Dark Patterns Audit Sheet

When to use it

When you are about to review a site, an app or a checkout flow looking for dark patterns and want to keep a record of what you find. The sheet goes with the guide to spotting dark patterns: the guide explains each pattern and the evidence behind it; the sheet is for going through them one by one with the product open beside you.

It is for learning to look. It has no recommendations and no severity scale: it records whether the pattern is there, where, with what evidence and whether it could be proven to deceive. What to fix, and in what order, is a separate conversation.

Before you use it

Plan more than one visit. Several patterns can only be confirmed, or become suspicious, by coming back another day: a countdown that resets with the same offer the next day, or a low-stock notice whose number drops on a fixed schedule. That is why the sheet asks for the date of the first visit and of the follow-up ones.

Capture the evidence on the spot. A screenshot with the date, the URL and, when the pattern lives in the code, the relevant snippet of the page source. What was not recorded that day cannot be shown later.

Record first whether it appears, then whether it deceives. They are two different questions and the sheet keeps them apart: a countdown timer can be genuine.

The document

Site or product: [name and URL]

Auditor: [name]

Date of the first visit: [date]

Dates of the follow-up visits: [dates]

Before you start

• Being present is not the same as deceiving. First record whether the pattern appears; proving that it deceives usually means coming back another day.
• Look beyond the screen: the page source, the terms and conditions, and the whole flow (what triggers a modal, what happens when you try to undo something).
• A phrase match is a signal to look closer, not proof.
• If in doubt, mark it grey. If your report mentions a psychological bias, present it as a hypothesis with its source.

The full guide, with the evidence for each pattern: https://uxr.cl/en/learn/dark-patterns/

Summary

Sneaking

Sneak into basket

What to look for

• A product or service in the cart that you did not add: a greeting card next to a bouquet of flowers, an insurance plan next to a laptop (Mathur et al., 2019, p. 13).
• Checkboxes, already ticked on an earlier step, that add something to the order (Mathur et al., p. 13).

How to check. Add a single product and read the cart line by line before paying. Go back through the previous steps and look for ticked boxes you did not tick.

Drip pricing or hidden costs

What to look for

• Charges that appear on the last step: “service fee”, “handling fee”, delivery, tip (Mathur et al., 2019, p. 13; SERNAC, 2021, p. 27).
• A package price that changes when you confirm, with no explanation (SERNAC, p. 28).

How to check. Write down the price shown on the product page and compare it with the total on the last step before paying. Every difference should have been disclosed from the start.

Obstruction

Roach motel

What to look for

• You subscribe or sign up on the website, but there is no button to cancel or to delete the account.
• The only option offered is to “pause” the membership, not cancel it. Chen et al. labelled this as forced action (2026, p. 8); for an auditor the symptom is the same: there is no way out.

How to check. Compare the two paths: how many steps and which channel it takes to sign up, and how many it takes to leave. If you cannot find how to leave in the interface, look in the terms and conditions: that is often where “by phone only” lives (Mathur et al., 2019, p. 21; SERNAC, 2021, p. 30).

Price comparison prevention

What to look for

• Similar products with different specifications and different discounts at the same time, which cannot be put side by side (SERNAC, 2021, p. 24).
• A “from” price in the listing that always belongs to the cheapest option, with many variants at different prices once you open it (SERNAC, p. 24).
• Text that cannot be copied (Gray et al., p. 17).

How to check. Try to compare two equivalent options. If you have to take notes by hand, open each one or work out unit prices to do it, there is a barrier. Whether the barrier is deliberate cannot be proven from the outside; record it as a finding with that caveat.

Interface interference

Visual interference

What to look for

• The button that suits the company is large and colored; the alternative is gray or a plain text link (SERNAC, 2021, p. 22).
• An option that looks disabled but can be clicked (Mathur et al., 2019, p. 17).
• A discount inflated by adding in the value of a “free gift” (Mathur et al., p. 17).

How to check. Compare the options within the same decision: size, color, contrast and position. If one looks disabled, click it.

