Imagine this situation: you try to cancel a streaming subscription and, instead of a simple button, you find a maze of pages, confirmations, and "unmissable last offers." Or, when buying an airline ticket, you discover travel insurance in your cart that you never requested. Who hasn't been through this?
These frustrating experiences have a name: dark patterns . They are design techniques deliberately created to manipulate decisions. If experienced adults fall into these traps, imagine the impact on children and teenagers who are still developing their critical thinking skills.
The good news is that Brazil has just taken a decisive step to address this problem. Law 15.211/2025, known as the Digital ECA (Statute of Children and Adolescents), expressly prohibits these practices when directed at children and adolescents. Moreover, it creates one of the most advanced digital protection regimes in the world for children and adolescents.
In this article, we will understand what dark patterns are , how they work in practice, what changes with the new legislation, and why this topic has become essential for legal professionals.
What are dark patterns?
The term "dark patterns" (or "deceptive patterns") was coined by British designer Harry Brignull in 2010 and refers to user interface design strategies that induce users to make decisions contrary to their own interests.
These aren't bugs or technical flaws. They are deliberate design choices, carefully tested and optimized to increase conversions, customer retention, and, most importantly, platform profits.
The logic is simple: the more difficult it is for the user to make conscious choices, the easier it will be to steer them toward the behavior desired by the company.
The most common techniques
Knowing the main techniques helps to identify them in everyday life. Let's look at the most commonly used ones:
Confirmshaming uses language that creates guilt when a user refuses an offer. A pop -up offers a discount in exchange for signing up for the newsletter . The options are: "Yes, I want to save money!" and "No, I'd rather pay more." The second option is designed to shame those who refuse.
The roach mote ( or "cockroach trap") makes entry easy, but exit extremely difficult. You sign up for a service in two clicks, but to cancel you have to call during restricted business hours, face long waiting lines, and go through multiple retention attempts. The name comes from the analogy with cockroach traps: easy to get in, impossible to get out.
Sneak into basket (or "shopping cart infiltration") automatically adds items to the purchase without explicit consent. The user only notices this after completing the transaction or when checking their credit card statement.
Misdirection (or "distraction") hides the most advantageous option for the user in obscure menus, while visually highlighting the profitable alternative for the company. During the purchase of a ticket, for example, the option not to purchase travel insurance appears hidden in a drop-down menu with dozens of countries.
Trick questions use confusing phrases with double negatives. "Uncheck this box if you don't want to stop receiving our offers" is a classic example that confuses even attentive readers.
Why are children more vulnerable?
The human brain only completes its development around the age of 25. The prefrontal cortex, responsible for impulse control, evaluating consequences, and making rational decisions, is one of the last areas to mature.
Children and adolescents are therefore neurologically more susceptible to manipulation techniques. They have greater difficulty identifying commercial persuasion, resisting immediate rewards, and evaluating long-term consequences.
European studies indicate that children are exposed to up to 20 times more ads on social media than on traditional television. Many of these ads are disguised as organic content, making them even harder to identify.
Furthermore, digital platforms are designed to maximize engagement. Features such as infinite autoplay, constant notifications, and variable reward systems (similar to slot machines) exploit cognitive vulnerabilities that especially affect younger users.
Real cases
In 2022, the Claro mobile phone operator faced an investigation by Procon-SP (the São Paulo consumer protection agency) for systematically hindering the cancellation of services. The Reclame Aqui website registered thousands of complaints from consumers who, even after requesting the termination of their contracts, continued to receive bills for months. Procon considered the company's response unsatisfactory and recommended the application of fines.
In the same year, the European Commission intensified its monitoring of TikTok. The platform was setting children's and teenagers' accounts as public by default, exposing personal data without proper consent. The social network was pressured to reverse this policy, making accounts for minors under 16 years old private by default.
