, a fitness app where cancellation requires a phone call: these are dark patterns. The Federal Trade Commission treats them as intentional deception, not mere design flaws.

In October 2024, the FTC finalized a rule requiring companies to make subscription cancellation as simple as signup. But legal challenges have complicated enforcement. A federal appeals court vacated the rule in July 2025. Yet FTC action continues through enforcement under existing authority, including a landmark $2.5 billion settlement with Amazon in September 2025. For subscription businesses, the rules keep shifting—but the underlying principle does not.

What dark patterns look like

Dark patterns are user interface designs that impair consumer autonomy or manipulate choice. The FTC staff report "Bringing Dark Patterns to Light," published in September 2022, categorized them in granular detail with concrete examples from real companies. Common patterns include: checkout processes that bury or obscure cancellation options; pre-ticked consent boxes that require active unchecking; misleading language that misrepresents costs or terms; requiring consumers to navigate multiple screens or switch channels (phone calls, emails) to cancel rather than offering online cancellation equivalent to signup; and confirm-shaming—designs that make choosing not to subscribe socially uncomfortable or imply negative consequences.

These designs specifically exploit cognitive shortcuts. They take advantage of how people process information under time pressure, or how they respond to friction. Amazon's design, according to the FTC's 2023 lawsuit, presented Prime repeatedly during checkout while obscuring the option to decline, making consumers navigate a confusing path to cancel later. The agency calls this entrapment: "roach motels," in which sign-up is painless but escape requires sustained effort.

The Negative Option Rule and Click-to-Cancel requirements

The FTC's original Negative Option Rule, established in 1973 and amended multiple times, governs automatic renewal programs—subscriptions that renew unless the consumer cancels. In October 2024, the FTC voted 3-2 to finalize an updated version, colloquially called the Click-to-Cancel rule, with two commissioners dissenting. The rule applied to subscriptions, memberships, and any recurring-payment arrangement. Its core mandate: "Sellers must provide a simple mechanism for consumers to cancel the plan, as easy to use as the method the consumer used to sign up."

For online signups, the rule required online cancellation. Businesses had to obtain express informed consent—unambiguous affirmative agreement, separate from other transaction terms—before charging. Mandatory disclosures had to appear immediately adjacent to the consent mechanism: the full cost, frequency and timing of charges, when charges would occur or increase after any trial, and how the consumer could cancel. The rule prohibited misrepresentation of material facts, including costs, purpose, efficacy, health and safety, endorsements, refunds, or other product characteristics. Companies had to maintain records proving consumer consent for three years. Compliance deadlines were set to begin 180 days after Federal Register publication.

Legal challenge and ongoing enforcement

The FTC finalized its rule in November 2024 in the Federal Register. But in July 2025, the U.S. Court of Appeals for the Eighth Circuit vacated it, ruling that the FTC had failed to complete a preliminary regulatory analysis required by Section 22 of the FTC Act for rules with implementation costs exceeding $100 million. The court's decision did not address the rule's merits—only the agency's procedural compliance. The FTC did not appeal the vacatur.

The vacatur created uncertainty, but did not end enforcement. The FTC made clear it would continue pursuing dark-pattern violations under Section 5 of the FTC Act, which prohibits unfair or deceptive acts affecting commerce. Section 5 is broader than the specific rule—it captures a wider range of deceptive practices without the procedural requirements that tripped up Click-to-Cancel. The FTC stated that the principles behind the rule—transparency, express informed consent, and easy cancellation—remain enforceable.

Enforcement signaling: The Amazon settlement

In September 2025, the FTC secured a $2.5 billion settlement with Amazon, then the largest settlement in FTC history. The agency alleged that Amazon had used dark patterns to enroll millions of Prime members and created an intentionally complex cancellation process. According to the FTC's 2023 complaint, Amazon's checkout repeatedly presented Prime subscription prompts while obscuring the option to decline, and the cancellation process was deliberately convoluted. The settlement required Amazon to pay $1 billion in civil penalties and refund $1.5 billion to roughly 35 million customers affected by unwanted enrollment or deferred cancellation.

By September 2026—a year after the settlement—Amazon had issued over $845 million in refunds to eligible Prime customers. The settlement required Amazon to redesign its enrollment and cancellation interfaces to clearly disclose the cost, frequency, material terms, and cancellation mechanism. The settlement did not establish law, but it signaled enforcement priority. Companies across subscription industries—streaming, fitness, publishing, software—face similar exposure if their practices manipulate consumer choice.

What companies must do now

The vacatur of Click-to-Cancel did not invalidate its underlying logic. Companies offering negative-option programs should assume the FTC will use Section 5 to challenge practices that violate the rule's core principles. The safest path: treat the rule's requirements as binding. Ensure signup and cancellation are conducted through the same channel—online signup requires online cancellation, not phone or chat. Provide express, unambiguous consent that is separate from other terms and visibly presented. Disclose the full cost, frequency, renewal terms, and cancellation method before charging. Do not bury or obscure cancellation options. Do not misrepresent facts about costs or efficacy. Maintain three-year records of consent.

State laws amplify these requirements. California's automatic renewal law (part of the broader Consumer Privacy Act framework) requires "symmetry of choice"—if consumers accept with one click, they must reject with equal ease. Other states have similar provisions. For companies operating nationally, complying with the strictest state standard typically means compliance everywhere.