Ines runs a small ceramics studio and sells gift vouchers for her evening classes online. December is coming, and the website plugin she uses has a new feature: a red bar that says Offer ends in 09:59.
She tries it on her phone. The clock ticks. It feels exciting, a little bit like a market stall at closing time.
Then she reloads the page. 09:59 again.
Nothing about her offer ends in ten minutes. The voucher discount runs until Christmas Eve. The plugin simply starts a fresh clock for every visitor, every visit. Ines has to decide whether that is clever marketing or a small lie with her name on it.
Ines and her studio are imagined. The research, the cases and the laws below are real.
This chapter is about two of the strongest forces on any page: the option that is already chosen for you, and the feeling that time is running out. Both are legitimate tools. Both can quietly become traps. The research tells you why they work, and recent law tells you, with unusual precision, where the line now sits.
The quiet power of the default
Every form has a default, even when nobody chose it on purpose. A checkbox starts ticked or unticked. A plan is pre-selected or not. A quantity field starts at 1. Whatever happens when the visitor does nothing is a decision the designer made for them.
In 2003, Eric Johnson and Daniel Goldstein of Columbia University published a two-page policy piece in Science with a blunt title: “Do Defaults Save Lives?” They looked at organ donation, a decision most people approve of in surveys and few people act on.
First, an online experiment. 161 respondents imagined moving to a new state. One group was told the default was not to be a donor, another that the default was to be a donor, and a third had to choose with no default at all. Changing the answer took a single click.
Consent was about twice as high when people had to opt out: 82%, against 42% when they had to opt in. With no default, 79% chose to donate. Only the opt-in version differed significantly from the others.
Then the real world. Using registry data from European countries, they estimated “effective consent”: people who had opted in where that was required, or who had not opted out where consent was presumed. The four opt-in countries ranged from 4.25% (Denmark) to 27.5% (the Netherlands). The six opt-out countries ranged from 85.9% (Sweden) to 99.98% (Austria). The two groups did not overlap.
Here is the part that usually gets left out of slide decks. The same paper looked at actual donations, which also depend on families, doctors and hospitals. Controlling for other factors, an opt-out default was associated with a 16.3% increase in donation rates, from 14.1 to 16.4 donors per million. Real, meaningful, and far smaller than the dramatic chart.
That gap is the first lesson for your website. A default can change what people end up registered for much more than it changes what they actually want.
The second classic comes from money. Brigitte Madrian and Dennis Shea studied a large US company that switched its 401(k) retirement plan from opt-in to automatic enrollment. Nothing else about the plan changed. Among employees with 3 to 15 months of tenure, participation was 37% for those hired just before the switch. For those hired under automatic enrollment, with similar tenure, it was 86%.
The dark side sits in the same paper. The automatic plan put new hires into a 3% contribution, invested entirely in a money market fund. 61% of the new cohort stayed exactly there: same rate, same fund. Fewer than 1% of employees hired before the change had picked that combination for themselves. The default did not just raise saving. It also set how much people saved and where the money went, and many treated it as advice.
What to do: list every default on your page, including the boring ones. For each, ask whether most visitors would choose it if they stopped to think. If the honest answer is “no, but it helps us”, it is not a convenience. It is a quiet decision taken on their behalf.
Why defaults stick
Johnson and Goldstein named three reasons a default works, and each has a direct equivalent on a landing page.
It looks like a recommendation. People assume the pre-selected option is what the designer thinks is normal or sensible. Madrian and Shea saw exactly this: many employees treated the company's default fund as investment advice.
It costs nothing to accept. Changing a default takes attention, a click, sometimes a form. Doing nothing is free. On a phone, in a hurry, “free” wins a lot.
Change feels like losing something. The default becomes the reference point, and moving away from it can feel like giving something up.
Prospect theory proposed that people judge outcomes as gains or losses from a reference point, usually the status quo, and that the value function is “generally steeper for losses than for gains”. The original paper tested choices between hypothetical gambles. It is one of the most cited ideas in behavioral science, and also one of the most debated: in 2018, David Gal and Derek Rucker argued in the Journal of Consumer Psychology that the evidence for a general loss–gain asymmetry is weaker than its reputation. Treat it as a strong tendency in some situations, not a law of nature.
These three forces explain why a pre-ticked “Add priority handling” box earns money without anyone deciding to buy priority handling. They also explain why regulators now treat certain defaults as unfair by design, which we come to below.
