South Korea’s competition regulator published a consolidated rulebook on manipulative online interfaces on Tuesday, setting out in unusual operational detail where e-commerce operators must place a cancellation button and which checkout behaviours it now treats as deceptive.
The Korea Fair Trade Commission (KFTC) said on October 6 that it had established and distributed guidelines for operating online interfaces to prevent dark patterns, according to reporting by the Korea Times, Korea JoongAng Daily and broadcaster SBS. MLex reported that the document covers 13 types of manipulative online practice, pairing each with compliance requirements, worked examples and answers to questions about how the underlying law applies.
The guidance is not itself legally binding. That framing has led some early coverage to treat it as a soft-law footnote, which understates what it does: it is the enforcement roadmap for a statute that has been in force since February 2025, carries corrective orders, administrative fines and business suspension, and has already produced sanctions against Coupang and Spotify.
For retailers and marketplaces selling into a market that research firm IMARC Group sized at about USD 606 billion in 2025, the practical question is narrower than the policy debate. It is whether a subscription cancellation flow, a shipping-fee disclosure sequence or a pre-ticked insurance box would survive an ex officio investigation in Seoul.
In short
- What happened: The Korea Fair Trade Commission published consolidated dark pattern guidelines on October 6, 2026, covering 13 manipulative interface practices with examples and a compliance Q&A.
- The operative rule: Subscription cancellation and membership withdrawal buttons must sit on the first screen after login, or one click from it, such as a “My Page” section, rather than buried in security settings.
- The legal teeth: The guidelines are non-binding, but the underlying Act on Consumer Protection in Electronic Commerce has banned six dark patterns since February 14, 2025, with corrective orders, fines and suspension available.
- The enforcement record: The KFTC has moved against 36 firms across OTT, music, e-book, e-commerce, rental and travel, but headline fines have been tiny, reportedly around KRW 10.5 million (roughly USD 7,800) in the first sanctions round.
- Why it matters globally: Korea is now operationally ahead of the United States, where the federal click-to-cancel rule was vacated in 2025 and remains at the advance-notice stage, and ahead of the EU, which is still drafting the Digital Fairness Act.
What the Korea Fair Trade Commission actually published
The KFTC’s announcement consolidates guidance that had previously been scattered across an initial guideline set, a compliance Q&A and a series of enforcement statements. The regulator said the new document updates and combines that material, adding detailed examples of violations so that platform operators can judge their own interfaces against a concrete standard.
Two specific instructions dominated the coverage. The first concerns cancellation: the guidelines recommend placing buttons for cancelling subscriptions or withdrawing membership on the initial screen after a user logs into a cyber mall, or on a screen reachable with a single click from that initial screen, such as a “My Page” area.
The Korea Times reported the regulator contrasted this with less intuitive placements, citing security settings as an example of where a cancellation link should not live. The second instruction addresses order flows, with the KFTC saying operators should avoid automatically adding options that consumers have not explicitly selected during the ordering process.
That second point is the pre-selection problem familiar to anyone who has bought an airline ticket and found travel insurance already ticked. Korean law has treated it as a distinct statutory category since 2025, rather than leaving it to general unfair-practice principles.
Why the regulator moved now
The timing reflects a sequencing choice rather than a reaction to a single incident. Korea’s amended e-commerce statute took effect in February 2025, a drip pricing grace period closed that August, and the first sanctions landed in October 2025. The guidance arrives after roughly 20 months of live enforcement, which gave the regulator a body of actual cases to generalise from.
That ordering matters for how seriously operators should read it. A guideline issued before enforcement is a prediction. A guideline issued after 36 firms have been through a monitoring sweep is closer to a published charge sheet, describing what the regulator has already decided it does not accept.
Why a non-binding guideline still carries legal force
The distinction regulators draw between binding rules and guidance is real but frequently misread by compliance teams. The KFTC’s guidelines do not create new obligations. They interpret obligations that already exist in primary legislation, and that legislation is enforceable.
The KFTC was explicit on this point, saying that while the guidelines are not legally binding, platform operators must comply with the Act on Consumer Protection in Electronic Commerce. An operator that ignores the guidance is not breaching the guidance. It is exposing itself to a finding under the statute, with the guidance available as evidence of what the regulator considers compliant.
