Abstract Dark patterns that manipulate consumer behaviour are now a pervasive feature of digital markets. Depending on the choice architecture utilised, they can affect the perception, behaviour and purchasing patterns of online consumers. Using a novel empirical design, we find strong evidence that individuals across all groups are susceptible to dark patterns, and only weak evidence that user susceptibility is materially affected by commonly used general proxies for consumer vulnerability (such as income, educational attainment or age). Our conclusions provide empirical support for broad restrictions on the use of dark patterns, such as those contained in the EU’s Digital Services Act, that protect all consumer groups. Our study also finds that added friction, in the form of required payment action following successful deployment of dark patterns, reduces their effectiveness. This insight highlights the instances in which dark patterns would be most effective – when no further action is required by the user. Consumer vulnerability is therefore more pronounced when dealing with online providers who store users’ payment details and can rely on a ‘single click’ to complete the purchase.