About 76% of the websites and mobile apps examined in a 2024 international sweep used at least one dark pattern, according to results published by the International Consumer Protection and Enforcement Network, a coalition that includes the FTC and consumer authorities from 25 countries. That figure sits well above the 37% found in an earlier, narrower 2022 European Commission sweep, reflecting both a broader definition of dark patterns and a rise in their actual use across e-commerce and subscription services.

Regulators have moved from counting these patterns to fining them. The FTC alone has extracted more than $2.9 billion in penalties and consumer refunds from dark patterns cases since 2022, anchored by the record $2.5 billion Amazon Prime settlement finalized in September 2025. Below is what the largest prevalence studies and enforcement actions actually show, with every figure traced to its named source.

What percentage of websites use dark patterns?

Prevalence estimates vary by study design, but every major count lands well above zero. The 2024 ICPEN sweep, the largest and most recent cross-border screening exercise, found 76% of examined sites and apps had at least one dark pattern and 67% had multiple, a sharper result than earlier academic crawls because it targeted sectors, like subscriptions and cookie consent, where dark patterns concentrate.

Figure 1: Prevalence rates differ by methodology and scope, not because dark patterns are becoming rarer. Source: ICPEN 2024 sweep results; European Commission Behavioural Study on Unfair Commercial Practices in the Digital Environment (2022); Mathur et al., Dark Patterns at Scale (2019); EU Consumer Protection Cooperation Network 2022 sweep.

The 97% figure from the European Commission's 2022 behavioral study of popular websites and apps is the highest on this list because its definition of a dark pattern was the broadest, counting low-friction nudges alongside more coercive tactics. The narrower, court-relevant academic definition used by Mathur et al. in 2019 found dark patterns on 35% of the 11,286 shopping sites they crawled, rising to roughly 45% among the top 1,000 highest-traffic domains, a pattern the researchers linked to larger sites having more resources to run conversion-optimization experiments. No matter which study you use, dark patterns are common on high-traffic commercial sites specifically, not evenly spread across the web.

Which dark pattern types show up most often?

Princeton and University of Chicago researchers cataloged 1,818 dark pattern instances across 15 distinct types and 7 broader categories in their 2019 crawl, still the most-cited taxonomy in FTC enforcement filings and academic follow-up work. A 2024 academic taxonomy expanded that list to 68 distinct types as researchers documented newer manipulative patterns in mobile apps and subscription flows that did not exist in 2019.

Figure 2: Category shares among the 1,818 dark pattern instances found across 11,286 shopping sites; sneaking and forced-action tactics are combined into one slice for readability. Source: Mathur et al., Dark Patterns at Scale, CSCW 2019.

Subscription cancellation flows are the category regulators cite most often in actual enforcement actions, even though they represent a smaller share of raw instance counts than urgency or scarcity tactics on retail product pages. That gap matters for anyone building a cancellation or checkout flow: the patterns most likely to trigger a fine are not necessarily the ones that show up most often in a website crawl.

What is the largest dark patterns fine ever issued?

The FTC's $2.5 billion settlement with Amazon, finalized in September 2025, is the largest dark patterns enforcement action to date, made up of $1 billion in civil penalties and $1.5 billion in consumer refunds. The FTC's complaint centered on a Prime cancellation flow employees reportedly called the Iliad Flow internally, a multi-page process the agency said was deliberately built to be long and confusing, and on enrollment screens the FTC said tricked users into signing up without clear consent.

Figure 3: Amazon's settlement dwarfs every prior FTC dark patterns case combined. Grubhub's $140 million judgment was reduced to $25 million on demonstrated inability to pay. Source: FTC press releases, 2022 to 2025.

The Amazon Prime dark patterns settlement is the largest on record $2.5B FTC settlement with Amazonover Prime cancellation dark patterns

Amazon's case followed a pattern the FTC had already used against smaller companies. Epic Games paid $245 million in refunds plus a separate $275 million children's privacy penalty in 2022 over a Fortnite purchase flow the FTC said made it easy to buy items by accident and hard to get a refund. Vonage paid $100 million the same year after the FTC said customers were required to navigate long hold times and speak to a retention agent just to cancel. If you sell any kind of recurring service, a terms and conditions agreement built around clear, current cancellation language is the kind of disclosure regulators check first in these cases.

How is a dark patterns case actually built?

Dark patterns enforcement in the US runs primarily through Section 5 of the FTC Act, which bars unfair or deceptive practices, and the Restore Online Shoppers' Confidence Act, which specifically requires clear disclosure and simple cancellation for negative-option subscriptions. Regulators do not need to prove intent to deceive under Section 5's unfairness prong, only that a practice caused, or was likely to cause, substantial consumer harm that outweighs any benefit.

Figure 4: The two-track legal test the FTC applies to a disputed design pattern. Source: FTC Act Section 5, Restore Online Shoppers Confidence Act, as summarized in FTC v. Amazon and FTC v. Vonage complaints.