The statute behind the guidance
Amendments to the Act on Consumer Protection in Electronic Commerce, commonly shortened to the E-Commerce Act, took effect on February 14, 2025. Law firm analyses from Kim & Chang, Yulchon and Lee & Ko describe the amendments as explicitly regulating six named categories of dark pattern, a drafting approach that differs sharply from the open-ended prohibitions used in Europe.
Naming the categories narrows the enforcement question. Rather than arguing about whether a given interface “materially distorts” consumer decision-making, a Korean investigator asks whether the interface falls inside one of six defined boxes. That is faster to prove and harder to litigate around.
The trade-off is coverage. A practice that is manipulative but does not fit any of the six categories is left to general provisions, which is one reason the new guidance extends to 13 practices rather than six.
What sanctions actually look like
Published guidance from Korean practitioners indicates violations can draw corrective orders, administrative fines and business suspension, with subordinate rules escalating by violation count. Reported suspension tiers run to three, six and twelve months. Administrative fines, by contrast, are described as falling in the low hundreds to several thousand US dollars depending on the number of violations.
That gap between the suspension power and the fine schedule is the single most important thing to understand about Korean dark pattern enforcement. The monetary penalty is close to irrelevant for a large platform. The corrective order, which compels an interface change, and the suspension power, which threatens the business itself, are not.
The six statutory dark patterns and what each one tests
The six categories written into the amended Act have been consistently described across law firm summaries. Each maps to a specific interface behaviour rather than an abstract principle, which makes self-auditing tractable.
| Statutory category | Interface behaviour | Practical compliance test |
|---|---|---|
| Hidden renewals | Converting a free trial or fixed term into a paid recurring charge without clear notice | Is there a distinct, timely notification before the first charge and before each renewal? |
| Drip pricing | Disclosing mandatory fees in stages so the first price shown is not payable | Does the first displayed price include every unavoidable fee and charge? |
| Pre-selected purchase options | Add-ons, insurance or upgrades ticked by default | Does every optional item start unselected and require an affirmative action? |
| Misleading hierarchies | Visual design that makes the consumer-adverse choice prominent and the neutral choice faint | Do accept and decline options have comparable size, contrast and placement? |
| Obstruction of cancellation or withdrawal | Burying, delaying or adding friction to cancellation | Is cancellation reachable in one click from the post-login screen? |
| Repeated interference | Re-prompting a consumer who has already declined | Does a declined offer stay declined for the rest of the session? |
The guidance published on October 6 expands this to 13 practices, according to MLex. The additional entries function as sub-types and edge cases rather than wholly new prohibitions, which is consistent with the KFTC’s stated aim of improving predictability rather than widening the net.
The cancellation rule is the one that forces code changes
Of the six, obstruction of cancellation is the category that cannot be satisfied with disclosure copy. The other five can often be resolved by changing what text appears and when. Cancellation placement is an information architecture requirement, and it competes directly with retention metrics.
Most subscription businesses deliberately place cancellation several levels deep, frequently inside an account or billing sub-menu, sometimes behind a retention offer sequence. The Korean standard of one click from the post-login screen eliminates that pattern for any operator serving Korean consumers.
It also creates a structural question for global platforms running a single codebase. A jurisdiction-specific cancellation path is technically straightforward but operationally awkward, and the alternative, applying the strictest standard globally, has revenue consequences that product teams tend to resist.
What enforcement has looked like since February 2025
The enforcement record is short but informative, and it undercuts the assumption that a new consumer-protection regime takes years to bite. The KFTC and the Korea Consumer Agency ran a monitoring sweep from the statute’s entry into force through July 2025, covering OTT platforms, music streaming and online shopping.
That sweep produced a ruling on September 30, 2025, reported as applying to 36 firms across OTT, music, e-book, e-commerce, rental and travel sectors. The first formal sanctions followed on October 15, 2025, against Coupang, Wavve, NHN Bugs and Spotify, reportedly totalling KRW 10.5 million across all four.
| Date | Step | Scope | Reported outcome |
|---|---|---|---|
| February 14, 2025 | Amended E-Commerce Act in force | Six dark pattern categories | Obligations begin, drip pricing grace period opens |
| August 13, 2025 | Drip pricing grace period ends | All operators | KFTC signals ex officio investigations |
| February to July 2025 | Joint monitoring sweep | OTT, music streaming, online shopping | Evidence base for first cases |
| September 30, 2025 | Ruling concluding the sweep | 36 firms, six sectors | Corrective measures |
| October 15, 2025 | First sanctions under the amendment | Coupang, Wavve, NHN Bugs, Spotify | Reportedly KRW 10.5m total |
| October 24, 2025 | Initial guidelines take effect | Cyber mall operators | First compliance framework |
| October 6, 2026 | Consolidated guidelines published | 13 practices | Examples, Q&A, cancellation placement rule |
The numbers that should worry operators are not the fines
Coupang’s share of that first sanctions round was reported at KRW 2.5 million, which converts to roughly USD 1,860 at the rate of about KRW 1,344 to the dollar quoted on October 5 and 6. For a company of Coupang’s scale, that is a rounding error rather than a deterrent.
