A practice website is a sales funnel as much as a brochure. It asks people to book, pay a deposit, fill in an intake form, accept cookies, join a membership or sign up for texts. Each of those steps is a screen someone designed, and the way it is designed can help a patient make a clear choice or push them into one they did not mean to make. The FTC calls the second kind dark patterns, and in September 2022 its staff published a report on them.
This guide reads that report against the screens a practice actually runs: service and price pages, online booking, deposits, intake and lead forms, cookie banners, memberships and the cancel path. It is written for independent practices, dental offices, med spas, chiropractic and integrative clinics. Several patterns have their own guide on this site, linked in each section, so this page works as the overview and the audit list. Free trials that convert to a paid plan are covered in our guide to free samples and trial offers for health products. Consent lines and pre-checked boxes on download and webinar forms are covered in our guide to lead magnets and gated content.
This is general information, not legal advice. Sources cited were checked on November 1, 2026: the FTC staff report Bringing Dark Patterns to Light (September 2022), read from an archived copy captured October 13, 2026 because ftc.gov blocks our server; 15 U.S.C. 8403 (Restore Online Shoppers’ Confidence Act, section 4) and 15 U.S.C. 45(a) in the Cornell LII text of the U.S. Code. A staff report is not a rule: it describes FTC cases, workshop discussion and staff recommendations. The report also names TILA, the TSR, CAN-SPAM, COPPA and ECOA as laws the FTC enforces against dark patterns; we did not read those for this guide. State law may also apply; we did not read state rules for this guide. Have a health care attorney review your booking and payment flows.
The short version
- Dark patterns are design choices, not just words. The report describes them as design practices that trick or manipulate users into choices they would not otherwise have made and that may cause harm.
- The whole screen counts. Staff write that companies are responsible for the net impression of the design elements on a page, not just the truth of certain words in isolation.
- Four families. The report groups the common patterns into designs that induce false beliefs, hide or delay material information, lead to unauthorized charges, and obscure or subvert privacy choices.
- Price up front. Staff say companies should include unavoidable and mandatory fees in the upfront, advertised price.
- Consent needs an affirmative, unambiguous act. Accepting general terms of use does not count as consent to a particular purchase, according to the report.
- Recurring charges have a statute. For online sales with a negative option feature, ROSCA, 15 U.S.C. 8403, requires clear disclosure of material terms before billing information is taken, express informed consent before charging, and simple mechanisms to stop recurring charges.
What the report is, and why a practice should read it
The FTC hosted a public workshop on digital dark patterns on April 29, 2021, and the staff report draws on that workshop, academic literature and FTC enforcement actions. Section 5 of the FTC Act, 15 U.S.C. 45(a)(1), declares unfair or deceptive acts or practices in or affecting commerce unlawful, and the report closes by saying that where dark patterns violate the FTC Act, ROSCA, the TSR, TILA, CAN-SPAM, COPPA, ECOA or other statutes and regulations the FTC enforces, the agency will continue to take action.
None of the cases in the report involves a medical practice. One involved free trial offers for dietary supplements, and one involved location data that could trace people to and from reproductive health clinics. The reason to read it anyway is that the screens it describes, price tables, checkout steps, consent dialogs, sign-up and cancel flows, are the same screens a cash-pay or membership practice now runs. The report also notes that on mobile devices the scrolling needed can make it unlikely that people will see important information, which matters for practices whose patients book from a phone.
1. Designs that create a false belief
The first family is designs that make people believe something untrue. The report’s examples include ads formatted to look like independent editorial content, comparison sites that present paid rankings as neutral, countdown timers on offers that are not actually time-limited, claims that an item is almost sold out when supply is ample, and false claims that other people are looking at or have bought the same thing. Its appendix adds deceptive testimonials, including endorsements that do not reveal the endorser was paid or connected to the company, or that present results that are not typical.
Where this shows up on a practice site:
- A booking page that says “only 2 appointments left this week” when the schedule is open, or a timer on a treatment special that resets for each visitor. See fake urgency and countdown timers.
- A “patients are viewing this treatment now” counter or a recent-bookings ticker that is not driven by real data.
- A “best clinics” list or comparison page the practice runs or pays for, presented as independent. See sponsored articles and advertorials and price comparison and booking marketplaces.
- Reviews or testimonials from staff, family or paid patients with no disclosure. See patient testimonials and before-and-after photos.
