What should teams do about Dark Patterns under the US CCPA?
Teams should treat Dark Patterns under the US CCPA as a source-linked operating decision: confirm whether the issue affects business-threshold status, notice at collection, privacy policy disclosures, consumer rights, do-not-sell/share controls, GPC, service-provider restrictions, or enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to identify the collection point, consumer right, sale/share status, GPC signal, vendor role, and applicable threshold before assigning the CCPA action.
- Write the Dark Patterns decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
CPPA enforcement advisory source for CCPA dark-pattern expectations, including clear language and symmetrical privacy choices.
Official CPPA FAQ source for treating opt-out preference signals, including Global Privacy Control, as CCPA opt-out requests.
CPPA regulations source for CCPA request and consent interface rules that prohibit dark-pattern effects.