Activity Notice Builder

A small card slides up in the corner of a shop page. It says that a number of people have bought this item today, or that someone is looking at it right now. Most of us glance at it and feel a faint pull. That pull is old, and it is not stupid. The trouble is that the card is very cheap to fake, and a reader has no way to tell a counted number from a typed one.

Why a stranger’s choice moves us

Psychologists call the effect social proof, or informational social influence: when we are unsure how to act, we copy what other people do, on the assumption that they know something we do not. Two conditions make it stronger. One is uncertainty about the right answer. The other is similarity, the sense that the people we are watching are like us.

The classic demonstration is old. In Muzafer Sherif’s experiment of 1935, people in a dark room judged how far a still point of light seemed to move, an illusion called the autokinetic effect. Alone, each person settled on a personal estimate. In groups of three, the estimates converged on a common answer, and people kept the group’s answer when tested alone again afterwards. Each had treated the others as evidence about something none of them could check.

A shop page recreates that dark room. You cannot see the other customers. You do not know whether the kettle is popular or whether the size you want is about to run out. Into that uncertainty the notice drops a single figure that sounds like evidence. That is why it works, and it is also why it matters so much whether the figure is real.

The UK Competition and Markets Authority makes the same point in its discussion paper on online choice architecture. It describes demand claims such as “25 customers are looking at this product” alongside supply claims such as “only 2 left!”. Where such claims are true, it says, they can help a shopper avoid missing a genuinely scarce product. Where they are false or misleading, they put undue pressure on people to act.

How often the crowd is invented

We have one careful count. In 2019 a team of seven researchers crawled about 53,000 product pages on about 11,000 shopping websites, looking for interface tricks. They found 1,818 instances of what they called dark patterns. Among them were 313 activity notifications: the “someone just bought this” pop-ups, the “35 people added this to their cart” lines, the viewer counts.

They then read the page code behind those notifications. They counted 29 deceptive activity notifications on 20 websites. Most of these produced their numbers with a random number generator; others replayed a fixed list of earlier messages that never changed. One site attached invented names and towns to an unchanging list of products that were always “just sold”. The researchers also found 22 outside companies selling such patterns as ready-made services.

That figure of 29 of 313 needs care, and the authors give it. They set aside every notification whose numbers were produced on the server, because from outside they could not tell whether those were genuine. So the count is a floor on deception, not an estimate of it. What it does show is that the faking is not hypothetical, and that it is easy to spot in the code once you look.

What regulators say, and where

In the United States, the Federal Trade Commission published a staff report in September 2022 called Bringing Dark Patterns to Light. Its appendix lists, under endorsements or social proof, a pattern named “False Activity Messages”: making false claims about others’ activity on a site or interest in a product. Its example is “24 other people are viewing this listing”. Under scarcity it also lists false high demand messages and false low stock messages. A staff report is not a rule, but it ends with a plain warning: where such practices break the laws the agency enforces, it will continue to take action.

The FTC’s Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, goes further in one narrow area. Section 465.8 bars buying or selling fake indicators of social media influence, meaning followers, views, likes and similar metrics generated by bots or otherwise not reflecting real activity, when the person knew or should have known they were fake and they are used for a commercial purpose. That section is about social media metrics; a notice on your own shop is not squarely inside it. The direction of travel is still clear.

In the European Union, the Commission’s 2021 guidance on the Unfair Commercial Practices Directive says that any manipulative practice that materially distorts the decisions of an average consumer can breach the trader’s duty of professional diligence. It notes that creating urgency by falsely claiming limited availability is banned in all circumstances, and names fake timers and limited stock claims on websites as examples. Giving inaccurate information on market conditions to push a purchase is on the same list. None of this is legal advice, and other countries have their own rules.

What an honest, polite notice needs

Strip the trick away and an honest version is not hard to describe. It needs four things, and each one closes a specific way of misleading.

First, a real source. The number must come from the shop’s own records, counted by the shop’s own system, and the notice must have no way to produce a number on its own. In practice that means a small data file written by the server, either into the page or at an address on the same site, and a script that refuses anything malformed. No data, wrong shape, a timestamp from the future, or data older than a limit the owner sets: the honest notice shows nothing at all.

Second, a period. “37 orders” says nothing. “37 orders in the last 24 hours” is a claim someone can check. The CMA investigated booking sites partly over this: whether viewer counts included people searching other dates or rooms, and whether vague words like “right now” hid what was being counted. A count without its period is a number without a meaning.

Third, a floor. Below some size, a figure stops being reassuring and starts being a broadcast about one person. “1 person bought this an hour ago” tells everyone that a particular customer acted at a particular time. A floor set by the owner, below which nothing is said, removes that and also removes the faintly desperate notice that boasts about two sales.

Fourth, no personal data. This one is not a matter of taste. The European data protection regulation defines personal data as anything about an identifiable person, and names a name and location data among the things that identify. “A shopper from your town just bought this” fails that test twice. An honest notice has no field for a name or a place, so it cannot leak one, and it cannot pretend to have one either.

The notice is advisory, so it should behave like advice. The WAI-ARIA standard has a role for exactly this, the status role, described as advisory information that is not important enough to justify an alert. Authors should make sure a status never takes keyboard focus when it changes. Screen readers treat it as a polite live region and read it when the person pauses, not in the middle of whatever they were doing.

WCAG 2.2 adds the rest. Success criterion 4.1.3 asks that status messages reach assistive technology without receiving focus. Criterion 2.2.2 asks that auto-updating information starting by itself can be paused, stopped or hidden, which is why a real dismiss button matters and why dismissing should silence the notice for the rest of the visit. Criterion 2.4.11 asks that a focused control is never entirely hidden by author content, so a corner notice must step aside rather than sit on the button someone is about to press. Text needs a contrast of at least 4.5:1.

Wording matters too, and languages count differently. English needs two forms, one order and two orders. Arabic distinguishes zero, one, two, few, many and other, and the browser’s Intl.PluralRules object reports which form a number takes in each language. The owner writes every form in their own words; the time since an event can come from Intl.RelativeTimeFormat, which writes phrases such as “14 minutes ago” in the page’s language.

A worked example, and what it cannot do

Take the example the tool opens with. The data says 37 orders in the last 24 hours, 3 sign-ups in the last 168 hours, a last order 14 minutes before now, and 12 units of one item in stock. The floor is 5 and the limit is two notices per page view. The first notice reads “37 orders placed in the last 24 hours”. The sign-ups are under the floor, so they are not announced. The second notice reads “Most recent order: 14 minutes ago”. The stock line passes every check but is not reached, because the limit is two.

Now change one thing. Make the data 31 minutes old with a freshness limit of 30, or add a field holding a buyer’s name, and the whole file is refused. Nothing appears, and one line in the browser console tells the owner why.

The method has limits, and they are worth stating. The notice can prove that a number came from the data file. It cannot prove that the data file is true. An owner who writes “1,000 orders” into the server by hand defeats it completely, and no script running in a visitor’s browser can detect that. It also says nothing about whether such notices raise sales for any given shop. What it offers is narrower: if the figures you hold are real, the visitor sees them with their period, above a floor, without anyone’s name, and without being interrupted. That is the whole of the claim, and it is enough.