The report’s recommendation for this family is broad: when designing interfaces, look not only at what a design choice does to sales or click-through rates but also at how it affects people’s understanding of the material terms, and fix a design once you learn it manipulates behavior by inducing false beliefs. For a practice that runs A/B tests on landing pages, that is a useful second question to ask of every winning variant.
2. Designs that hide or delay what matters
The second family hides material information or brings it out late. The report describes fees placed behind tooltip buttons people were unlikely to click, fees listed below the fold, and drip pricing, where only part of the total price is advertised and other mandatory charges appear late in the buying process. Its appendix also lists hidden information in fine print, long terms of service, nondescript links or pop-ups that appear only on hover, and price comparison prevention, such as showing a price per payment without the number of payments or the total cost.
Staff write that companies should include any unavoidable and mandatory fees in the upfront, advertised price, that failing to do so has the potential to deceive consumers in violation of the FTC Act, and that companies must not mislead people into believing optional fees are mandatory. For practices, the common versions are:
- A treatment price on the service page that leaves out a mandatory consultation, facility, product or “booking” fee that appears only at checkout. See all-in pricing and junk fee laws and advertising cash prices.
- A financing or package price shown per month or per session with no total and no number of payments.
- Deposit and cancellation terms that sit only in a linked policy, not on the screen where the card is entered. See procedure booking deposits and cancellation fees.
- Light gray text, small type or poor contrast for the conditions of an offer. The report gives white text on a yellow background as an example of a problem disclosure, and says businesses marketing to older adults should avoid putting important information at the edge of the screen or in a light color. Our website accessibility guide covers contrast in more detail.
3. Designs that lead to charges people did not agree to
The third family is charges people did not want or intend. The report’s examples include free trials that turn into recurring charges people were not clearly told about, products added to the cart without permission or through a pre-checked box, buttons labeled “Next” that actually complete a purchase, and cancel paths that are hard to find or full of offers. In one case described in the report, the FTC alleged that consumers had to go through six to nine screens to cancel, with links on each screen that led out of the cancel path.
ROSCA applies to online sales through a negative option feature. Under 15 U.S.C. 8403 a seller may not charge or attempt to charge for goods or services sold that way unless it (1) provides text that clearly and conspicuously discloses all material terms before obtaining billing information, (2) obtains express informed consent before charging the consumer’s card or account, and (3) provides simple mechanisms to stop recurring charges. The report adds staff views on what that means in practice:
- Consent should include an affirmative, unambiguous act by the consumer. Key terms should not be hidden in general terms and conditions or behind hyperlinks, pop-ups or drop-down menus, and accepting a general terms of use document does not constitute consent to a particular purchase.
- Cancel mechanisms should be at least as easy to use as the method used to sign up, and available through the same medium, such as the website or app.
- Sellers should not use new offers or save attempts that impose unreasonable delays on cancellation.
- If the seller offers phone cancellation, it should at a minimum answer all calls to the cancel number during normal business hours within a short time, and the call should not be longer or more burdensome than the call used to sign up.
For a practice, this covers membership plans, subscription skincare or supplement shipments, prepaid treatment packages that renew, and any add-on that is pre-selected at checkout. Our guide to membership auto-renewal rules walks through the cancel path in detail, including the status of the FTC’s amended Negative Option Rule.
4. Designs that steer privacy choices
The fourth family is privacy choices that are not real choices. The report lists six interface types workshop panelists discussed: no way to definitively reject data collection, repeated prompts to pick a setting the person wants to avoid, confusing toggles, privacy choices that are hidden or hard to reach, one option highlighted while the more private option is grayed out, and defaults that maximize collection and sharing. The cookie banner that puts “Accept” front and center while the option to deny is several screens away is one of the report’s examples.
Staff recommendations include collecting only the data needed to provide the service the person asked for, avoiding defaults that collect or share information in ways people would not expect, presenting choices at the time and in the context of the decision, avoiding ambiguous toggles and options with unequal prominence, and presenting choices about sensitive information so it is clear what the person is agreeing to. Health information is the obvious sensitive category for a practice. See cookie consent banners, pop-ups on practice websites, tracking pixels and consumer health data privacy laws.
The report also covers lead generators that are not honest about who they are or why they collect information. Staff write that a company that says it collects information for one purpose or audience cannot share it with a different buyer or for a different purpose without consent, and that companies who use others to generate leads should monitor what those third parties do on their behalf. If a practice buys leads or runs lead forms through a partner, see buying patient leads and lead form ads.
Patterns from the appendix that fit practice flows
Appendix A of the report is a table of named patterns. These are the ones that map most directly onto a practice website, with the report’s own description in plain words.
