Dark patterns and Irish law: how UX becomes a legal liability

The point: a dark pattern is a screen that decides for your customer

A dark pattern is a piece of design that gets a customer to do something they did not quite choose. A box that arrives already ticked. A cookie banner with a big "Accept all" and a faint "Manage settings". A pop up whose "no" button says "No thanks, I hate saving money". A countdown clock that starts again every time you reload the page.

In Ireland these are not only bad manners. Three sets of law look at the same screen. The GDPR decides whether a consent is a consent at all. The ePrivacy Regulations 2011 govern cookies and marketing email. The Consumer Protection Act 2007, as amended by the Consumer Rights Act 2022, decides whether the way you sell is unfair. The Data Protection Commission (DPC) enforces the first two, the Competition and Consumer Protection Commission (CCPC) the third. And the European Data Protection Board (EDPB), where the DPC sits with the other EU regulators, has written guidelines on exactly this, deceptive design patterns, with a name for each trick.¹

So this article goes screen by screen: what each common pattern is, which rule it runs into, and what I build instead, worked through on an invented shop in euro. The law is cited, the businesses are made up. I am an engineer, not a solicitor, so take a specific dispute to one.

Three laws, one checkout page

Before the patterns, the map. "GDPR" does not cover everything on the screen, and knowing which law owns which element tells you who would come knocking.

The GDPR defines consent as "any freely given, specific, informed and unambiguous indication" of the person's wishes, given "by a statement or by a clear affirmative action".² Article 7 adds four rules: you must be able to prove the consent, a request inside a longer text must be "clearly distinguishable from the other matters", withdrawing must be as easy as giving, and tying a service to a consent it does not need counts heavily against the consent being free.³ Article 25 adds data protection by default: only the data each purpose needs.⁴

Regulation 5(3) of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, says a person must not store information, or gain access to information already stored, on a subscriber's or user's device without their consent and clear, prominently displayed information about the purposes.⁵ That is the cookie rule, and it covers pixels and local storage too. Regulation 5(5) has exactly two exceptions: carrying a communication, and what is strictly necessary for a service the visitor explicitly asked for.⁵ There is no exception for statistics. Regulation 13 is the email rule: no marketing email to a person without consent, unless the narrow exception for your own existing customers applies.⁶ The DPC says a cookie consent must meet the GDPR standard, so a consent that fails one fails the other.⁷

The Consumer Protection Act opens its unfair practices part with one line: "A trader shall not engage in an unfair commercial practice." A practice is unfair if it falls short of professional diligence and is likely to impair the average consumer's ability to make an informed choice and change their decision.⁸ Then come misleading practices, aggressive practices and a list in section 55 banned outright, with no test of effect.⁹ The Consumer Rights Act 2022 added the rules for online selling: what the customer must be told before they are bound, and when an extra charge needs their express consent.¹⁰

One law gets quoted at shops that mostly does not apply to them. Article 25 of the Digital Services Act bans deceptive interfaces, but only for online platforms, services that publish what users upload, and not for practices the EU unfair practices rules or the GDPR already cover.¹¹ A shop selling its own tea is judged under the laws above.

Read it from the top, the way a customer moves through a shop. Each box is a screen and the law that owns it. The last box is the thread through all of them: both regimes judge the screen as a whole.

Worked example: mapping Corrib Tea's checkout

Corrib Tea is an invented loose leaf tea shop in Galway, run by Gráinne at corribtea.example. I use it throughout. Her journey has five elements worth mapping.

The cookie banner: regulation 5 of the ePrivacy Regulations, so the DPC. The "Only 3 left" badge: the Consumer Protection Act, so the CCPC, because it is a claim about availability that drives a buying decision. The €1.50 "packing fee" at the last step: the Consumer Protection Act and the Consumer Rights Act, because it is about the price. The ticked checkout box, "Send me offers from Corrib Tea and selected partners": regulation 13 and the GDPR. The unsubscribe link that needs a login: GDPR article 7(3).

Five elements, three laws, two regulators. The map tells Gráinne which fixes are about consent and which are about honest selling.

