The CCPA Dark Pattern Rules Effective January 2026 — What Changed

California's updated CCPA regulations took effect on January 1, 2026, turning longstanding "dark pattern" guidance into hard rules. Here's what's new, what's now mandatory, and how to fix your consent interface before enforcement reaches you.

For years, "dark patterns" lived in CCPA regulations as cautionary examples — design choices regulators discouraged but rarely pinned down. That changed at the start of 2026. On September 22, 2025, California's Office of Administrative Law formally approved a sweeping package of updated CCPA regulations proposed by the California Privacy Protection Agency (CPPA), and the public-facing portions took effect on January 1, 2026.

Buried among the new obligations around automated decision-making, risk assessments, and cybersecurity audits is something that touches nearly every website operator immediately: a tightened, more concrete set of rules on consent interface design. If you run a cookie banner, a preference center, or any "Do Not Sell or Share" control for California residents, these are the rules that now govern how those interfaces must behave.

This article breaks down exactly what changed, what's now treated as a hard requirement rather than a suggestion, and the practical design fixes that move your consent flow from risky to compliant.

What actually changed on January 1, 2026

The 2026 update did not invent the concept of dark patterns — California has prohibited them since the original CCPA regulations and reinforced the position in a September 2024 enforcement advisory. What the update did was sharpen the teeth of that prohibition in three meaningful ways.

First, it added five new illustrative examples of practices that may constitute prohibited dark patterns, giving regulators and businesses far more specific reference points. Second, it elevated certain illustrative examples from the original regulations into outright requirements — meaning behaviour that was once merely "an example of something that might be a problem" is now a clear rule. Third, it made opt-out confirmation mandatory where it was previously optional.

The throughline across all of it is a single principle the CPPA keeps returning to: privacy choices must be genuinely symmetrical, and they're judged by their effect on the consumer, not by what the business intended.

What counts as a dark pattern under CCPA

The regulatory definition is broad by design. A dark pattern is a user interface designed or manipulated in a way that subverts or impairs a consumer's autonomy, decision-making, or choice. The relevant rule lives in 11 CCR § 7004, which sets out the principles that any method for submitting a CCPA request or obtaining consent must satisfy.

Section 7004(a) lays out the foundational principles. Two of them do most of the heavy lifting:

• Easy to understand. The methods must use language consumers can read and understand. No confusing double negatives, no toggles where "on" might mean either "sell my data" or "don't sell my data."
• Symmetry in choice. The path to the more privacy-protective option cannot be longer, more difficult, or more time-consuming than the path to the less privacy-protective one.

The regulation also requires businesses to avoid confusing language, avoid choice architecture that interferes with a consumer's ability to choose, and keep request methods easy to execute without unnecessary friction. Critically, § 7004 makes clear that any agreement obtained through dark patterns does not count as consumer consent. A business that uses dark patterns to obtain consent to sell personal information is treated as having never obtained consent in the first place.

The five newly added dark pattern examples

The most concrete change for designers and product teams is the expanded list of illustrative dark patterns. The updated regulations specifically call out the following practices as ones that may constitute prohibited dark patterns:

1. Asymmetric step countRequiring more steps to opt out of the sale or sharing of personal information than to opt in.
2. Unequal button prominenceMaking a "yes" button more prominent than a "no" button — through sizing, contrast, or colour.
3. Treating dismissal as consentTreating closing or navigating away from a pop-up as consent, without the consumer affirmatively selecting "I accept."
4. Default-on incentive programsSelecting by default, or featuring more prominently, the option to join a financial incentive program over the option not to.
5. Manufactured urgencyCreating a false sense of urgency that pressures consumers into quickly deciding the scope of their consent.

None of these will surprise anyone who has audited a typical consent banner. The "Accept All" button rendered in bold teal next to a faint grey "Manage Preferences" text link is the textbook example of unequal prominence layered on top of asymmetric steps. What's new is that regulators no longer have to argue the point from first principles — these patterns are now named in the text.