- Confirm shaming. Framing the decline option as a bad decision, such as a pop-up whose close button reads “No, I don’t want to look younger” or “No thanks, I’ll keep my pain.”
- Preselection. A default that benefits the business, such as an add-on product, a membership or text marketing opt-in that is checked unless the patient notices.
- Trick questions. Double negatives or confusing labels, such as “Uncheck this box if you prefer not to receive offers,” or a button labeled “No, cancel” that keeps the plan.
- False hierarchy. A bright button for the choice the business wants and a small gray link for the other one, for example “Keep my membership” against “cancel.”
- Forced registration. Requiring an account or extra information to complete a task, such as creating a patient portal login before the visitor can see open appointment times.
- Nagging. Asking again and again with only “Yes” or “Not now” as answers, such as a newsletter or text sign-up prompt that returns on every page.
- Misdirection. Using design to draw the eye to one figure, such as a highlighted per-session price, while the mandatory total sits below in plain type.
A dark pattern audit for your own site
Walk through your own site on a phone, as a new patient would, and check each of these. Write down what you find and the date, and keep the screenshots with your advertising records.
- Every scarcity, demand or time limit on the site is true, and timers end at a real deadline instead of resetting.
- Reviews, testimonials and rankings disclose any payment or connection, and anything that looks like an independent article or list is labeled if the practice paid for it.
- The price on the service page includes every mandatory fee, and installment prices show the number of payments and the total.
- Deposit, cancellation and refund terms appear on the screen where the card is entered, in readable type and contrast.
- No add-on, membership, auto-ship or marketing opt-in is checked by default.
- Buttons say what they do. A button that charges a card says so, and no “Next” button completes a purchase.
- Any recurring charge has its material terms on screen before the card form, a separate affirmative act to agree, and an online cancel option that is as easy as signing up.
- Close and decline options are as visible as accept options, and are worded neutrally.
- The cookie banner offers reject on the same layer as accept, and forms collect only what the practice needs for the task.
- Lead forms say who will receive the information and why, and any partner who collects leads for you is checked for the same things.
An illustration
This is a made-up example, not a client. A med spa’s online booking flow shows a treatment price on the service page. At checkout a booking fee is added, a skincare auto-ship box is already checked, and the pay button reads “Continue.” The deposit terms sit behind a link in the footer. The membership offered at checkout can only be cancelled by phone during limited hours.
Mapped onto the report, that is drip pricing and hidden information (section II), preselection and an unauthorized transaction risk from a mislabeled button (section III and Appendix A), and a roadblock to cancellation. Because the auto-ship and the membership are recurring charges sold online, ROSCA’s three requirements apply to both. The fix is mostly design: show the full price on the service page, leave the auto-ship box unchecked, label the button with what it does, put the deposit terms next to the card field, and add an online cancel option for the membership.
How we help
We design practice websites, booking and payment pages and lead generation campaigns for independent practices, and we build price, consent and cancel screens so the patient can see the terms before they act. We also run local search, Google Ads and an AI front desk that can explain booking terms by phone. We are not a healthcare provider and we do not give legal or medical advice. Related guides: bait and switch in healthcare ads, online booking widgets, online intake forms and our guide to healthcare marketing rules.
What is a dark pattern on a website?
The FTC staff report Bringing Dark Patterns to Light (September 2022) describes dark patterns as design practices that trick or manipulate users into making choices they would not otherwise have made and that may cause harm, such as fake countdown timers, hidden fees, pre-checked boxes and hard-to-find cancel options.
Is there a federal dark patterns law?
The report is a staff report, not a rule. It says the FTC acts against them where they violate laws it enforces, including section 5 of the FTC Act (15 U.S.C. 45) and ROSCA (15 U.S.C. 8403).
Do practice memberships fall under ROSCA?
ROSCA covers goods or services sold in a transaction effected on the internet through a negative option feature. A membership sold online that renews and charges until the patient cancels fits that description, so it needs clear disclosure of material terms before billing information, express informed consent, and a simple way to stop the charges.
Can a booking page add a fee at checkout?
The report describes adding mandatory charges late in the buying process as drip pricing, and its staff say unavoidable and mandatory fees should be included in the upfront, advertised price. Show the full price where the service is first priced.
Is a cookie banner with a big Accept button a dark pattern?
The report gives as an example a consent interface that puts the option to accept cookies front and center while the option to deny is behind several screens. Its staff recommend that one option not be more prominent than another.