O'Sullivan's third audit of the Ryanair booking flow documents that nearly every manipulative pattern from his 2022 review remains intact in 2026, including the buried 'Do not insure me' option, pre-selected Priority Boarding, and red/green seat maps that conflate 'free' with 'unavailable'. He frames this persistence as evidence that Ryanair treats deceptive design as core revenue infrastructure rather than a fixable UX flaw.
By framing the 2026 post as a 'refresher' on patterns first catalogued in 2022, O'Sullivan implicitly argues that four years of EU consumer-protection scrutiny and the deceptive.design taxonomy gaining mainstream traction have produced essentially zero substantive changes at Ryanair. New 2026 additions like the bundled 'Smart Boarding' upsell and a pre-checked third-party hotel contact box suggest the regulatory environment has, if anything, emboldened new variants.
The editorial connects Ryanair's €4.86 per-passenger ancillary revenue — roughly a third of total per-pax revenue in FY2025 — directly to the survival of these patterns, citing Michael O'Leary's own earnings-call admissions about the ancillary strategy. The argument is that dark patterns are not a bug to be regulated away but the load-bearing mechanism of the ultra-low-cost carrier business model.
O'Sullivan documents the redesigned bag-size validator flagging an identical 40×20×25cm bag as oversized in the gate app while passing in the web checkout — a discrepancy he treats as a deliberate revenue mechanism rather than a measurement bug. Combined with the mobile boarding pass requiring a separate app install under threat of a £20 airport-checkin penalty, he argues Ryanair is using platform fragmentation itself as a dark pattern.
Conor O'Sullivan's blog post 'Ryanair dark UX patterns summer 2026 refresher' hit 200 points on Hacker News this morning. It is the third installment of a running audit — the original ran in 2022, an update in 2024, and now 2026 — that walks through the Ryanair booking flow screen by screen and tags each manipulative pattern by name from Harry Brignull's deceptive.design taxonomy.
The headline finding is that almost none of the 2022 patterns have been removed. The 'Do not insure me' option is still buried inside an alphabetized country dropdown between Latvia and Lithuania. Priority Boarding is still pre-selected and styled as the recommended path, with the no-thanks button rendered in a lower-contrast outline. Seat selection still uses red/green airplane diagrams where the 'free' middle seats are marked the same shade of red as 'unavailable' rows, exploiting the cultural association between red and unavailable to push users toward paid seats. The mobile boarding pass still requires a separate Ryanair app install on the day of travel, with the web flow gated behind a £20-at-airport-checkin penalty if you miss it.
What's new in 2026: a 'Smart Boarding' upsell that bundles three previously separate fees, presented as a discount; a third-party hotel cross-sell that now defaults to a checked checkbox marked 'I'd like to be contacted about my trip'; and a redesigned bag-size validator on the app that O'Sullivan documents flagging a compliant 40×20×25cm bag as oversized at the gate while passing the same dimensions in the web checkout.
Ryanair is the most-studied dark-pattern operator in commercial aviation because it is also the most profitable, and those two facts are connected, not coincidental. Its FY2025 results showed €4.86 in ancillary revenue per passenger, roughly a third of total per-pax revenue. The carrier is not hiding the strategy — Michael O'Leary has spent two decades on earnings calls explaining that ancillaries are the margin business and the fare is the loss leader. The booking flow is the conversion funnel for that margin business, and every UI affordance is tuned for it.
The EU's Digital Services Act, which became fully enforceable in February 2024, explicitly prohibits 'deceptive design' on online platforms, including pre-ticked boxes, confirmshaming, and misleading visual hierarchy. The Unfair Commercial Practices Directive has banned several of the same patterns since 2005. Italy's AGCM fined Ryanair €1.85M in 2023 specifically for the insurance dropdown. Belgium's consumer authority issued a separate ruling in 2024. None of this has moved the needle on the actual checkout flow, because the patterns are jurisdiction-specific to fight and global in their revenue contribution. If you can extract €2 of extra ancillary per booking across 200 million passengers, you can absorb a seven-figure fine per country per year and still be far ahead. That math is the entire story.