What a valid consent is, in plain words

Strip the legal words away and a valid consent under the GDPR has four tests. Free: the person could say no without losing anything they came for. Specific: one purpose per yes. Informed: they knew who wanted what and why. Unambiguous: they did something, a click or a tick, that only means yes.² Recital 32 puts the consequence bluntly: silence, boxes ticked in advance or inactivity do not constitute consent. It also says that when the processing has several purposes, consent should be given for all of them, which means one choice per purpose.² And article 7 wants the request kept clearly apart from the rest of the text.³

You also have to be able to show the consent later.³ For marketing email the Irish rule makes that concrete: if a prosecution turns on whether someone consented, the burden of proving that they unambiguously consented lies on the sender.⁶ A consent you cannot evidence is, in practice, one you never had.

Worked example: the newsletter box, before and after

Gráinne's newsletter form on the home page has one email field and a button labelled "Get 10% off". Underneath, in small grey type: "By signing up you agree to our terms and to receive marketing from us and our partners."

Run the four tests. Free: the discount itself is fine, the EDPB says the GDPR does not rule out every incentive, though the shop has to be able to show the choice was still free.¹² Specific: no, one press covers the shop terms, Gráinne's emails and partner emails. Informed: barely, the partners are not named. Unambiguous: the press means "I want 10% off", not "I want partner emails". The partner consent fails, and the own marketing consent is shaky because it sits inside the terms.

The rebuild is small. The button still says "Get 10% off". Above it, one unticked box: "Email me new teas and offers from Corrib Tea. Unsubscribe in one click." Partners are dropped, because Gráinne has none she actually sends to. Each sign up stores the time and the exact wording shown, which is the evidence article 7 asks for.

Pre ticked boxes and other defaults

A default is whatever happens if the customer does nothing, and doing nothing is easy. A meta analysis of 58 studies found that, in studies with a yes or no outcome, pre selecting an option made it on average 27% more likely to be chosen.¹³ The EDPB calls the data protection version "deceptive snugness": the most data invasive option is switched on by default, relying on the fact that people keep what is pre selected, and it ties the pattern to article 25 and to consent.¹ The Court of Justice settled the cookie case in Planet49: consent is not validly given by way of a pre checked box the user must deselect to refuse.¹⁴ The DPC's cookie guidance says the same for pre checked boxes, sliders and anything else set to "on" by default.⁷

Defaults reach the till too. Under the Consumer Rights Act, an extra payment needs express consent, and a default option the customer must reject to avoid paying is not that.¹⁰

There is a nuance that saves most shops, and it is worth knowing before you rip out every box. For email to your own customers, regulation 13(11) has an exception. You may email someone without consent if you got their address in the context of a sale, you only market your own products of a similar kind, you gave them a clear and easy way to object, free of charge, when you collected the address and in every message after, and the sale was no more than 12 months before the email.⁶ The DPC describes it the same way, as a limited exception for existing customers that holds only while those conditions are met.¹⁵ That route does not need a tick at all. It needs an honest chance to say no.

Worked example: what Gráinne's ticked box is really worth

Gráinne's checkout handles 3,000 orders a month. Her box, ticked by default, reads "Send me offers from Corrib Tea and selected partners". 2,700 customers leave it ticked. Her dashboard shows a sign up rate of:

$$r = \frac{n_{\text{yes}}}{n_{\text{asked}}}$$

where $r$ is the sign up rate, $n_{\text{yes}}$ is the number of customers counted as saying yes and $n_{\text{asked}}$ is the number who saw the box. It is an ordinary rate, events over opportunities, explained from scratch in Foundations: ratios and rates.

On her dashboard that is $2{,}700 / 3{,}000 = 0.90$, a 90% sign up rate. Now ask what is defensible. As consent: nothing, because a box left ticked is inactivity, not a clear affirmative action.² For partner offers: nothing, because the existing customer exception only covers your own products of a similar kind.⁶ For her own teas: possibly the exception, but only if the box clearly offered a way to object, and a ticked box that mixes in partners does not read like one.

Now the honest version. Text at checkout: "We'll email you about new teas now and then. Tick here if you'd rather we didn't." Plus an unsubscribe link in every email, and no marketing to anyone whose last order is more than 12 months old. That is the exception, done properly. Say 10% tick the refusal box, an invented figure for the example. Then $3{,}000 \times 0.90 = 2{,}700$ customers can receive Gráinne's own marketing, lawfully.

Same 2,700 people. The second list survives a complaint. The first has to be deleted the day somebody asks how they got on it. In the shops I have worked on, the honest box costs almost nothing in reach for your own products.