Reading the fine as the regulator’s valuation of the conduct would be a mistake. Korean administrative fines for this category are set by schedule, not by harm or turnover, which is why they look trivial next to European penalties calculated as a percentage of global revenue.
The enforcement signal sits in the corrective orders and in the fact that the regulator ran a cross-sector sweep at all. A firm that receives a corrective order has to change its product, and the second violation escalates toward suspension tiers that no marketplace can absorb.
How Korea compares with the United States, Europe and the United Kingdom
Korea’s position looks stronger in comparison than it does in isolation, because the jurisdictions usually treated as regulatory leaders have both stalled on this specific question.
| Jurisdiction | Instrument | Status | Cancellation requirement |
|---|---|---|---|
| South Korea | Amended E-Commerce Act plus October 2026 guidelines | In force since February 2025, enforced since 2025 | One click from the post-login screen |
| United States (federal) | FTC Negative Option Rule | 2024 rule vacated July 2025, new advance notice issued 2026 | None in force, enforcement via FTC Act and ROSCA |
| New York City | DCWP click-to-cancel rule | Effective October 1, 2026 | Yes, with per-violation penalties |
| European Union | DSA Article 25 plus UCPD | In force, no definition of dark patterns | No specific placement rule |
| European Union (proposed) | Digital Fairness Act | Legislative proposal stage | Expected to broaden beyond platforms |
The United States federal rule collapsed on procedure
The FTC’s click-to-cancel rule was vacated by the Eighth Circuit on July 8, 2025. The court held that the Commission failed to comply with procedural requirements governing its rulemaking, depriving petitioners of a fair opportunity to participate. The ruling turned on process rather than on whether the substance was within the agency’s authority.
The FTC restarted. It submitted a draft advance notice of proposed rulemaking to the Office of Information and Regulatory Affairs on January 30, 2026, and subsequently issued an advance notice seeking comment on whether and how to modernise the Negative Option Rule. Law firm analyses note it remains unclear whether the Commission will re-propose something comparable in scope to the vacated rule.
In the interim the agency has continued to bring cases under Section 5 of the FTC Act and the Restore Online Shoppers’ Confidence Act. That enforcement route works, but it operates case by case rather than setting a design standard, and the FTC’s willingness to press subscription-practice claims is visible in the enlarged Amazon Prime refund payments that began on October 1.
US cities and states moved into the gap
The practical consequence of federal delay has been fragmentation. The New York City click-to-cancel rule that took effect on October 1, 2026 is the clearest example, imposing municipal cancellation obligations with per-violation penalties on businesses that would otherwise face no specific federal standard.
For a national retailer this is the worst available outcome. A single federal rule is a one-time compliance project. A patchwork of municipal and state rules requires jurisdiction detection, divergent flows and continuous monitoring of legislative calendars.
The same dynamic is visible in adjacent pricing rules, where the FTC’s broader agenda has advanced unevenly and the personalized pricing docket closed with industry signalling a court fight rather than acquiescence.
Europe has breadth without specificity
Article 25 of the Digital Services Act prohibits providers of online platforms from designing, organising or operating their interfaces in a way that deceives or manipulates recipients, or otherwise materially distorts or impairs their ability to make free and informed decisions. The provision is fully in force.
Its weakness is that it supplies no definition of a dark pattern and no design standard. The Commission has the option, not the obligation, to issue guidelines, and has not produced the kind of placement rule Korea has now published. Enforcement therefore requires a case-specific argument about whether a given interface materially distorts decision-making.
The Digital Fairness Act is expected to address this, extending beyond the platform-only scope of Article 25 to business-to-consumer services generally. It remains at proposal stage, which means the operative European standard for the next several years is still the general one.
What this means for retailers and marketplaces selling into Korea
The compliance burden falls unevenly. Operators whose Korean presence is a localised storefront running on global infrastructure face the most work, because the interface decisions that now carry regulatory risk are usually made centrally and deployed everywhere.