The practitioner-relevant reaction in the HN thread isn't moral outrage — it's recognition. The top comments are frontend and product engineers pointing out that they've been asked to ship versions of these exact patterns. A booking.com engineer notes that the 'X people are looking at this hotel right now' counter is generated client-side from a seeded random number. A former Expedia PM describes A/B tests where adding a pre-checked travel insurance box lifted attach rate from 4% to 31% — a 7x — and the test was 'not even controversial' to ship. A SaaS founder admits the 'Are you sure you want to cancel? Your team will lose access to…' modal in their churn flow was directly copied from a Brignull case study. The Ryanair audit is useful precisely because almost no engineer working today has avoided being adjacent to at least one of these patterns; it just names them, in order, with screenshots.
If you build checkout, onboarding, or subscription flows, the practical takeaway is to treat the deceptive.design taxonomy the way you treat OWASP Top 10: as a checklist run before merge, not a values statement on the about page. Pre-ticked checkboxes for paid add-ons, disguised ads, sneaking items into cart, confirmshaming, hard-to-cancel, forced continuity, and visual interference are the seven patterns most consistently flagged by both EU regulators and the FTC's 2023 dark-patterns report. Each has a structural signature in the DOM — pre-checked `` adjacent to a price increase, button contrast ratio inverted from the destructive action's typical hierarchy, modal copy that names a loss without naming a gain — and each is grep-able in a sufficiently disciplined component library.
The defensive move for an IC engineer is to keep the Brignull names handy in code review so 'this is confirmshaming' or 'this is roach motel' becomes a noun you can say in a Slack thread, not a vibe. Product managers will often genuinely not know the pattern has a name and a regulator behind it; once they do, the conversation shifts from 'this lifts the metric' to 'this lifts the metric and exposes us to a DSA complaint and a Hacker News thread.' The Ryanair audits are useful citation material here because they are dated, screenshot-based, and have outlived three EU regulatory cycles — that combination makes them harder to dismiss as a one-off complaint.
The second-order point is that 'we A/B tested it and it converted' is no longer a sufficient justification in any EU jurisdiction. The DSA's recital 67 specifically calls out that conversion lift cannot be the defense for a deceptive pattern, because the lift itself is evidence that the pattern is working as deception. If your analytics stack reports on attach rate without reporting on post-purchase refund rate and complaint rate, you are flying blind on the same metric Ryanair has been fined for optimizing.
The 2028 refresher will probably look much like the 2026 one. The EU's enforcement mechanism is per-member-state, the fines are uncorrelated with revenue impact, and Ryanair has internalized the cost. What might actually change the calculus is the proposed update to the Consumer Rights Directive that would let national authorities seek revenue-percentage fines (up to 4%, GDPR-style) for repeat dark-pattern violations — a draft is circulating in the Council and could be voted on in 2027. Until then, the playbook stays profitable, the audit stays useful, and the engineer's job is to keep the taxonomy close enough to hand to use the words out loud in the meeting where the pre-checked box ships.
About 1/3 of their revenue is ancillary (the dark patterns are there to cause ancillary revenue).I just flew from Bournemouth to Alicante on Ryanair for £50. A similar flight in the US (DC to Miami, for example) would be easily 5x that, possibly 7-8x. The dark patterns took me about 10min to cl
Oh, don't get me started on Ryanair, but alas.You go through what seems the entire check-in process, you get what seems like a summary at the end, with a link to a UK government site where you need to go next to get a travel authorization, I spend an hour doing that, finally finish that, I show
And a last, most sneaky one: At checkout if you pay with credit/debit card don't use Ryanair's "guaranteed exhange rate" if the cost of the flight is not in your card's currency (ticket by default, at least two clicks to find and untick it). That's ~6% gap from mid
They managed to create a business model relying in some sort of "slot machine" where customers buy the ticket to discover later they are "stupid" not noticing some rule hidden in the meticulously engineered dark patterns and, to board now and do not miss the planned trip, they wi
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
That “Don’t Insure Me” option hidden in the middle of a country list is pure evil. I’m used to seeing dark patterns everywhere but that’s a first for me.From where I stand, it’s not fair to charge the hell out of people who fall for these tricks while giving steep discounts to the ones who don’t. Ma