Cookie banners: reject must be as easy as accept

The most common dark pattern in Ireland is still the banner with a bright "Accept all" on the first layer and the refusal hidden behind a faint "Manage settings". The DPC's guidance note of April 2020 is direct about it: a banner must not nudge the visitor towards accepting, and if there is an "accept" button, a "reject" option, or one that leads to a layer where the visitor can choose by purpose, must get equal prominence.⁷ The EDPB calls the faint button "hidden in plain sight", a visual nudge towards the more invasive choice.¹ I go a step further than the minimum and put "Reject all" on the first layer, so refusing takes exactly as many clicks as accepting.

Two more DPC details catch shops out. A banner that says that by continuing to use the site, by clicking, using or scrolling, the visitor consents, is not consent, and neither is a banner that vanishes when the visitor scrolls.⁷ And a stored consent should not be treated as lasting for ever: the DPC wants the visitor asked to reaffirm it no later than six months on, a period it reached from first principles and expects you to justify if you go longer.⁷

Why do shops resist? Because the numbers move. A research team looked at the five most popular consent tools on the top 10,000 websites in the UK and found only 11.8% met minimal requirements based on European law. In a field experiment, removing the refusal button from the first page raised consent by 22 to 23 percentage points.¹⁶ Closer to home, when the DPC swept the websites of 38 well known Irish organisations in 2019, about two thirds relied on implied consent and ten of them, 26%, had boxes ticked in advance for marketing, advertising and analytics cookies.¹⁷ In my experience the smaller shops are still where that sweep found the big names.

Worked example: Corrib Tea's banner, before and after

Gráinne's banner is shown on 80,000 visits a month. With "Accept all" and "Manage settings", 62,400 visits accept, a consent rate of $62{,}400 / 80{,}000 = 0.78$. After the rebuild, "Accept all" and "Reject all" sit side by side, same size, same colour, same weight, and 44,800 visits accept, a rate of $44{,}800 / 80{,}000 = 0.56$. These are invented numbers, chosen to sit inside the range the research found.

How big is that drop? There are two honest ways to say it, and agencies love to pick whichever sounds better.

$$\Delta_{\text{pp}} = r_{\text{new}} - r_{\text{old}}, \qquad \Delta_{\%} = \frac{r_{\text{new}} - r_{\text{old}}}{r_{\text{old}}} \times 100$$

$\Delta_{\text{pp}}$ is the change in percentage points, $\Delta_{\%}$ is the relative change as a percentage, $r_{\text{old}}$ is the consent rate before and $r_{\text{new}}$ the consent rate after. The difference between points and a percentage change is the first section of Foundations: percentages.

For Gráinne: $0.56 - 0.78 = -0.22$, so 22 percentage points down, and $-0.22 / 0.78 \times 100 = -28.2$, so 28.2% fewer visits that accept.

The horizontal axis is the two banner designs, the vertical axis the share of visits that press accept. The takeaway: an equal banner costs Gráinne a bit over a quarter of her consented traffic, and none of those lost yeses were ones she could have defended. Irish law has no exception for statistics, so the $80{,}000 - 44{,}800 = 35{,}200$ visits that refuse are not counted by her analytics at all. Her shop database still records every order. That is why I set up Google's consent mode in its basic shape by default for Irish shops: no Google tag loads until the visitor has chosen. The practical setup is in my article on cookies, consent and tracking across Ireland, Germany and Austria.

Confirmshaming and biased framing

Confirmshaming is making the "no" feel embarrassing. The EDPB files it under "emotional steering": wording or visuals that make people feel good, safe or rewarded for one choice, or scared, guilty or punished for the other, in a way likely to push them against their own data protection interests. It names the fairness and transparency principles and informed consent as the provisions at stake.¹ Biased framing is the quieter cousin: one option described only by its benefits, the other only by its risks, such as "Keep my personalised experience" against "Lose my saved preferences" when the real choice is ad tracking or not.

The CCPC side matters too. Under the Consumer Protection Act a practice that is likely to deceive the average consumer is misleading, and it is no defence that the information was factually correct.¹⁸ A pop up made only of true sentences can still mislead as a whole.

Worked example: rewriting Gráinne's exit pop up

Gráinne's pop up, shown when a visitor moves to leave: headline "Wait, don't go thirsty", a green button "Yes, give me 10% off", and grey text underneath, "No thanks, I'll pay full price like a fool". The email field is in the pop up, and the small print says the address will be used "to personalise your experience".