Trick questions

What to look for

• “Uncheck the box if you prefer not to receive email updates” (Mathur et al., 2019, p. 17).
• A box for NOT receiving communications whose text opens by stating the opposite: “We would like to send you emails. If you do not wish…” (Mathur et al., p. 17).

How to check. Read every checkbox out loud and ask what happens if you tick it and what happens if you don't. Mathur et al. only count as a trick question an opt-out box that opens with an affirmative statement. Those that open by offering the opt-out (“Tick here to opt out of…”) are recorded separately, as concerning but not deceptive (note 9, p. 17).

Pressured selling

What to look for

• The most expensive option selected by default: the largest bouquet, the top plan (Mathur et al., 2019, p. 18).
• Pop-ups that, when you add something to the cart, offer “hot sellers” or “deals” and have to be closed before you can continue (Mathur et al., p. 18).

How to check. Check which variant is selected when you open the product page. If it is the most expensive one, note it. Also check whether a pop-up interrupts the way to the cart.

Forced action

Forced registration

What to look for

• “Debes registrarte para continuar tu compra” (“You must sign up to continue your purchase”), with no guest checkout (SERNAC, 2021, p. 17).
• A sign-up window that appears when you add to cart or after browsing for a while, with no close button (Chen et al., 2026, p. 8).
• A single checkbox that bundles accepting the terms with agreeing to receive marketing (Mathur et al., 2019, p. 22).
• Personal data requested too early, for example the RUT (Chile's national ID number) just to simulate a loan (SERNAC, p. 18).

How to check. Try to complete the task without an account. If a window appears, look for a way to close it without signing up. Ask what data each step actually needs.

Forced continuity or hidden subscription

What to look for

• A “free trial” that asks for a credit card and rejects prepaid or debit cards (SERNAC, 2021, p. 29).
• A service that looks like a one-off payment and renews every year; the detail sits behind a “learn more” link (Mathur et al., 2019, p. 14).

How to check. Before paying, look for three things: whether it renews, how much it will charge and when. If any of them is not visible, note it. Asking for a card is not enough to call it a dark pattern; SERNAC treats it as a signal (p. 29), but the proof is that the renewal is not disclosed.

Social engineering

Countdown timer

What to look for

• A clock in hours, minutes and seconds next to the price or in a banner, with labels such as “Oferta al límite” (offer at its limit) or “Oferta imperdible” (unmissable offer) (SERNAC, 2021, pp. 19–20).

How to prove it deceives. Note the time the clock reaches zero and come back afterwards, and again the next day. It is deceptive if it resets with the same offer or if the offer is still available after it expired (Mathur et al., 2019, p. 15).

Limited-time message

What to look for

• “Sale ends soon”, with no date or time (Mathur et al., 2019, pp. 15–16).

How to check. Look for the end date in the fine print, in the promotion's conditions and on the terms page. Mathur et al. only counted it when it was in none of those places (pp. 15–16).

Phrases to look for (Spanish): «Por tiempo limitado» (for a limited time), «Sólo por hoy» (today only).

Low-stock message

What to look for

• “Últimas unidades” (last units), the message SERNAC saw most often (p. 19).
• “Solo quedan 2 habitaciones a este precio” (only 2 rooms left at this price) (SERNAC, p. 20).
• “Limited quantities” with no number (Mathur et al., 2019, p. 20).

How to prove it deceives. Come back several times over a few days and note the number. It is suspicious if it drops on a fixed schedule, changes when you reload the page, or the message appears on almost every product (Mathur et al., p. 20).

Phrases to look for (Spanish): «Últimas unidades» (last units), «Stock limitado» (limited stock), «Quedan [número] unidades» ([number] units left), «Solo quedan [número]» (only [number] left), «Hasta agotar stock» (while stocks last), «Edición limitada» (limited edition).

High-demand message

What to look for

• “Items in your cart are in high demand” (Mathur et al., 2019, p. 20).

How to check. Check whether the message changes with the product. Mathur et al. found that 38 of 47 appeared the same whatever the product or the cart contents (p. 21).