What to do: when you pre-select something, make the reason visible. “Most people choose Standard” is a claim you should be able to back up. “Recommended for first-time students” is a recommendation you should actually believe.
A nudge is not a shove
In 2008, the economist Richard Thaler and the legal scholar Cass Sunstein turned this research into a book, Nudge. They called the setting in which people choose the “choice architecture” and defined a nudge as any part of it that predictably changes behavior without forbidding options or significantly changing economic incentives. Crucially, a nudge must be easy and cheap to avoid.
Their political label for this was “libertarian paternalism”: steer people toward choices that serve them, while leaving them completely free to choose otherwise. Putting fruit at eye level in a canteen counts. Banning chips does not.
That definition gives you a usable test for your own page. A nudge helps people do what they would want, and walking away is effortless. Once the design benefits you at their expense, or makes the alternative hard to find, it has stopped being a nudge. Researchers call that a dark pattern.
Your voucher
Total €64
Your voucher
Total €60
Before a consumer is bound by a contract, the trader must get their express consent to any payment beyond the main price. If the trader instead inferred consent through a default the consumer had to untick, such as a pre-ticked insurance or gift-wrap box, the consumer is entitled to a refund of that payment. Applies to consumer contracts across the EU, transposed into each country's law.
Source: Directive 2011/83/EU, consolidated text, EUR-Lex. General information, not legal advice. Check the rules in your own country.
Under the GDPR, consent must be a “freely given, specific, informed and unambiguous” indication given “by a statement or by a clear affirmative action”. Recital 32 adds that pre-ticked boxes should not constitute consent, and Article 7(3) says it must be as easy to withdraw as to give. On 1 October 2019, in Planet49, the Court of Justice confirmed that a pre-ticked checkbox the user must untick does not give valid consent to cookies, whether or not the data counts as personal data.
Sources: Regulation (EU) 2016/679; judgment of 1 October 2019, Case C-673/17. Not legal advice.
What to do: keep defaults for things that are free, reversible and genuinely typical. Never pre-tick anything that costs money or signs someone up for marketing. If you are tempted, show the option unticked with a good reason to tick it. That is a nudge. A pre-tick is not.
Scarcity and the cookie jar
Urgency has a sibling: scarcity. Both say “you might lose this”, one about time, the other about quantity.
The study everyone cites is Stephen Worchel, Jerry Lee and Akanbi Adewole's 1975 cookie experiment. In the first study, 146 female psychology students at the University of North Carolina sat at a table with a glass jar holding either 2 or 10 chocolate chip cookies. They tasted one and rated how much they wanted more, how attractive the cookies were and what they should cost.
Cookies from the jar of 2 were rated as more desirable. Cookies whose supply dropped from 10 to 2 during the session were rated higher still, especially when the drop was explained by other people's demand rather than an accident. The authors linked this to commodity theory (things seem more valuable when unavailable) and to reactance, our urge to resist a threatened freedom.
A second study in the same paper tried to rule out that participants were simply guessing the hypothesis and playing along. It contains a detail worth remembering. Among the 13 of 66 participants judged to be aware of what the experiment was about, the pattern ran in the opposite direction: they rated the scarce cookies lower. The group was far too small for significance, and the authors interpreted it as uncooperative responding. Still, it hints at something every shopper knows: scarcity you can see through stops working, and may work against you.
What to do: if something is genuinely limited, say so with a specific, checkable reason: “12 places per class, because there are 12 wheels.” Real scarcity with a real reason is information. Invented scarcity is a bet that nobody looks closely.
What 11,000 shops revealed
In 2019, a Princeton and University of Chicago team led by Arunesh Mathur built a crawler that walked through product, cart and checkout pages like a shopper. They analysed roughly 53,000 product pages from about 11,000 shopping websites and published the results as “Dark Patterns at Scale”.
The researchers called a timer deceptive if it reset after reaching zero with the same offer still valid, or if the “expiring” offer stayed available after the timer ran out. One example they documented: an offer that remained valid after its 60-minute countdown hit zero.
Scarcity messages were even more common. They found 632 “low stock” messages on 581 sites. Most could not be proven false from the outside, which matters: the team only labelled 17 as deceptive. Of those, 16 sites lowered their “stock” on a fixed schedule, and one generated a random number on every page load. Eight used third-party scripts to generate the numbers, including popular Shopify plugins.
The authors are careful to call their counts a lower bound. Their crawler only read text and only explored product, cart and checkout pages.