Step one, the decline: "No thanks" as a real button, the same size as the yes. Step two, the purpose: "We'll email you your code, then new teas now and then. Unsubscribe in one click." Step three, the frequency: once per visitor, and not again for a while after a no. Asking until people give in is the EDPB's "continuous prompting".¹ Step four, the test: Gráinne runs each version for two weeks and compares sign ups still subscribed after 60 days, not raw sign ups. In my experience that is the number that pays, and the honest pop up holds up well on it.

Bundled consent

Bundling is one yes for several purposes. "I agree to the terms, the privacy policy and marketing" in one tick. The EDPB says consent bundled with the acceptance of terms and conditions does not qualify as freely given, and neither does consent where a service is tied to processing it does not need, which is article 7(4).¹³ The DPC's cookie guidance says the same for storage and access: do not bundle cookie consent with other purposes or with the terms of a contract.⁷

My test: could the customer get what they came for and still say no to this? If not, and the thing is not needed to deliver it, it is bundled.

Worked example: a Limerick rota app's sign up screen

Rotawise is an invented staff rota tool from Limerick. Its sign up screen has an email, a password and one tick box: "I accept the terms of service and privacy policy and agree to product updates, partner offers and usage analytics." The "Create account" button stays grey until it is ticked.

Take it apart. The terms of service are a contract, which needs acceptance, not consent. The privacy policy is information, which you give, not something people agree to. Product updates are marketing and need their own choice. Partner offers need their own consent, if they exist at all. Usage analytics that store or read anything on the user's device need consent too, because regulation 5(5) has no statistics exception, so they belong in the app's own cookie choice, not in this box.⁵

The rebuilt screen: a "Create account" button, a line above it, "By creating an account you accept the terms of service. My privacy notice explains what I do with your data", both linked, and one unticked box, "Email me product updates. Unsubscribe in one click." Partner offers are gone, analytics wait for the cookie choice. One tick box, one purpose, and the account no longer depends on a yes it does not need.

Sludge: easy in, hard out

Sludge is friction placed on purpose on the path the business does not want you to take. Signing up takes one screen, leaving takes six and a phone call. Not all friction is sludge: asking someone to confirm a large bank transfer protects them. The test is whose interest the friction serves.

Irish law attacks sludge from both sides. Article 7(3) of the GDPR says withdrawing consent must be as easy as giving it.³ The EDPB calls the opposite "longer than necessary": a journey that takes more steps to switch on a privacy control than it took to switch on the invasive option.¹ On the consumer side, one of the things the Consumer Protection Act weighs in deciding whether a practice is aggressive is "onerous or disproportionate" barriers, outside the contract itself, when a consumer wants to end a contract, use a contractual right or switch to another trader.¹⁹

Worked example: counting Rotawise's clicks

Count the actions both ways. Subscribing to Rotawise's product emails: tick one box at sign up, one action. Unsubscribing: click "Manage preferences" in the email, log in (two fields and a button), go to Settings, then Notifications, untick "Product updates", Save. One plus three plus three plus one: eight actions against one.

Cancelling a paid plan: Settings, Billing, "Cancel plan", a discount offer, a survey, a screen saying "Are you sure? Your team will lose their rotas", and a final button. Seven screens, against a sign up of two.

The fix: the unsubscribe link works in one click without a login. The ePrivacy Regulations already ask for an easy, free way to object in every marketing message,⁶ and a login screen is not easy. Cancelling becomes Settings, Billing, "Cancel plan", one confirmation screen with the end date, done. A retention offer can stay as one optional screen with an obvious "No, cancel my plan" button. Three screens. I would rather lose a customer cleanly than keep one who tells ten others how hard it was to leave.

Dark patterns in the buying journey: fake urgency and hidden fees

Some dark patterns are not about data but about getting the order now, at a higher price than the customer thought. Here the Consumer Protection Act does the work.

