From grimoire
Audits e-commerce, subscription, and consent flows for deceptive UX patterns (Brignull taxonomy) and redesigns to eliminate manipulation while preserving conversion goals.
How this skill is triggered — by the user, by Claude, or both
Slash command
/grimoire:prevent-dark-patternsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Audit flows for Brignull's dark pattern taxonomy, classify each by deception type and legal risk, and redesign to eliminate manipulation while preserving legitimate conversion goals.
Audit flows for Brignull's dark pattern taxonomy, classify each by deception type and legal risk, and redesign to eliminate manipulation while preserving legitimate conversion goals.
Adopted by: The EU Digital Services Act (DSA) Article 25 (2022) explicitly prohibits dark patterns for platforms with 45M+ EU monthly users; the FTC published "Bringing Dark Patterns to Light" (2022) with enforcement guidelines and named dark patterns in settlements against companies including Amazon (2023, $25M settlement) and Vonage (2023, $100M settlement); the Norwegian Consumer Council's "Deceived by Design" (2018) report named Google, Facebook, and Microsoft as dark pattern practitioners and triggered regulatory investigations in multiple EU jurisdictions Impact: FTC enforcement actions demonstrate measurable financial and reputational risk: Amazon's $25M settlement for Prime cancellation dark patterns; Epic Games' $520M settlement for dark patterns targeting children in Fortnite; the EU's enforcement of DSA Article 25 creates ongoing regulatory exposure for platforms with large EU user bases; NNG user studies show dark patterns reduce long-term trust and customer lifetime value even when they improve short-term conversion metrics Why best: Dark patterns produce short-term conversion gains at the cost of long-term trust — users who feel manipulated churn, leave negative reviews, and do not return; the alternative to dark patterns is not zero conversion — it is honest conversion, where users who take an action do so intentionally and remain customers; the legal and reputational risk of dark patterns now exceeds their conversion benefit in most regulated markets
Sources: Brignull "Deceptive Design" (deceptive.design, 2010 — updated taxonomy); EU Digital Services Act Article 25 (2022); FTC "Bringing Dark Patterns to Light" (2022); NNG "Dark Patterns in UX" (Gibbons, 2023); Norwegian Consumer Council "Deceived by Design" (2018)
Review the flow for each of the following patterns:
Trick questions Pre-checked boxes that opt users into things they didn't intend. Inverted or confusing checkbox logic ("Uncheck to not receive emails").
[✓] Yes, I want to receive marketing emails (pre-checked)[ ] Send me product updates and offers (unchecked by default)Sneak into basket Items added to the cart during checkout without explicit user action (often insurance, add-ons, or donations).
Roach motel Easy to get into, hard to get out of. Subscriptions with a "1-click signup" but a multi-step phone-call-required cancellation.
Privacy zuckering Confusing, layered privacy settings designed to maximize data collection by making the privacy-protective option hard to find or understand.
Misdirection Visual design or copy draws attention to one option while obscuring another. Typically used to make the undesirable choice (for the user) visually prominent.
Confirmshaming Opt-out copy that shames or guilts the user for declining: "No thanks, I hate saving money."
Disguised ads Content or links styled to look like editorial content, search results, or system UI.
Forced continuity Free trial that requires credit card; automatic billing at end of trial with no warning email.
Hidden costs Fees, taxes, or charges that appear only at the final step of checkout.
Bait and switch Advertising one outcome but delivering another. Clicking "Update now" installs software the user didn't intend.
Interface interference Making the privacy-protective or consumer-protective option harder to use — greyed out buttons, extra confirmation steps, broken unsubscribe links.
Nagging Repeatedly prompting for the same action the user has already declined (cookie consent, push notification permission, review requests).
For each dark pattern found:
| Severity | Criteria | Action |
|---|---|---|
| High | Meets FTC/DSA prohibited pattern definition; creates regulatory exposure | Remove immediately; escalate to legal |
| Medium | Manipulative but not clearly illegal; long-term trust risk | Redesign in current sprint |
| Low | Aggressive but not manipulative; creates friction without deception | Review against brand values |
High-severity patterns in markets with active enforcement (EU, US, UK, Australia): prioritize removal over conversion optimization.
For each dark pattern found, the redesign goal is honest conversion — keeping the conversion opportunity without the deception:
| Dark pattern | Dishonest version | Honest version |
|---|---|---|
| Pre-checked add-on | Adds item to cart automatically | Offers item clearly as an opt-in during checkout |
| Roach motel cancellation | Cancellation hidden/phone-required | Cancellation in account settings, 2-click confirmation |
| Confirmshaming | "No thanks, I hate saving money" | "No thanks" |
| Forced continuity | Silent billing after trial | Email reminder 7 days before; clear cancellation link |
| Hidden costs | Fee appears at final step | Estimated total shown from product page |
Honest conversion typically produces slightly lower initial conversion rates but significantly higher 30-day retention and lower churn — because users who converted intended to.
Cookie banners are the most litigated dark pattern area in the EU. Minimum compliant design:
Non-compliant cookie banners have resulted in fines against Google (€150M), Facebook (€60M), and Microsoft under CNIL enforcement.
For each dark pattern found, document:
Present to product, legal, and design leads. Dark pattern removal requires stakeholder alignment because it typically affects conversion metrics that teams are measured on.
npx claudepluginhub jeffreytse/grimoire --plugin grimoireReviews marketing conversion flows (sign-up, upsell, free-trial, cancellation) for dark patterns violating FTC Section 5, Negative Option Rule, and state privacy laws.
Audits A/B tests of cookie consent banners for GDPR/CNIL compliance, ensuring equal accept/reject ease and detecting dark patterns like visual asymmetry.
Reviews UX flows, data practices, and communication patterns to verify user consent is informed, voluntary, and meaningful. Use during design or implementation of checkout, onboarding, notifications, permissions, or ToS.