Regulators then ran their own check. On 30 January 2023, the European Commission and consumer authorities from 23 member states, Norway and Iceland published a sweep of 399 online shops. 148 of them used at least one of three manipulative practices:
- 42 sites used fake countdown timers on purchases of specific products.
- 54 sites steered people toward subscriptions, pricier products or delivery options through visual design or wording.
- 70 sites hid or played down important information, such as delivery costs or a cheaper option.
The sweep also checked the apps of 102 of those shops. 27 used at least one of the same practices.
What to do: if you use a plugin for timers, “recent sales” pop-ups or stock counters, open its settings and find out where its numbers come from. If the answer is “a schedule” or “random”, switch it off. You are legally responsible for what it says on your page, not the plugin vendor.
Try the reload test
There is a simple way to tell a real deadline from a decorative one: reload the page, or come back tomorrow. A real deadline does not care who is looking. A fake one starts again for every visitor.
Both cards advertise the same €10 voucher discount. Press Reload the page a few times, then Skip past the deadline. (Without JavaScript the clocks stay still; the left one would restart at 10:00 on every visit, the right one would always point at the end of the month.)
Card A · “Hurry!”
€10 off evening class vouchers
10:00Offer ends in…
Card B · a real date
€10 off evening class vouchers
--Ends on the last day of this month, 23:59, your local time.
Reloads so far: 0
Card A is how many timer plugins behave. Card B is how a real promotion behaves: one end date, the same for everyone, still true tomorrow. Notice that Card B can still create urgency. A real date is perfectly capable of getting people moving.
What to do: run the reload test on your own site, in a private window and on a second device. If any clock, stock number or “people viewing now” counter changes because you reloaded, it is not telling the truth.
Where the law draws the line
Few areas of web design are regulated this specifically. A fake countdown is not a grey zone in the EU or the UK. It is on a short list of practices banned outright.
Annex I lists commercial practices that are unfair in all circumstances, without any need to prove harm in the individual case. Point 7 is falsely stating that a product, or particular terms, will only be available for a very limited time, in order to elicit an immediate decision and deprive consumers of the chance to make an informed choice. A timer that resets, or an offer that survives its own deadline, fits that description. Point 18, passing on materially inaccurate information about market conditions or the possibility of finding the product, is relevant to invented stock levels. Since the Omnibus Directive (EU) 2019/2161, member states must allow fines of at least 4% of annual turnover in the member states concerned for widespread cross-border infringements handled through coordinated enforcement.
Source: Directive 2005/29/EC, consolidated text, Annex I and Art. 13, EUR-Lex. General information, not legal advice. Check your own jurisdiction.
The UK's list of practices that are always unfair includes falsely stating that a product will only be available for a limited time. The DMCC Act wording drops the word “very”. This paragraph came into force on 6 April 2025, replacing the equivalent rule in the old Consumer Protection from Unfair Trading Regulations.
Source: legislation.gov.uk, DMCC Act 2024 Sch. 20 para. 7, in force 6 April 2025 (S.I. 2025/272). Not legal advice.
Since 17 February 2024, providers of online platforms must not design, organise or operate their interfaces in a way that deceives or manipulates users or materially impairs their ability to make free and informed decisions. The Commission may issue guidance on giving more prominence to certain choices, repeated pop-ups after a choice was made, and making cancellation harder than signing up. Two limits matter for a small business: Art. 25 does not apply to practices already covered by the UCPD or the GDPR, and the section it sits in does not apply to online platforms that are micro or small enterprises (Art. 19). For your own landing page, the UCPD and consumer law above are the rules that bite.
Source: Regulation (EU) 2022/2065, Art. 19, 25 and 93, EUR-Lex. Not legal advice.
In the United States there is no list like Annex I, but the Federal Trade Commission uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, and specific laws on subscriptions. Two cases set the tone.
FTC v. Epic Games (Fortnite), December 2022
Refunds for what the FTC described as dark patterns and billing practices: a confusing button layout that triggered purchases with a single press, charges made without cardholder consent, and locking the accounts of customers who disputed charges. Epic also agreed to a separate $275 million penalty under the children's privacy rule COPPA, $520 million in total.
FTC press release, 19 December 2022.
