Deceptive design pattern

Confirmshaming and the confirmation gauntlet: when “are you sure?” is the trap

A confirmation gauntlet is a chain of “are you sure?” dialogs that pretends to protect the user while actually discouraging them, usually reinforced by confirmshaming — writing the decline option as a small self-insult so that choosing it feels like an admission. Both rest on the same finding: a warning shown repeatedly stops being read, so adding confirmations past the first one buys no safety and mostly buys abandonment.

What it is

A single confirmation before an irreversible action is good practice. It is Jakob Nielsen’s error-prevention heuristic in its most literal form, and it exists because the cost of an accidental deletion is far higher than the cost of one extra click. The confirmation gauntlet is what happens when that reasoning is applied a second, third and fourth time by a team whose actual goal is to make the action less likely to complete. The vocabulary of safety is preserved; the function has changed from protecting the user to deterring them.

Confirmshaming is the other half, and it works on the wording rather than the count. Instead of a neutral decline — “No thanks”, “Not now” — the option the site does not want is written as a small confession of stupidity or meanness: “No thanks, I like paying full price”, “No, I don’t want to save money”, “I’d rather stay uninformed”. Mathur and colleagues, crawling roughly 11,000 shopping sites, found 169 instances of it, most often in modals trading a discount for an email address. Brignull, who named the pattern, classifies it as emotional manipulation; the Princeton crawl classifies it as asymmetric but not covert, which is the interesting part. Confirmshaming works while you can see it working.

“The Confirmation Gauntlet” takes an ordinary account-deletion flow and runs the pattern to its logical end. The first dialog is a plain “Are you sure?”. The second asks whether you are really sure, and quietly swaps the positions of Yes and No, so that repeating the motion that worked a moment ago sends you back to the start. The third presents two identical “Yes” buttons and tells you one of them is not real; picking the wrong one resets everything. The fourth demands you solve an arithmetic problem. The fifth asks you to type DELETE into a field that empties itself every two seconds. It is an escalation played for laughs, and each rung of it is a technique that ships in production somewhere.

Gray and colleagues, building a taxonomy from 118 examples collected by practitioners, would split this level across three of their five categories: obstruction for the chain itself, interface interference for the swapped and duplicated buttons, and forced action for the arbitrary tasks bolted on at the end. The FTC’s 2022 staff report on dark patterns describes the same collection of moves from the consumer-protection side.

Why it works on people

The core mechanism is habituation, and it has been observed at the level of neural response. Anderson and colleagues used fMRI to watch what happens as a security warning is shown repeatedly, and found the brain’s response to it declines with each exposure — the paper’s title, “From Warning to Wallpaper”, is the finding. This is why a chain of confirmations is not additive. The first dialog is read; by the third, the user is executing a motor sequence and the words have become scenery. A gauntlet does not make an action safer than one dialog does. It makes the dialogs less likely to be read, including the one that mattered.

That produces a specific failure mode worth naming: gauntlets train the click-through habit and then punish it. Once a user has learned that the dialogs in a product are noise, the genuinely dangerous one arrives inside the same rhythm and receives the same reflex. Teams that add confirmations to reduce accidental destruction can, past a certain count, increase it.

The second mechanism is motor automation. Repeated interfaces build motor plans; a person who has pressed the right-hand button twice will aim for the right-hand button the third time before the labels have been processed. Swapping the positions of a safe and a destructive option between steps converts that efficiency into a trap. California’s privacy regulations describe the same design as confusing on its face: presenting choices as Yes then No, and then reversing to No then Yes, contravenes what the user has been led to expect.

Third, confirmshaming works because declining requires you to assert the insult on your own behalf. Framing a choice as a loss changes how people evaluate it, and shame is an unusually effective lever on behaviour. The button is not arguing that the offer is good; it is making the refusal socially uncomfortable in a room with nobody in it, which turns out to be enough for a measurable fraction of people.

Fourth, arbitrary tasks — a captcha, a sum, a timed transcription — are effort taxes dressed as verification. They do confirm intent in a weak sense, and they are also indistinguishable from an obstacle, which is what makes them attractive to a team that wants an obstacle and a rationale at the same time.