Three areas deserve immediate review. Cancellation path depth is the first and most concrete, measured simply as the number of clicks from the post-login screen to a completed cancellation. Anything greater than one click to reach the cancellation entry point is now outside the regulator’s stated expectation.
Price assembly is the second. Drip pricing has been enforceable without a grace period since August 2025, and the test is whether the first number a consumer sees includes every unavoidable charge, including delivery where delivery is mandatory.
Default states are the third. Every pre-ticked box in a Korean checkout flow is a candidate violation, including options that a product team would describe as a convenience rather than an upsell.
Interface changes that are worth auditing now
A practical audit does not require legal input for the first pass. It requires someone to attempt cancellation as a consumer, record the click path, and screenshot each decision point. Most violations are visible in that exercise without reference to the statute.
The second pass should check retention interstitials. A cancellation flow that is one click to enter but then presents three successive retention offers may satisfy the placement rule while failing the repeated interference category, which is a distinct statutory box.
The third pass should cover notification timing on renewals. Hidden renewals is the category most likely to catch businesses that believe they are compliant, because a renewal notice buried in a transactional email footer is technically present and practically invisible.
The Coupang overhang
Coupang’s position complicates the picture, because the company is simultaneously the most prominent dark pattern respondent and the subject of a separate and far more serious competition investigation.
The KFTC’s handling of that broader Coupang file has already drawn judicial attention, and shopappy covered the point at which Korea’s antitrust chief committed to repairing the Coupang probe ahead of a Seoul court ruling. A regulator defending its own process in court is in a weaker position to demand procedural rigour from the companies it supervises.
That does not reduce the dark pattern exposure. It does suggest that the KFTC has an institutional incentive to demonstrate competence in an area where its legal footing is unambiguous, and consumer-interface enforcement under a statute with named categories is exactly that kind of area.
The wider Asia-Pacific pattern
Korea is not acting alone, and the regional direction is toward prescriptive interface rules rather than general principles. Jones Day’s survey of competition enforcement in the region identifies dark patterns as a shared priority across several Asia-Pacific authorities.
India has moved along a parallel track, pairing dark pattern guidance from its consumer protection authority with a broader rewrite of platform obligations, and shopappy has tracked how India’s amended e-commerce rules impose a 30-day price test on Amazon and Flipkart. The common thread is regulators specifying interface outcomes rather than prohibiting categories of intent.
For global operators the consequence is that the strictest-jurisdiction approach becomes more attractive over time. When three or four major markets each specify a slightly different cancellation standard, maintaining per-market flows costs more than adopting the tightest one everywhere.
What the guidance leaves unresolved
Three ambiguities survive the consolidation, and each one matters more to large operators than to small ones.
The first is the boundary of the cancellation rule itself. The guidance addresses where the cancellation entry point sits, but says less about what may legitimately happen after a consumer clicks it. Identity re-verification, a confirmation step and a refund calculation are all defensible, yet each adds friction that in aggregate reproduces the behaviour the rule targets.
The second is how the placement standard applies to interfaces that do not have a conventional post-login home screen. Voice ordering, in-app purchase flows mediated by a mobile platform, and subscriptions sold through a third-party marketplace all lack the structure the rule assumes. The guidance was written for cyber malls, and the cyber mall model is no longer the only one.
The third is the interaction with platform-level billing. Where a subscription is purchased through an app store, the cancellation control frequently belongs to the app store rather than the merchant. An operator can be fully compliant in its own interface and still leave the consumer unable to cancel without leaving it.
Why the predictability framing cuts both ways
The KFTC has presented the guidelines as clarifying existing prohibitions rather than creating new ones, with the stated aim of improving predictability for compliant businesses. That framing is accurate and is also a warning.
If the obligations already existed, then an operator discovering today that its cancellation flow is four clicks deep has not just acquired a compliance gap. It has been exposed since February 2025, and the guidance now removes any argument that the standard was unclear.
Regulators use clarification documents precisely because they foreclose the uncertainty defence. The practical effect is to shorten the runway for remediation rather than to extend it.
How large the exposed market actually is
Korea is a disproportionately important market for this kind of rule because digital commerce penetration is unusually high. IMARC Group put the South Korean e-commerce market at about USD 606 billion in 2025, and other trackers cite figures in a similar range near USD 624 billion.
