Consent West-Winds: The Dark Cloud of Dark Patterns

What happened?

On September 4, the California Privacy Protection Agency, the agency responsible for enforcing the California Consumer Privacy Act (CCPA), issued an enforcement advisory on “dark patterns” and their inability to constitute valid consent.

Why does it matter?

Any business whose consent is considered invalid would likely face allegations that all processing activities subject to the CCPA (excluding data collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act, its implementing regulations, or the California Financial Information Privacy Act) and on which that consent is based are unlawful and subject to civil penalties of up to $2,500 per violation, and up to $7,500 for willful violations. Going further, consent is a near-ubiquitous concept, and California’s view of what constitutes valid consent is likely to shift the winds on what constitutes valid consent — and what is conversely considered invalid, deceptive, or unfair — more generally.

What is a dark pattern?

Dark patterns are “choice architectures that have the substantial effect of subverting or impairing a consumer’s autonomy, decision-making, or choice.” Like clouds, this can take many forms, particularly when interpreted by an aggressive regulator. The advisory stressed two important aspects for valid consent (i.e., not being a dark pattern): plain-language explanations and symmetrical choices. A “symmetrical choice” means that consumers can exercise more privacy-protective choices as easily as they can exercise less privacy-protective choices. The advisory provides some examples:

Ultimately, “dark patterns are about effect, not intent,” and identifying them can feel like searching for shapes in the clouds.

What should I consider doing?

1. Keep an eye on the sky. These consent winds may sweep east.
2. Review consent interfaces and processes for dark clouds the CPPA might call a “dark pattern.” Ask:

• Is the language easy to read, in plain language, and free of legal jargon?
• Is the path to the less privacy-protective choice longer or more difficult to reach than the more privacy-protective choice?
• Is it more time-consuming for a consumer to make a more privacy-protective choice?

Here’s hoping for sunny, cloud-free days ahead!

©2026 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.