Finally, the metric is flattering. A gauntlet reliably reduces the number of completed deletions and cancellations, and that number goes up on a dashboard as a save. The people who intended to leave and could not are not counted anywhere.

Where you meet it

  • Newsletter and discount modals whose dismiss control reads “No thanks, I hate saving money” rather than “No thanks”.
  • Account deletion placed behind three or more dialogs, where an earlier one returns you to the start of the flow rather than to the step you were on.
  • Cookie or tracking prompts where declining is phrased as indifference to your own interests — “No, I don’t want a personalised experience”.
  • Destructive and safe actions that trade places between two dialogs in the same flow, or between a web app and its own native dialogs.
  • Confirmation dialogs in a cancellation flow with a button labelled “Cancel”, so the same word means both proceed and abort.
  • Type-to-confirm fields on actions that are trivially reversible, where the friction is theatre rather than protection.
  • Charitable round-up or opt-out prompts where the decline is framed as a refusal to help someone.
  • Progressive dialogs that add a new hurdle each time the user returns, so the flow is longer on the second attempt than the first.

Designing around it

  • Confirm once, and only for actions that are both consequential and irreversible. If you cannot say in a sentence what the second dialog protects against that the first does not, it is deterrence rather than safety. It is the highest-leverage change available here, because the habituation research suggests the marginal dialog is not merely useless but actively erodes the first one.
  • Prefer undo to confirmation wherever the action can be made reversible. A soft delete with a restore window, or a thirty-day grace period on account closure, removes the dialog entirely and protects the user better than any number of prompts — this is Nielsen’s user-control-and-freedom heuristic doing the work that error prevention was being stretched to cover. Announce the undo route in the success message, not in a modal beforehand.
  • Write the dialog around the consequence and the object, not around certainty. “Delete 3 projects and 428 files? This cannot be undone.” tells someone what they are about to lose. “Are you sure?” asks them to introspect about a fact they do not have. Label the confirm button with the verb and the object — “Delete 3 projects” — so the button is readable without the sentence above it.
  • Keep the destructive action in a fixed position across every dialog in the product, and keep the order of choices consistent. If the safe option is on the right in one dialog, it is on the right in all of them. Reordering between steps of the same flow is not a safeguard; it is a way of generating mis-clicks and then blaming the user for them.
  • Reserve type-to-confirm for the genuinely unrecoverable, and do not stack anything on top of it. A field where you type the resource name is a good pattern precisely because it forces specific attention on the specific object. Adding a countdown, a self-clearing input, a captcha or an arithmetic problem converts it from a check on intent into an endurance test, and a time limit imposed on an input is an accessibility failure in its own right under WCAG’s Timing Adjustable criterion.
  • Write the decline option in neutral, first-person-plausible language. “No thanks”, “Not now”, “Skip”, “Continue without an account”. A useful test: read the label aloud as if a member of staff were saying it to a customer. If it would be rude in a shop, it is rude in a modal; the medium is doing most of the work of making it feel acceptable.
  • Give the decline the visual weight of a real control. A dismiss option rendered as grey seven-pixel text under a full-width primary button is an asymmetry the user has to work to overcome, and it is the same design as confirmshaming with the insult removed.
  • Make every dialog properly operable: focus moves into it on open, Escape closes it, focus returns to where it came from, the confirm control is reachable by keyboard, and nothing in it expires on a timer. Dialog accessibility is where deterrent friction shows up first, because the techniques that annoy sighted mouse users tend to break keyboard and screen-reader users outright.
  • Instrument the flow honestly. Count the dialogs a user must clear to complete each destructive or exit action and treat that count as a number you defend in review. Track undo and restore rates: a high restore rate means the confirmations are not working, and adding another will not fix it. Track abandonment per step and be candid internally about which of those abandonments were intended by the design.
  • An honest version of a delete-account flow: a settings entry labelled “Delete account”, one dialog that states exactly what will be deleted, what will be retained and for how long, a type-the-account-name field, a confirm button labelled “Delete account”, a neutral “Cancel” beside it, and an email afterwards explaining how to restore within the grace period. One prompt, no shame, and a genuine safety net instead of a gauntlet.

Questions

What is confirmshaming?