State regulators have opened a second enforcement track. California's CCPA regulations explicitly define and prohibit dark patterns in consent and opt-out interfaces, and the state's Attorney General used that authority, alongside broader privacy claims, in a $12.75 million settlement with General Motors in January 2025, the largest CCPA fine issued to date. A separate California sweep of streaming services that began in January 2024 has already produced a $530,000 settlement over app-level opt-out toggles and dark pattern prohibitions written directly into the consent order.

How have dark patterns fines grown over time?

Figure 5: Enforcement escalated from six-figure and low nine-figure settlements in 2022 to a ten-figure settlement by 2025. Source: FTC press releases, California Attorney General press releases, 2022 to 2025.

Every year since 2022 has produced at least one enforcement action large enough to make national news, and the dollar figures have climbed roughly tenfold from the largest 2022 case to the largest 2025 case. That trend line, not any single settlement, is the signal worth tracking if your business relies on subscription billing, cookie consent, or any flow where canceling takes more steps than signing up did.

Comparing the major dark patterns studies and enforcement actions

SourceWhat it measuredHeadline figureYear
ICPEN international sweepSites/apps with at least one dark pattern, 25 countries76% prevalence2024
FTC v. AmazonPrime cancellation and enrollment dark patterns$2.5 billion settlement2025
Mathur et al. (Princeton/U. Chicago)Shopping sites crawled for 15 dark pattern types35% of 11,286 sites2019
California AG v. General MotorsCCPA consent and dark pattern violations$12.75 million settlement2025

Source: ICPEN 2024 sweep results; FTC press releases; Mathur et al., CSCW 2019; California Attorney General press releases.

The Bottom Line

Dark patterns went from an academic research topic to a multibillion-dollar enforcement category in under a decade. Whether you trust the 76% prevalence figure from the 2024 ICPEN sweep, the narrower 35% from the original Mathur et al. crawl, or the 97% ceiling from the European Commission's broadest study, the direction is the same: manipulative cancellation flows, hidden fees, and pressure tactics are common enough that regulators built dedicated legal theories to fine them, and the fines have grown from low millions to $2.5 billion in three years. Any business running a subscription, free trial, or cookie consent banner should treat its cancellation flow as a compliance surface, not just a retention tool, because the FTC and state regulators are now actively looking for exactly this pattern.

Frequently Asked Questions

What percentage of websites use dark patterns? About 76% of the websites and apps examined in a 2024 international sweep by the FTC and consumer protection authorities in 25 countries used at least one dark pattern, with 67% using more than one, according to the International Consumer Protection and Enforcement Network's 2024 sweep results.

What is the largest dark patterns fine ever issued? The $2.5 billion FTC settlement with Amazon in September 2025 is the largest, covering $1 billion in civil penalties and $1.5 billion in consumer refunds over Prime enrollment and cancellation practices the FTC called the Iliad Flow.

How many types of dark patterns exist? Researchers at Princeton and the University of Chicago identified 15 distinct dark pattern types across 7 broader categories in a 2019 crawl of 11,286 shopping websites, and a 2024 academic taxonomy expanded that to 68 distinct types.

Is using dark patterns illegal? It depends on the pattern and jurisdiction, but the FTC has used Section 5 of the FTC Act and ROSCA to bring dark patterns cases resulting in over $2.9 billion in combined penalties and refunds since 2022, and California's CCPA regulations explicitly prohibit dark patterns in consent and opt-out flows.

Where the Numbers Come From

  1. International Consumer Protection and Enforcement Network. (2024). Global sweep of websites and apps across 25 countries. 76% of examined sites/apps used at least one dark pattern, 67% used multiple.
  2. Federal Trade Commission. (2025). "FTC and Amazon Agree to Settle Charges Related to Amazon Prime Membership and Cancellation Practices." $2.5 billion settlement, September 2025.
  3. Mathur, Acar, Friedman, Lucherini, Mayer, Chetty, and Narayanan. (2019). "Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites." ACM CSCW 2019. 1,818 dark pattern instances across 15 types, 35% of 11,286 sites, roughly 45% of the top 1,000 sites.
  4. Federal Trade Commission. (2022). "Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars." $245 million in refunds plus $275 million penalty.
  5. Federal Trade Commission. (2022). "FTC Action Against Vonage Results in $100 Million to Customers Trapped by Illegal Dark Patterns and Junk Fees." November 2022.
  6. Federal Trade Commission and Illinois Attorney General. (2024). "FTC, Illinois Attorney General Take Action Against Grubhub." $140 million judgment, $25 million payable on demonstrated inability to pay.
  7. California Attorney General. (2025). "Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement." January 2025, largest CCPA settlement to date at time of filing.
  8. European Commission, Consumer Protection Cooperation Network. (2023). 2022 sweep of 399 online shops. 148 sites (37%) used at least one of three tracked dark pattern types, most commonly fake countdown timers.
  9. Federal Trade Commission. (2022). "Bringing Dark Patterns to Light." Staff report identifying the four most common dark pattern tactics across e-commerce, cookie consent, children's apps, and subscriptions.

Note: All figures verified as of July 2026. The Grubhub judgment reflects a $140 million order reduced to $25 million payable based on documented inability to pay; treat the payable figure, not the judgment figure, as the actual recovery. FTC and state enforcement totals are refreshed at least twice a year as new settlements are announced.