Static strings like "Only X left", hardcoded low numbers, random number generators near stock/availability text, countdown displays without real inventory API backing.

Show real inventory counts from a database. If stock is genuinely low, display it. Never fabricate or exaggerate scarcity.

FTC enforcement (misleading advertising). EU Unfair Commercial Practices Directive Art. 6.

deceptive.design

setInterval/setTimeout countdown timers without server-side deadline validation, client-side-only expiry timestamps, timers that reset on page load.

If a deadline is real (flash sale, limited offer), show it with a server-backed timestamp. When the timer expires, the offer genuinely ends.

FTC enforcement. EU Omnibus Directive (2022) explicitly bans fake urgency.

deceptive.design

Modal/dialog decline buttons with negative self-referential language ("I don't want", "I'll miss out"). Asymmetric tone between accept and decline options.

Use neutral, respectful language for both options: "Accept" / "No thanks" or "Subscribe" / "Skip". The user's choice should never be framed as a mistake.

NNGroup / deceptive.design

Missing persistence of dismissal state (no localStorage/cookie flag after decline), modals triggered on every page load without checking prior dismissal.

Ask once. Store the decline. Offer the option again only in settings or after a natural trigger. Respect "Don't ask again."

GDPR recital 32 (freely given consent). App Store/Play Store guidelines.

deceptive.design

Checkbox labels containing "not", "un-", double negatives. Toggle components where checked=true maps to an opt-out action.

Use positive, direct language. "Send me marketing emails" (checked = yes). Single negation only.

GDPR Art. 7 (clear and plain language for consent). CCPA requires clear opt-out.

deceptive.design

Ad components without "Sponsored" or "Ad" labels, affiliate links without disclosure, promotional content without visual differentiation.

Clearly label all advertising and sponsored content. Use visual differentiation (background, border, "Sponsored" badge).

FTC Endorsement Guidelines (16 CFR Part 255). EU Unfair Commercial Practices Directive. Up to $50K/violation.

FTC / deceptive.design

Hardcoded testimonial objects without real data source, static review counts not from a database, random number generators for user/signup counts.

Use real testimonials with attribution. Show genuine metrics from your database. If you don't have social proof yet, omit it.

FTC enforcement (Amazon $30M fine, 2023). EU Omnibus Directive bans fake reviews.

FTC / deceptive.design

Button pairs where one is primary/filled and the other is text/link/unstyled. Significant size asymmetry between accept and reject actions.

Give all options equal visual weight. Accept and Reject should be the same size and prominence.

GDPR Art. 7 + EDPB Guidelines. CNIL fined Google €150M and Facebook €60M (2022).

EDPB / deceptive.design

Price display components that exclude fees/tax, fee calculations only in the final checkout step, cart summaries that add items only at payment.

Show the total price from the first moment a price is displayed. Break down all fees early. No surprises at checkout.

FTC Click-to-Cancel Rule (2024). EU Consumer Rights Directive Art. 6. Epic Games $245M FTC fine.

FTC / deceptive.design

Trial signup flows that collect payment without conversion disclosure, missing "You will be charged $X on [date]" near submit, no pre-charge reminder logic.

State conversion terms next to signup: "After 14 days, $X/month. Cancel anytime." Send reminder email 3 days before charge.

FTC Click-to-Cancel Rule (2024). Amazon FTC settlement ($30M). GDPR Art. 7.

FTC / deceptive.design

Pricing components without feature comparison tables, plan cards with non-aligned feature sets, missing "Compare plans" functionality.

Provide a clear feature comparison table with consistent units and aligned rows.

EU Consumer Rights Directive (transparency obligation).

deceptive.design

No cancellation route in the app, cancellation behind "Contact us", multi-step flows with 3+ confirmation steps, retention offers blocking cancel.

Maximum 2 steps: click Cancel then Confirm. Optional feedback form that doesn't block cancellation.

FTC Click-to-Cancel Rule (2025). EU Consumer Rights Directive Art. 11. California AB-390.

FTC / deceptive.design

Auth guards on content pages that don't need personalization, app-download interstitials, feature gates tied to social sharing.

Let users access content without accounts where possible. Offer account creation as optional enhancement.

GDPR data minimization (Art. 5) if accounts collect unnecessary data.

deceptive.design

Cart logic adding items programmatically, pre-checked addon checkboxes, default-selected upsells, marketing consent defaulting to checked.

Cart contains only what the user explicitly added. Add-ons are presented but never pre-selected. All optional checkboxes start unchecked.

GDPR Art. 7 (Planet49 ruling). FTC enforcement. EU Consumer Rights Directive.

deceptive.design

Checkbox components with defaultChecked={true} for optional/consent items, radio groups defaulting to most expensive option, selects defaulting to paid tiers.

All optional checkboxes start unchecked. Plan selection defaults to free/lowest tier or shows no default.

GDPR Art. 7(2) + Planet49 ruling (2019). TTDSG §25 (Germany). EU Consumer Rights Directive Art. 22.

CJEU Planet49 / deceptive.design

Consent banners where accept and reject have different component variants, sizes, colors, or click depth.

Accept and Reject must have equal visual weight — same size, same prominence, same click depth.

GDPR Art. 7 + EDPB Guidelines. CNIL fined Google €150M, Facebook €60M (2022). German TTDSG §25.

EDPB / CNIL