In 2023, the U.S. Federal Trade Commission (FTC) sued Amazon for deceptive practices in its Prime program. The central accusation: the company deliberately designed the cancellation process to be confusing and time-consuming, leading millions of consumers to pay for a service they no longer wanted.
These cases demonstrate that the problem is global, affects companies of all sizes and sectors, and demands robust regulatory responses.
What changes with the Digital ECA?
Law 15.211/2025 represents Brazil's response to this scenario. The legal instrument not only prohibits dark patterns targeting children and adolescents, but also creates an integrated digital protection system.
Paragraph 2 of Article 18 is unequivocal in stating that suppliers are prohibited from designing, modifying, or manipulating interfaces with the aim or effect of compromising the user's autonomy, decision-making, or choice. The prohibition is especially strict when it results in the weakening of parental supervision tools.
Article 7 enshrines the principles of privacy by design and privacy by default . In practice, this means that every digital product or service must come pre-configured in the most protective mode available. The burden of relaxing these protections then falls on the legal adult guardian, not the child.
Article 24 stipulates that social media accounts belonging to minors under 16 years of age must be linked to a legal guardian. Effectively, independent accounts for this age group are prohibited.
Article 26 prohibits the creation of behavioral profiles of children and adolescents for the purpose of targeted advertising. So-called targeted ads based on data from minors are prohibited.
Joint liability and sanctions
One of the most relevant aspects of the new law is the joint and several liability regime established in Article 15. App stores, operating systems, and developers are jointly liable for violations. No agent in the chain can evade responsibility by claiming that the failure occurred at another link.
The sanctions foreseen are significant: a warning with a deadline of up to 30 days for correction, a fine of up to 10% of the economic group's revenue in Brazil (or up to R$ 50 million per infraction), temporary suspension of activities and, in serious cases, prohibition of the exercise of activities by judicial decision.
Oversight will be carried out in a coordinated manner by the National Data Protection Authority (ANPD), the Public Prosecutor's Office, and the Guardianship Councils, which will now also operate in the digital context.
Validity and adaptation period
The law will come into effect on March 17, 2026. This deadline was established to allow for the necessary sub-legal regulation, the adaptation of digital platform systems, and the training of professionals who will work in applying the rule.
For companies, this period represents a window of opportunity to review interfaces, audit design practices, and implement compliance programs. For legal professionals, it's a time to develop expertise in an area that will demand specialized knowledge.
The new professional profile
Implementing the Digital Child and Adolescent Statute (ECA Digital) will require professionals capable of navigating multiple areas of legal knowledge. Mastering the traditional Child and Adolescent Statute is not enough. It is necessary to integrate data protection (LGPD), consumer law (CDC), platform regulation (Marco Civil da Internet), and even notions of interface design.
Lawyers working in digital compliance, consulting for technology companies, consumer law, and children's rights will find a rapidly expanding field of practice. Similarly, professionals from the Public Prosecutor's Office, the Public Defender's Office, and the Judiciary will need specific training to properly apply the new legal framework.
Professionals who ignore this transformation risk presenting outdated opinions and theses, incapable of meeting the demands of contemporary digital law.
An opportunity to be at the forefront.
The Digital ECA (Brazilian Statute for Children and Adolescents) positions Brazil among the countries with the most advanced regulations for the protection of children and adolescents in the digital environment. The express prohibition of dark patterns , combined with the privacy by default regime and the joint liability of the digital chain, creates a new paradigm that will transform how platforms operate in the country.
IDP offers a Postgraduate Program in Digital Law, Data, and Artificial Intelligence , coordinated by Professor Laura Schertel, director of CEDIS and president of the Digital Law Commission of the Brazilian Bar Association (OAB). The faculty includes members of CADE (Administrative Council for Economic Defense), advisors to the Supreme Federal Court (STF), and researchers who are at the forefront of Brazilian digital regulation.
The law is being rewritten by technology. Don't get left behind.
Secure your spot and prepare to lead the legal discussions of the future.