Section 55 bans outright, with no test of effect, "making a false representation that a product is available only for a limited time, or on particular terms for a limited time, in order to elicit an immediate decision", and since the Consumer Rights Act it bans fake consumer reviews too.²⁰ A "high demand" message or a stock count with nothing behind it is false information about availability, which section 43 names as misleading.¹⁸ On price, section 46 treats the price inclusive of taxes and any delivery charges as material information in an invitation to purchase, and it counts material information given in an "untimely" way as misleading.²¹ That is the trouble with a fee that only appears at the last step. For an online sale, the Consumer Rights Act adds that the total price and any delivery charges or other costs on top must be given before the customer is bound, and a customer who was not told of those charges is not liable for them.¹⁰

EU consumer authorities act together through the Consumer Protection Cooperation (CPC) network. In December 2019, in an action led by the Dutch consumer authority, Booking.com committed not to present an offer as time limited if the same price would still be available afterwards, to make clear what "last room available" refers to, and to show the total price including all unavoidable charges, fees and taxes.²² In January 2023 the network swept 399 online shops: 148 used at least one dark pattern, 42 used fake countdown timers and 70 hid important information such as delivery costs.²³ The CCPC enforces the Irish side through compliance notices, undertakings, prohibition orders and, as its ultimate sanction, prosecution.²⁴

Worked example: Gráinne's timer and her packing fee

Gráinne's product pages show "Order in the next 02:59:12 for this price" and "Only 3 left". The test takes five minutes. Open the page in a private window, note the clock, close it, open it again. The clock is back at three hours. Check the stock: 412 tins. Both claims are false, and a price that is not really ending is the kind of claim section 55 names.²⁰ The fix: show a deadline only when a real one exists, such as "Order by 2pm for dispatch today" from the courier cut off, and show stock only below a real threshold.

The packing fee. A tin is listed at €12.00. At the last step, a "packing and handling fee" of €1.50 appears that every customer pays. Total price per tin, which should be shown from the start: $12.00 + 1.50 = 13.50$, so €13.50. Delivery can still be shown separately if it varies, as long as the customer is told it comes on top.²¹ Gráinne's decision is commercial, not legal: show €13.50, or fold the packing into the price and absorb it. Either is grand. Showing €12.00 is not.

What getting it wrong costs

The fines are large on paper. A breach of the GDPR's conditions for consent can draw an administrative fine of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, under article 83(5).²⁵ The ePrivacy Regulations work through the courts instead. Every marketing email sent in breach of regulation 13 is a separate offence, carrying a class A fine on summary conviction and, on indictment, up to €250,000 for a company, and the DPC can prosecute summary cases itself.²⁶ A class A fine is up to €5,000.²⁷ Under the Consumer Protection Act, a first conviction on indictment carries a fine of up to €60,000, a later one up to €100,000, with prison terms possible in both.²⁷

$$F_{\max} = \max\left(F_0,\ p \times T\right)$$

$F_{\max}$ is the maximum GDPR fine, $F_0$ is the fixed amount in article 83, $p$ is the turnover percentage and $T$ is the annual worldwide turnover. The $\max$ means "whichever is higher". The percentage part is plain Foundations: percentages.

For Corrib Tea, with an invented turnover of €1.2 million: under the GDPR, $0.04 \times 1{,}200{,}000 = 48{,}000$, below €20 million, so the ceiling is €20 million. Under the Consumer Protection Act there is no percentage at all: a first conviction on indictment tops out at €60,000 whatever the turnover. For a small business the fixed amount sets the ceiling.

Ceilings are not prices. For a banner, the DPC's tool is an enforcement notice, and ignoring it is the offence.²⁶ The CCPC calls prosecution its ultimate sanction.²⁴ In my experience the real cost comes earlier and quieter: the list that has to be deleted, the analytics nobody trusts, and the regular customer who unsubscribes because the pop up called them a fool.

How I audit a journey, in order

The EDPB's guidelines end on prevention: build interdisciplinary teams of designers, data protection people and decision makers, and apply data protection by design and by default before an interface launches, which avoids deceptive patterns in the first place.¹ Here is how I turn that into an afternoon's work.

Top to bottom, it follows the order a customer meets the problems. The first question matters most: a banner that is decoration while the pixels have already fired is the commonest fault I find. The last box keeps the work honest.

Worked example: Gráinne's audit, start to finish

Run on Gráinne's shop, the audit finds seven screens: pixels firing before the banner is answered, no "Reject all", a resetting clock and invented stock, a packing fee revealed at the end, a ticked partner box, a shaming exit pop up and an unsubscribe behind a login. Each fix is the one worked through above, and most are copy and configuration, not a rebuild.

The email capture and onboarding forms have their own article, and so does the engineering of event tracking under consent mode.