The symmetry rule, in plain English

Symmetry is the principle that ties the whole framework together, so it's worth getting precise. Section 7004 frames it as a question of paths: the path a consumer takes to exercise the more privacy-protective option must not be longer or more burdensome than the path to the less protective one.

The regulation gives its own illustrative examples of what fails the test:

The practical takeaway is blunt: if a visitor can accept everything in one click, they must be able to reject everything in one click, on the same layer of the interface, with equal visual weight. Burying the rejection behind a "Manage Settings" screen is the single most common way banners fail this rule.

Mandatory opt-out confirmation

One of the cleaner upgrades from optional to mandatory concerns confirmation. Under the updated regulations, when a consumer requests to opt out of the sale or sharing of their personal information — including when that request arrives via an opt-out preference signal such as Global Privacy Control (GPC) — the business is now required to confirm that the request has been processed.

This was previously a nice-to-have. Now it's an obligation. The regulations suggest acceptable methods: displaying an "Opt-Out Request Honored" message on the site, or reflecting the processed request through a toggle or radio button in the consumer's privacy settings. The point is that the consumer should be able to see that their choice actually took effect, rather than having to trust that a silent backend process did the right thing.

If your site honours GPC signals — and for California traffic, you should — you now also need a visible mechanism that communicates the signal was received and acted upon.

The other 2026 updates worth knowing

While dark patterns are the focus here, the same regulatory package brought several adjacent changes that interact with consent and request handling. A few worth keeping on your radar:

Enhanced right to know

If a business retains a consumer's personal information for longer than 12 months, its "request to know" mechanism must now let the consumer reach back beyond the trailing 12-month window — going as far back as January 1, 2022. In practice that means offering a date-range option or an "all data you've collected about me" option rather than a fixed one-year lookback.

Clarified privacy policy disclosures

Businesses must now identify the categories of personal information disclosed not only to "third parties" but also to "service providers and contractors" in the preceding 12 months. If no personal information was disclosed for a business purpose, that fact must be stated explicitly.

Sensitive personal information and minors

The definition of "sensitive personal information" was amended to include any personal information of a consumer the business has actual knowledge is under 16 years old — raising the stakes for any site with younger audiences.

The longer runway items

Automated decision-making technology (ADMT) disclosures, risk assessments, and cybersecurity audits are also part of the package, but those phase in across 2027 through 2030. The dark pattern and consent rules, by contrast, are live now.

How to fix your cookie banner before enforcement reaches you

The good news is that compliance with the dark pattern rules is mostly a design and engineering exercise, not a legal one. Here's a practical checklist mapped directly to the 2026 requirements:

• Equalise the buttons. "Accept All" and "Decline All" (or "Reject All") on the same layer, same size, same visual weight, both visible without scrolling.
• Count the clicks. Make sure rejecting takes no more steps than accepting. If accepting is one click, rejecting must be one click too.
• Kill dismissal-as-consent. Closing the banner, clicking the X, or scrolling away must not be logged as acceptance. Default to the privacy-protective state until the consumer affirmatively chooses.
• Honour GPC and confirm it. Detect opt-out preference signals, process them, and surface a visible confirmation that the request was honoured.
• Remove false urgency. No countdown timers or "act now" framing around consent decisions.
• Audit your defaults. No pre-checked boxes for data sales, sharing, or financial incentive programs.
• Check vendor banners too. If a third-party CMP renders your interface, you're still responsible for its asymmetries.

Why intent no longer matters

Perhaps the most important framing point for 2026 is one the CPPA has stated repeatedly: dark patterns are judged by their effect, not the business's intent. You don't get a pass for designing an asymmetric banner by accident, or because a vendor's default template happened to bury the reject option. If the interface impairs the consumer's ability to make a free choice, it's a dark pattern — regardless of whether anyone set out to manipulate.

That standard reframes compliance as an ongoing design discipline rather than a one-time legal sign-off. Every redesign, every A/B test on a consent flow, every new CMP configuration is a fresh opportunity to introduce — or eliminate — an asymmetry. The businesses that fare best under the 2026 rules are the ones that bake symmetry into their design system and verify enforcement at the script level, rather than treating the banner as a cosmetic checkbox.

Frequently asked questions