🛡️ The rules that are supposed to protect you

Europe — GDPR (in force 2018). Saying yes or no to cookies must be a real choice. Non-essential cookies need consent that is freely given, specific, informed and unambiguous, and it's opt-in by default — tracking stays off until you actively agree. Refusing has to be as easy as accepting, and pre-ticked boxes or "just keep browsing" do not count as consent.

United States — a patchwork, not one law. There is still no comprehensive federal privacy law (a federal bill, the SECURE Data Act, only appeared in 2026). Instead about 20 states now have their own privacy laws, led by California's CCPA (2018, effective 2020) and its CPRA upgrade (2023). The key difference: the US model is mostly opt-out — firms may collect and even sell your data unless you actively say no ("Do Not Sell or Share My Personal Information") — the reverse of GDPR's opt-in.

🎯 Why this matters — and why a game

Having a right on paper isn't the same as being able to use it. Companies can comply technically while burying, disguising, or exhausting your "no" through interface design — what Soe et al. call circumvention by design. The law protects your rights; it barely regulates the design of the screen that delivers them.

Awareness is the first line of defense. If you can recognise a dark pattern in the half-second you see it, you can resist it, choose deliberately, and demand better design. This game trains that reflex: feel the friction, then learn its name.

Your only job: decline non-essential cookies on every site. That should take one click.

It won't. Each level hides a real dark pattern documented in the research. After every choice you make, the trick gets named and explained. Your click-counter is the scoreboard of shame.

⏳ And you're on the clock. Each site has a time limit — and it shrinks as you go, starting around 10 seconds and tightening toward 4. Run out and — like most real users worn down by friction — you default to accepting. That surrender is exactly what the design is built to produce.

Real finding: across 300 news sites, 297 used dark patterns; accepting took 1 click, declining took up to 17 (Soe et al., 2020).

Based on