It is writing the option a site does not want you to choose as a small insult to yourself — “No thanks, I like paying full price” instead of “No thanks”. Brignull named it, and a crawl of roughly 11,000 shopping sites found 169 instances, mostly in modals offering a discount in exchange for an email address. It works by making the refusal socially uncomfortable rather than by arguing that the offer is good.

Are confirmation dialogs bad design?

No — one confirmation before a consequential, irreversible action is standard good practice and prevents real harm. The problem is chains. Because response to a repeated warning measurably declines with exposure, a second and third dialog do not add protection; they teach the user to click through, which weakens the first dialog too. If an action can be made reversible with an undo window instead, that is better than any dialog.

Why do some interfaces swap the Yes and No buttons between dialogs?

Because repetition builds a motor plan, and moving the target converts that efficiency into a mis-click. A user who pressed the right-hand button twice will aim there a third time before reading the labels. California’s privacy regulations name the practice — offering choices as Yes then No, then reversing the order — as confusing design that contravenes what the user has been led to expect. Keep destructive actions in a fixed position across the whole product.

What should a delete-account flow look like?

One dialog that states exactly what will be deleted, what will be retained and for how long; a field where the user types the account or resource name; a confirm button labelled with the action rather than with agreement; a neutral cancel beside it at real visual weight; and a grace period with a restore route explained in the confirmation email. No timers, no arithmetic, no second and third “are you really sure”, and no guilt in the copy.

Sources

  1. Anderson, B. B., Vance, A., Kirwan, C. B., Eargle, D., & Jenkins, J. L. (2016). From Warning to Wallpaper: Why the Brain Habituates to Security Warnings and What Can Be Done About It. Journal of Management Information Systems, 33(3), 713–743. Uses fMRI to show that neural response to a repeated warning declines with exposure, and tests polymorphic designs as a countermeasure. The empirical basis for treating each additional confirmation as a cost to the first one rather than an addition to it. Studied on security warnings, so applying it to confirmation dialogs is an inference by analogy, though a close one.
  2. Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A. (2019). Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), Article 81. Automated crawl of ~53,000 product pages across ~11,000 shopping sites, finding 1,818 dark pattern instances across 15 types. 169 of those were confirmshaming, mostly in email-capture modals, with real examples including “No thanks, I like paying full price”. Classifies confirmshaming as asymmetric but not covert.
  3. Brignull, H. Deceptive Patterns — “Confirmshaming”. The taxonomy entry that named the pattern: “The user is emotionally manipulated into doing something that they would not otherwise have done.” Brignull began cataloguing these designs in 2010.
  4. Gray, C. M., Kou, Y., Battles, B., Hoggatt, J., & Toombs, A. L. (2018). The Dark (Patterns) Side of UX Design. Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems. Builds a five-category taxonomy — nagging, obstruction, sneaking, interface interference and forced action — from 118 examples collected by UX practitioners. The framework that separates the chain (obstruction), the swapped buttons (interface interference) and the arbitrary tasks (forced action).
  5. Nielsen, J. (1994, updated 2024). 10 Usability Heuristics for User Interface Design. Nielsen Norman Group. Heuristic 5, error prevention, is the legitimate case for a confirmation. Heuristic 3, user control and freedom, is the argument for undo over confirmation. Heuristic 4, consistency and standards, is the argument against moving a destructive button between steps.
  6. W3C. Web Content Accessibility Guidelines (WCAG) 2.2, Success Criterion 2.2.1: Timing Adjustable. A Level A criterion requiring that content-imposed time limits can be turned off, adjusted or extended, with narrow exceptions. Directly relevant to confirmation inputs that clear themselves or expire, which is the level’s final step played straight.
  7. California Code of Regulations, title 11, § 7004(a)(3). Cited narrowly for its illustrative example rather than as general UI law: it identifies inconsistent ordering — offering choices as “Yes” then “No” and later reversing them — as confusing design that contravenes user expectation. The section applies to methods for submitting CCPA requests and obtaining consent, not to interfaces generally.
  8. Federal Trade Commission, Bureau of Consumer Protection (2022). Bringing Dark Patterns to Light: Staff Report. US staff-level account of design that obscures or subverts consumer choice, with an appendix cataloguing common patterns. A staff report rather than a rule, so it describes enforcement thinking rather than creating obligations.

Related patterns