FTC v. Amazon (Prime), September 2025
The FTC alleged Amazon enrolled people in Prime without consent and made cancelling difficult, in breach of the FTC Act and the Restore Online Shoppers' Confidence Act (ROSCA). The settlement: a $1 billion civil penalty and $1.5 billion in refunds to an estimated 35 million customers. Amazon must offer a clear button to decline Prime, can no longer label it “No, I don't want Free Shipping”, and must offer a way to cancel that uses the same method as sign-up and is not difficult, costly or time-consuming.
FTC press release, 25 September 2025.
Note what the Amazon order targets. The decline button wording, “No, I don't want Free Shipping”, is a nudge turned into a guilt trip. It does not forbid declining. It just makes declining feel like a loss, which is loss aversion used against the customer.
Also note what does not exist in the US: the FTC's broad “Click-to-Cancel” rule was vacated by the Eighth Circuit Court of Appeals in July 2025. ROSCA and Section 5 remain.
- 2005Unfair Commercial Practices Directive. Annex I point 7 bans false “limited time” claims.
- 2011Consumer Rights Directive. Art. 22 outlaws pre-ticked boxes for extra payments.
- 2018GDPR applies. Consent requires a clear affirmative action.
- 1 Oct 2019Planet49: a pre-ticked box is not valid consent.
- Dec 2022FTC v. Epic Games: $245 million in dark-pattern refunds.
- 30 Jan 2023EU sweep: 148 of 399 shops use dark patterns, 42 with fake timers.
- 17 Feb 2024Digital Services Act applies, including Art. 25 for online platforms.
- 6 Apr 2025UK DMCC Act ban on false limited-time claims in force.
- 25 Sep 2025FTC v. Amazon: $2.5 billion settlement over Prime sign-up and cancellation.
- Q4 2026, plannedEU Digital Fairness Act proposal expected. Not yet published as of 18 October 2026.
About that last line. The Digital Fairness Act is the EU's planned next step on dark patterns, addictive design and similar practices. As of 18 October 2026 it is still a plan: the Commission ran a public consultation in 2025 and its 2026 work programme schedules a legislative proposal for the fourth quarter of 2026, a timing it calls indicative. No proposal text has been published, so nobody can tell you yet what it will require. Anything you read claiming “the DFA bans X” is a prediction.
What to do: you do not need to wait for new law. Fake timers, invented scarcity and pre-ticked paid extras are already unlawful in the EU and UK. If your page uses any of them, removing them is not an optimization project. It is compliance.
Honest urgency looks like this
None of this means a page must be timeless and calm. People genuinely benefit from knowing that a price rises on Monday, that a course starts next week, or that only four places are left. Deadlines help people stop postponing a decision they already want to make.
The difference is whether the urgency describes the world or manufactures a feeling.
Fake urgency
- Deadline“Ends in 09:59” from your first visit
- ReasonNone given
- After expirySame offer, new timer
- Stock“Only 3 left!” on every product
- Activity“Anna from Lyon just bought…”
- Decline“No thanks, I like paying more”
Works until someone reloads. Unlawful in the EU and UK when false.
Honest urgency
- Deadline“Ends Sunday 24 Nov, 23:59 CET”
- Reason“Prices rise for the new term”
- After expiryOffer gone, old price back
- Stock“4 of 12 places left”, live count
- ActivityReal reviews with dates
- Decline“No thanks” in plain words
Still urgent. Still true tomorrow. Nothing to hide from a regulator or a customer.
Honest urgency has five ingredients. A date and time with a time zone, the same for every visitor. A reason that would survive a customer's follow-up question. A consequence that actually happens when the deadline passes. Numbers that come from your real inventory. And a neutral way to say no.
If you do show a live countdown, show the date beside it, so the clock is a convenience rather than the only information. And keep it out of the way of the content. A ticking clock pulls the eye on every frame; for some visitors, it is also a source of anxiety. A static line like “Ends Sunday at midnight” does most of the work with none of the noise. If the clock is a time limit on the visitor's own task, such as a basket held for 15 minutes, WCAG 2.2.1 Timing Adjustable also applies: the speed and feedback chapter covers that rule.
For defaults, the honest version is just as simple. Pre-select the option that is free, reversible and most common. Explain any recommendation. Leave paid extras and marketing consent unticked.
What to do: rewrite every urgency line on your page so it contains a date, a reason or a real number. If you cannot write one honestly, the line should go.
What to change tomorrow
Run the reload test
Open your site in a private window, then reload. Check every timer, stock count and “just bought” pop-up. Anything that resets or changes on its own gets switched off today.
