Artifact GuideUS CCPADark Patterns

US CCPA Dark Patterns

Dark Patterns decisions under the US CCPA should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

This guide converts official requirements into scope, evidence, ownership, and review decisions for practical implementation, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

A dark pattern is a user interface that has the effect of substantially subverting or impairing consumer autonomy, decisionmaking, or choice. This page maps US CCPA obligations for Dark Patterns to trigger conditions, accountable owners, required deadlines, evidence records, and review paths that product, legal, privacy, security, and compliance teams can apply.

Section 1

What should teams decide about Dark Patterns under the US CCPA?

Start by deciding whether the issue affects business-threshold status, notice at collection, privacy policy disclosures, consumer rights, do-not-sell/share controls, GPC, service-provider restrictions, or enforcement exposure. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

Keep the California source, threshold calculation, notice text, consumer-right workflow, opt-out/GPC evidence, and service-provider contract record together so the CCPA decision can be reviewed later.

Define the exact Dark Patterns trigger and the business process it affects.
Record which role, product, system, customer group, or data flow is in scope.
Attach the source-linked rule, the owner, and the evidence field before approving the control.
Escalate uncertainty when the facts depend on thresholds, exemptions, cross-border activity, vulnerable users, or enforcement-sensitive wording.

Sources for this answer

AVOIDING Dark Patterns: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Official CPPA advisory explaining CCPA dark-pattern risks, clear language, and symmetry in consumer privacy choices.

California Privacy Protection Agency - CCPA dark patterns advisory

Official CPPA advisory for assessing whether CCPA choice interfaces use clear language and symmetrical choices.

CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations

Official CPPA rulemaking page for current CCPA updates; use CPPA dark-pattern guidance for interface-review decisions.

Section 2

Who should own Dark Patterns, and what evidence should prove the decision?

Ownership should sit with the team that can change notices, request intake, ad-tech settings, vendor contracts, data retention, or consumer-facing controls, with privacy/legal review for ambiguous cases.

Evidence should show threshold calculations, notice-at-collection placement, privacy-policy disclosures, rights request logs, opt-out/GPC handling, vendor restrictions, and enforcement-response readiness.

Name one accountable owner and one reviewer for the Dark Patterns workflow.
Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.

Sources for this answer

California Privacy Protection Agency - CCPA dark patterns advisory

Official CPPA advisory for assessing whether CCPA choice interfaces use clear language and symmetrical choices.

CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations

Official CPPA rulemaking page for current CCPA updates; use CPPA dark-pattern guidance for interface-review decisions.

California Privacy Protection Agency - CCPA regulations text

Official CPPA regulations text for CCPA choice, consent, and dark-pattern compliance checks.

Section 3

Which edge cases should teams check before relying on a Dark Patterns decision?

Most CCPA mistakes happen at the boundary between a business, service provider, contractor and third party, or between selling, sharing, financial incentives, minors, GPC, and data-broker obligations.

Apply this section before launching a consumer choice interface, opt-out flow, consent flow, financial incentive, minor-focused journey, GPC handling path, or vendor-propagation process.

Check whether the rule changes for minors, financial incentives, opt-out preference signals, service-provider or contractor roles, third-party sharing, or data-broker interactions.
Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
Track unresolved assumptions in an open-questions section and route legal interpretation points for review.

Sources for this answer

AVOIDING Dark Patterns: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Official CPPA advisory explaining CCPA dark-pattern risks, clear language, and symmetry in consumer privacy choices.

California Privacy Protection Agency - CCPA dark patterns advisory

Official CPPA advisory for assessing whether CCPA choice interfaces use clear language and symmetrical choices.

CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations

Official CPPA rulemaking page for current CCPA updates; use CPPA dark-pattern guidance for interface-review decisions.

California Privacy Protection Agency - CCPA regulations text

Official CPPA regulations text for CCPA choice, consent, and dark-pattern compliance checks.

Section 4

How should teams operationalize Dark Patterns with proportionate controls?

Use a CCPA workflow that captures threshold status, data category, collection point, consumer right, opt-out or GPC trigger, vendor role, evidence, owner, and review date.

The output should be a threshold note, notice update, DSAR decision, opt-out/GPC record, vendor clause map, dark-pattern review, or enforcement evidence pack.

Create a short intake question that identifies the Dark Patterns scenario.
Map the answer to a required action, evidence field, owner, reviewer, and review date.
Link related artifact pages with descriptive anchors so users can move from scope to deadlines, controls, penalties, and templates.
Update the workflow when official source material changes or when internal evidence shows recurring exceptions.

Sources for this answer

AVOIDING Dark Patterns: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Official CPPA advisory explaining CCPA dark-pattern risks, clear language, and symmetry in consumer privacy choices.

California Privacy Protection Agency - CCPA dark patterns advisory

Official CPPA advisory for assessing whether CCPA choice interfaces use clear language and symmetrical choices.

CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations

Official CPPA rulemaking page for current CCPA updates; use CPPA dark-pattern guidance for interface-review decisions.

Recommended next step