Honest design is the version that lasts

A dark pattern wins the test that measures this week's sign ups and loses every other one: the complaint, the audit, the list you cannot use, the customer who notices. None of this asks you to stop persuading. A clear offer, a well placed button and a reason to sign up are all allowed. What the law asks is that the "no" is real, the price is the price and the clock is a clock. Built that way from the start, it costs less than fixing it later, and in my experience it converts better than founders expect.

Sources

Footnotes

1. European Data Protection Board, Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them, Version 2.0, executive summary and Annex I, 14 February 2023, https://www.edpb.europa.eu/system/files/documents/2023-02/edpb_03-2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf

2. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(11) and recital 32, EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

3. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 7 (Conditions for consent), EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

4. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 25 (Data protection by design and by default), EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

5. Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulation 5, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

6. Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulation 13, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

7. Data Protection Commission, Guidance note on cookies and other tracking technologies, dataprotection.ie, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf

8. Law Reform Commission, Consumer Protection Act 2007, revised, section 41 (General prohibition on unfair commercial practices), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

9. Law Reform Commission, Consumer Protection Act 2007, revised, Part 3, Chapters 2 to 4 (sections 42 to 56), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

10. Government of Ireland, Consumer Rights Act 2022, No. 37 of 2022, sections 106 and 123 and Schedule 3, Irish Statute Book, 2022, https://www.irishstatutebook.ie/eli/2022/act/37/enacted/en/print

11. European Parliament and Council, Regulation (EU) 2022/2065 (Digital Services Act), Article 3(i) and Article 25, EUR-Lex, 2022, https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng

12. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, paragraph 48, 4 May 2020, https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf

13. Jon M. Jachimowicz, Shannon Duncan, Elke U. Weber and Eric J. Johnson, When and why defaults influence decisions: a meta-analysis of default effects, Behavioural Public Policy, volume 3, issue 2, Cambridge University Press, 2019, https://doi.org/10.1017/bpp.2018.43

14. Court of Justice of the European Union, Press release 125/19, Judgment in Case C 673/17 Planet49: Storing cookies requires internet users' active consent, 1 October 2019, https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf

15. Data Protection Commission, FAQ on Consent for Electronic Direct Marketing, dataprotection.ie, 2026, https://www.dataprotection.ie/dpc-guidance/faq-consent-electronic-direct-marketing

16. Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger and Lalana Kagal, Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence, CHI 2020, arXiv:2001.02479, 2020, https://arxiv.org/abs/2001.02479

17. Data Protection Commission, Report by the Data Protection Commission on the use of cookies and other tracking technologies, following a sweep conducted between August 2019 and December 2019, dataprotection.ie, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Report%20by%20the%20DPC%20on%20the%20use%20of%20cookies%20and%20other%20tracking%20technologies.pdf

18. Law Reform Commission, Consumer Protection Act 2007, revised, section 43 (Misleading: false, misleading or deceptive information), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

19. Law Reform Commission, Consumer Protection Act 2007, revised, section 53 (Aggressive commercial practices), subsection (3)(d), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

20. Law Reform Commission, Consumer Protection Act 2007, revised, section 55 (Prohibited commercial practices), subsection (1)(n), (za) and (zb), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

21. Law Reform Commission, Consumer Protection Act 2007, revised, section 46 (Misleading: withholding, omitting or concealing material information), subsections (2) and (3), updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html

22. European Commission, Booking.com commits to align practices presenting offers and prices with EU law following EU action, press release IP/19/6812, 20 December 2019, https://ec.europa.eu/commission/presscorner/detail/en/ip_19_6812

23. European Commission, Consumer protection: manipulative online practices found on 148 out of 399 online shops screened, press release IP/23/418, 30 January 2023, https://ec.europa.eu/commission/presscorner/detail/en/ip_23_418

24. Competition and Consumer Protection Commission, The role of the CCPC, ccpc.ie, 2026, https://www.ccpc.ie/enforcement-and-regulation/consumer-protection/the-role-of-the-ccpc

25. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 83(5), EUR-Lex, 2016, https://eur-lex.europa.eu/eli/reg/2016/679/oj

26. Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulations 13(13) to (15), 17 and 26, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

27. Law Reform Commission, Consumer Protection Act 2007, revised, section 79 (Fines and penalties) with its editorial note on class A fines under the Fines Act 2010, updated to 24 November 2025, https://revisedacts.lawreform.ie/eli/2007/act/19/revised/en/html