The recurring tricks we flag across companies. Each pattern below has a name, a definition, what makes it harmful, an example pulled from a real policy, and the companies we've already caught using it.
Definition. Use of the product is treated as agreement, with no real alternative.
Why it's bad. Strips users of any meaningful choice — "consent" by ultimatum is not consent.
"By using our services, you consent to the practices described in this policy.
Seen in: Meta · TikTok · X
Definition. Essential and non-essential data uses are accepted in one click.
Why it's bad. A single "Accept" approves analytics, ads, and tracking together with the strictly necessary stuff.
"By clicking 'Accept', you agree to the use of all cookies described in this policy.
Seen in: Meta · Amazon · Google
Definition. Privacy controls are hidden behind many clicks and shifting menus.
Why it's bad. Friction is the goal — exhaust users into leaving the defaults alone.
"Settings > Privacy > Ads > Ad Topics > Advanced > …
Seen in: Meta · Apple · Google
Definition. Marketing and tracking are opted-in by default, requiring action to opt out.
Why it's bad. GDPR and similar laws are explicit that consent must be a clear affirmative action.
"[ ✓ ] I would like to receive product updates and personalized offers
Seen in: Meta · Amazon
Definition. Resetting preferences and re-asking for consent on a schedule.
Why it's bad. Bets on a moment of inattention — one slip and "Accept All" goes back on.
"Your cookie preferences have been reset. Please review and confirm.
Seen in: Meta · X · Most ad-tech
Definition. Phrasing the reject button to make users feel bad for declining.
Why it's bad. Manipulates emotion rather than respecting choice.
"[ Reject and use a worse version ] [ ACCEPT ALL ]
Seen in: Meta · Apps in general
Definition. Easy to sign up, hard to leave or delete.
Why it's bad. Deletion flows are buried, require contact forms, or impose waiting periods.
"Account deletion may take up to 90 days and require email confirmation.
Seen in: X · Amazon
Definition. Tricking users into sharing more than they intend through unclear defaults.
Why it's bad. Named after Meta. Defaults expose data publicly unless you go hunting.
"Default visibility for new posts: Public.
Seen in: Meta · TikTok
Definition. Using a user's contacts to nudge their friends into the product.
Why it's bad. Conflates address-book access with permission to message the contacts within it.
"Find friends already on our service. Tap to invite the rest.
Seen in: TikTok · LinkedIn · X
Definition. Wording the privacy choice so the user picks the worse option.
Why it's bad. Negatives, double-negatives, and inverted defaults exploit reading-fatigue.
"Uncheck this box if you do not wish to not receive offers from our partners.
Seen in: Apps in general