The regulations got stricter. The dark patterns got subtler.
Cookie consent banners — the ubiquitous pop-ups required by GDPR and CCPA — are supposed to enable genuine consent. In practice, they're adversarial interfaces (arXiv:2603.21515). UMBRA detects both classic dark patterns and nine newly evolved ones: pay-to-opt-out schemes (subscribe to reject cookies), fake opt-outs (the button does nothing), and revocation barriers (you can consent in one click but revoking requires navigating nested menus).
Audit of 14,000 websites: cookies are set before consent. Revocation remains obstructed. Third-party tracking persists despite user rejection. Sites implementing revocation barriers showed cookie increases averaging 25%. Many use insecure cookie attributes creating XSS and CSRF vulnerabilities — the consent mechanism itself is a security risk.
99% detection accuracy on ground-truth datasets. The detection combines text analysis (spotting misleading language), visual heuristics (button size, color contrast, placement asymmetry), and interaction tracing (does clicking “reject” actually stop cookies?).
The structural insight: regulation creates selection pressure on deception, not elimination of it. Before GDPR, websites tracked without asking. After GDPR, they ask — but design the asking to produce the answer they want. The dark patterns evolved: first-generation patterns (hidden reject buttons) are now caught by auditors. Second-generation patterns (fake opt-outs, pay walls) require behavioral testing to detect because they look compliant while being functionally non-compliant. The compliance is in the form; the violation is in the function. The regulation selected for more sophisticated deception.