Phrases to look for (Spanish): «Alta demanda» (high demand).

Activity messages

What to look for

• Pop-ups such as “Alguien de [district] comenzó a comprar [product] hace 3 minutos” (someone from [district] started buying [product] 3 minutes ago) (SERNAC, 2021, p. 23).
• “¡Apúrate! 2 personas están a punto de comprar este producto” (hurry! 2 people are about to buy this product), repeated across many products (SERNAC, p. 23).
• “35 people added this item to cart”, “90 people have viewed this product” (Mathur et al., 2019, p. 18).

How to prove it deceives. Look at the page source: Mathur et al. found numbers generated at random and messages hard-coded so that they never changed (pp. 18–19). Also check which script draws the message: many come from third-party providers, and some openly advertised fake orders (pp. 22–24).

Phrases to look for (Spanish): «Viendo» (viewing), «Viendo esto» (viewing this), «[número] vendidos» ([number] sold), «Compró» (bought), «Alguien en» (someone in), «Interesado» (interested).

Testimonials of uncertain origin

What to look for

• Only positive testimonials, or only top ratings, with no way of knowing how many customers they represent (SERNAC, 2021, p. 21).
• High ratings without the number of reviews behind them (Chen et al., 2026, p. 8).

How to check. Two tests from Mathur et al. (p. 19): see whether the site has a form for submitting testimonials, and search Google for the exact text of one. They found the same testimonials on another site under different names.

Phrases to look for (Spanish): «Nuestros clientes dicen» (our customers say), «Excelente servicio» (excellent service), «Excelente producto» (excellent product), «Excelente calidad» (excellent quality), «Muy buena calidad» (very good quality), «Es perfecto» (it's perfect), «Fabuloso» (fabulous).

Confirmshaming

What to look for

• “No thanks, I like paying full price”, mostly in pop-ups offering a discount in exchange for an email address (Mathur et al., 2019, p. 16).
• When removing optional insurance: “¡No quedes sin protección!” (don't go unprotected!), with “Mantener mis seguros” (keep my insurance) highlighted (SERNAC, 2021, p. 22). SERNAC classified it as visual interference; it has the form of confirmshaming and often comes with a false visual hierarchy.

How to check. Read the decline option without looking at the other one. If it describes the person (“I like paying more”) rather than the action (“no, thanks”), it is confirmshaming. This one needs no proof of deception: you can see it.

Sources

• Gray, C. M., Santos, C. T., Bielova, N., and Mildner, T. (2024). An Ontology of Dark Patterns Knowledge: Foundations, Definitions, and a Pathway for Shared Knowledge-Building. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '24). ACM. https://doi.org/10.1145/3613904.3642436
• Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., and Narayanan, A. (2019). Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), article 81. https://doi.org/10.1145/3359183
• Chen, Z., Shen, J., Luna, Zhang, H., and Vaccaro, K. (2026). Deception at Scale: Deceptive Designs in 1K LLM-Generated Ecommerce Components. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '26). ACM. https://doi.org/10.1145/3772318.3791063
• SERNAC (2021). Informe de Resultados de Levantamiento de Dark Patterns en Comercio Electrónico [Results of the dark patterns survey in e-commerce] (version 1.2). Servicio Nacional del Consumidor, Chile's national consumer protection agency. https://www.sernac.cl/portal/619/articles-62983_archivo_01.pdf
• SERNAC (2022). Informe: Detección de Dark Patterns por Webscraping [Detecting dark patterns through web scraping] (version 0.7, marked “No Vigente”, not in force). Servicio Nacional del Consumidor, Chile. https://www.sernac.cl/portal/619/articles-81901_archivo_01.pdf

Grounding

The document zone is not written by hand: it is generated from the same data as the guide to spotting dark patterns, so within that zone the guide and the sheet cannot say different things. The text on this page outside the document is written by hand. The sources are the guide's, listed in full at the end of the document: Mathur et al. (2019), Gray et al. (2024), Chen et al. (2026) and SERNAC's 2021 and 2022 reports (SERNAC is Chile's national consumer protection agency).