Audit your plugins
Look at the settings of every urgency, scarcity or social-proof app. If it can show “random” or “scheduled” numbers, assume it does. Remove it or connect it to real data.
Untick paid extras and marketing boxes
Pre-ticked add-ons are refundable by law in the EU (CRD Art. 22). Pre-ticked consent is not consent (GDPR, Planet49). Show them unticked, with a reason to choose them.
Give every deadline a date, a time zone and a reason
“Ends Sunday 24 November, 23:59 CET, when the new term's prices start.” Then let it actually end.
Make “no” neutral
Replace guilt-trip decline links with plain words. The Amazon order is a costly reminder of what regulators think of “No, I don't want Free Shipping”.
Write down your defaults
For each pre-selected option, note who benefits. If it is mainly you, change it or explain it on the page.
What the research supports
Strong: defaults have large effects on what people end up enrolled in (Johnson & Goldstein 2003; Madrian & Shea 2001), and deceptive timers and scarcity claims are common on real shops (Mathur et al. 2019; EU sweep 2023). Moderate: scarcity raises perceived value in lab settings, from small samples like Worchel et al.'s. Debated: how general loss aversion is. Not shown: that fake urgency produces lasting gains for a small business. Defaults change registrations far more than they change underlying wishes, as the gap between effective consent and actual donations shows.
Sources
- Johnson, E. J. & Goldstein, D. (2003). Do Defaults Save Lives? Science, 302(5649), 1338–1339. Author-hosted full text consulted for the online experiment (n = 161), country consent rates and the 16.3% donation estimate.
- Madrian, B. C. & Shea, D. F. (2001). The Power of Suggestion: Inertia in 401(k) Participation and Savings Behavior. Quarterly Journal of Economics, 116(4), 1149–1187. NBER Working Paper 7682 consulted for the 37% and 86% participation rates and the 61% default rate.
- Thaler, R. H. & Sunstein, C. R. (2008). Nudge: Improving Decisions About Health, Wealth, and Happiness. Yale University Press. Definition of a nudge (p. 6) checked against published excerpts.
- Worchel, S., Lee, J. & Adewole, A. (1975). Effects of Supply and Demand on Ratings of Object Value. Journal of Personality and Social Psychology, 32(5), 906–914. Full text consulted, including the method of Study 1 and the reversed pattern among aware participants in Study 2.
- Kahneman, D. & Tversky, A. (1979). Prospect Theory: An Analysis of Decision under Risk. Econometrica, 47(2), 263–291. Abstract consulted for the value-function description.
- Gal, D. & Rucker, D. D. (2018). The Loss of Loss Aversion: Will It Loom Larger Than Its Gain? Journal of Consumer Psychology, 28(3), 497–516. Abstract consulted for the critique.
- Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M. & Narayanan, A. (2019). Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), Article 81. Full text consulted for prevalence counts, deceptive timers and low-stock messages.
- European Commission (2023). Consumer protection: manipulative online practices found on 148 out of 399 online shops screened. Press release IP/23/418, 30 January 2023. Full text consulted.
- Directive 2005/29/EC (Unfair Commercial Practices Directive), consolidated text. Annex I points 7 and 18, Art. 13 as amended by Directive (EU) 2019/2161.
- Directive 2011/83/EU (Consumer Rights Directive), consolidated text. Art. 22.
- Regulation (EU) 2016/679 (GDPR), official text. Art. 4(11), Art. 7(3), recital 32.
- Court of Justice of the EU (2019). Case C-673/17, Planet49, judgment of 1 October 2019. Operative part consulted.
- Regulation (EU) 2022/2065 (Digital Services Act), official text. Art. 19, 25 and 93.
- Digital Markets, Competition and Consumers Act 2024, Schedule 20, para. 7 and commencement note.
- US Federal Trade Commission (2022). Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations. Press release, 19 December 2022.
- US Federal Trade Commission (2025). FTC Secures Historic $2.5 Billion Settlement Against Amazon. Press release, 25 September 2025.
- European Economic and Social Committee. Digital Fairness Act (exploratory opinion, plenary 21–22 October 2026), and the independent tracker Digital Fairness Act legislative timeline. Consulted for proposal status.
Sources checked 18 October 2026. Legal summaries are general information, not legal advice; national transpositions differ, so check your own jurisdiction. The Digital Fairness Act status reflects publicly available information on that date. Ines, her studio and all mock-ups are fictional; the figures are original illustrations.