Those estimates differ in methodology and should be treated as indicative rather than precise. What they agree on is scale: Korea is among the largest e-commerce markets globally relative to its population, and subscription commerce is well established across streaming, grocery and membership retail.
That density is why the first enforcement sweep was able to cover OTT, music, e-book, e-commerce, rental and travel without straining the regulator’s capacity. The sectors most exposed to dark pattern rules are the sectors where Korean consumers already transact most heavily.
What to watch next
Three developments will determine whether the October 6 guidance changes behaviour or simply documents it. The first is whether the KFTC follows the guidance with a second cross-sector sweep, which would confirm that the document is an enforcement precursor rather than a compliance courtesy.
The second is whether the fine schedule is revised. The current structure caps monetary exposure at a level that rational operators can ignore, and Korean commentary has noted the mismatch between the schedule and the scale of the platforms being supervised.
The third is the European timetable. If the Digital Fairness Act lands with a specific cancellation standard, the strictest-jurisdiction calculation changes for every global subscription business, and the Korean rule stops being an outlier that can be handled with a market-specific exception.
The official text and subsequent enforcement notices are published by the regulator in Korean and, selectively, in English on the Korea Fair Trade Commission’s English site.
Frequently asked questions
Are the Korea FTC dark pattern guidelines legally binding?
No. The KFTC stated that the guidelines are not legally binding. However, platform operators must comply with the Act on Consumer Protection in Electronic Commerce, which has banned six categories of dark pattern since February 14, 2025 and carries corrective orders, administrative fines and business suspension. The guidelines interpret that statute, so ignoring them raises the risk of a statutory finding.
Where exactly does a cancellation button have to be placed?
The guidelines recommend placing subscription cancellation and membership withdrawal buttons on the initial screen a user sees after logging into a cyber mall, or on a screen reachable with a single click from that initial screen, such as a “My Page” area. The KFTC contrasted this with placements like security settings, which it treats as insufficiently accessible.
What are the six dark patterns prohibited by Korean law?
Hidden renewals, drip pricing, pre-selected purchase options, misleading hierarchies, obstruction of cancellation or withdrawal, and repeated interference. These were written into the amended Act on Consumer Protection in Electronic Commerce, which took effect on February 14, 2025. The October 2026 guidelines expand the treatment to 13 practices according to MLex.
How large are the fines for dark pattern violations in Korea?
Reported penalties have been small. The first sanctions round in October 2025, against Coupang, Wavve, NHN Bugs and Spotify, reportedly totalled KRW 10.5 million, roughly USD 7,800 at about KRW 1,344 to the dollar. Coupang’s share was reported at KRW 2.5 million. The more significant exposure comes from corrective orders and escalating business suspension tiers of three, six and twelve months.
Do these rules apply to foreign sellers and overseas platforms?
The guidelines address cyber mall operators such as OTT services, commerce platforms and online travel agencies without drawing a distinction based on seller origin. Spotify’s inclusion in the first sanctions round indicates that non-Korean operators serving Korean consumers are within scope in practice.
What is the status of the US click-to-cancel rule?
The FTC’s 2024 Negative Option Rule was vacated by the Eighth Circuit on July 8, 2025 on procedural grounds. The Commission submitted a draft advance notice of proposed rulemaking in January 2026 and has since issued an advance notice seeking comment on modernising the rule. No federal cancellation rule is currently in force, though the FTC continues to enforce under Section 5 and ROSCA.
How does Korea’s approach differ from the EU Digital Services Act?
Article 25 of the DSA bans manipulative interface design but supplies no definition of a dark pattern and no design standard, so enforcement requires a case-specific argument. Korea names six statutory categories and now publishes a specific placement rule for cancellation. The EU’s Digital Fairness Act is expected to close that specificity gap but remains at proposal stage.
What should a retailer audit first?
Measure the click path from the post-login screen to a completed cancellation. If reaching the cancellation entry point takes more than one click, that is the first fix. Then check whether the first price shown includes all unavoidable fees, whether any checkout option is pre-ticked, and whether a declined offer is re-presented later in the same session.
Is Korea planning further enforcement sweeps?
The KFTC has not announced a specific second sweep tied to the October 2026 guidelines. Its prior pattern was to monitor sectors first, issue a consolidated ruling, then sanction, and the regulator has previously said it would launch ex officio investigations into sectors where dark patterns persist. A follow-up sweep would be consistent with that sequence.