CCPA Dark Pattern Guidelines and the DPDP Act, 2023: How Indian Law Now Tests Online Consent Twice

Peshal Dutta @AgreyaLegal | Data Protection Practice

Introduction

Imagine opening an app to book an airline ticket. You enter your details, choose your preferences and proceed to checkout. Just before you pay, you notice something extra: travel insurance quietly added to your bill, a non-refundable donation pre-selected, and a countdown timer warning that only two seats remain at this price. When you try to remove these add-ons, the button reads, “No thanks, I prefer taking risks.”

None of this is accidental. These are carefully engineered (deliberately designed) psychological nudges, known in design circles as “dark patterns”. As digital access becomes inseparable from daily life in India, two legal frameworks now converge (meet and work together) on the problem: the Central Consumer Protection Authority’s (CCPA) Guidelines for Prevention and Regulation of Dark Patterns, 2023 and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Together, they form a dual line of defence. The Guidelines police how a choice is presented to the consumer; the DPDP Act scrutinises (examines closely) whether the consent behind that choice is genuine. The maxim fraus omnia corrumpit(fraud unravels everything) captures their shared principle: consent procured by deception is no consent at all.

Deconstructing Dark Patterns: The CCPA Framework

The CCPA notified the Guidelines on 30 November 2023 under Section 18 of the Consumer Protection Act, 2019. They took effect on publication in the Official Gazette.

Paragraph 2(1)(e) of the Guidelines defines dark patterns as deceptive design practices built into a user interface (UI) or user experience (UX) that mislead or trick users into doing something they did not originally intend, by subverting or impairing consumer autonomy, decision-making or choice, and which amount to a misleading advertisement, an unfair trade practice or a violation of consumer rights.

Paragraph 3 extends the Guidelines to all platforms systematically offering goods or services in India, as well as to advertisers and sellers. Paragraph 4 prohibits any person, including a platform, from engaging in a dark pattern practice. Paragraph 5 treats the 13 practices listed in Annexure 1 as “specified dark patterns”, among them false urgency, basket sneaking, confirm shaming, forced action, subscription traps, interface interference, nagging, trick questions and rogue malware. Crucially, Paragraph 6 provides that the Guidelines operate in addition to, and not in derogation of (without reducing or overriding), any other law for the time being in force.

The Dual Consent Test

Indian law now tests online consent twice.

The first test sits in consumer law. Rule 4(9) of the Consumer Protection (E-Commerce) Rules, 2020 requires an e-commerce entity to record a consumer’s consent for a purchase only where it is expressed through an explicit and affirmative action. Consent must never be recorded automatically, and pre-ticked checkboxes are specifically barred. The CCPA’s Advisory dated 5 June 2025 reinforces this baseline by calling upon platforms to identify and eliminate such practices.

The second test sits in data protection law, and it asks a different question entirely: is the consent to process personal data real? Section 6(1) of the DPDP Act requires consent to be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Section 6(4) adds that withdrawing consent must be as easy as giving it. Breaches attract penalties under Section 33 read with the Schedule: up to ₹50 crore for breaches of general obligations such as consent, and up to ₹250 crore at the top of the scale for failures in reasonable security safeguards. These substantive obligations become enforceable in May 2027, eighteen months after the DPDP Rules, 2025 were notified on 13 November 2025.

The two tests are distinct and guard different decisions. Rule 4(9) protects the consumer’s decision to pay; Section 6 protects the more fundamental decision to share personal data. The maxim volenti non fit injuria (no wrong is done to one who consents) holds good only where consent is genuinely volitional (freely willed), and both regimes now write that principle into the screen itself.

Regulatory Overlap: Where Do the Two Meet?

The official illustrations in Annexure 1 of the Guidelines show how closely the two regimes overlap:

1. Forced action: Several illustrations concern personal data, such as compelling a user to share Aadhaar or card details not needed for the transaction, forcing a user to upload contacts to access a product, and making privacy settings difficult to understand or change. Consent extracted in this manner can hardly be called “unconditional”, since the user gives it only to gain access. These illustrations collide directly with the DPDP Act’s requirement that collection be confined to what is necessary for the specified purpose.

2. Nagging: The illustrations include repeatedly asking for personal details on the pretext (false excuse) of security, and pushing cookie or notification prompts with no option to decline. A user who cannot refuse cannot be said to consent “freely”.

3. Interface interference: A faint, light-coloured “No”, a cancellation link in tiny font, or other ambiguous options. Each tilts the choice, undermines the “unambiguous” requirement and frustrates easy withdrawal.

4. Basket sneaking and subscription traps: The Guidelines treat auto-added paid extras, including those added through a pre-ticked box, as basket sneaking. Making cancellation impossible, hidden or cumbersome (unnecessarily difficult) is a subscription trap, which mirrors the DPDP Act’s duty under Section 6(4) to make withdrawal as easy as giving consent.

Enforcement Today

The CCPA is already acting. Its Advisory dated 5 June 2025, issued under Section 18 of the Consumer Protection Act, records that dark patterns persist on e-commerce platforms despite the Guidelines, and that notices have been issued in certain cases. It advised every e-commerce platform to conduct a self-audit within three months and to take the steps necessary to rid its platform of dark patterns. Platforms were also encouraged to give self-declarations based on those audits to build consumer trust.

Finally, the CCPA asked e-commerce platforms, industry associations, voluntary consumer organisations and academic institutions to disseminate (spread) the Advisory widely. That is a clear signal that the CCPA regards dark patterns as a pervasive (widespread) problem demanding an industry-wide response.

The Road Ahead: Convergence and Joint Implementation

The regulatory net is tightening quickly. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026, notified on 9 September 2026 and effective from 1 January 2027, convert the voluntary self-audit into a binding duty. New Rule 4(15) requires every e-commerce entity to comply with the Guidelines, conduct a yearly self-audit and prominently display a compliance certificate.

Further, new Rule 5(6) bars marketplace e-commerce entities from using information collected on their platforms to promote their own goods, or to project any seller as “associated” with them, without the express and affirmative consent of the consumer concerned (see analysis). This mirrors the DPDP Act’s insistence on a clear affirmative action.

The consequences under consumer law are already real. Under Section 20 of the Consumer Protection Act, 2019, the CCPA may order the discontinuance of unfair trade practices prejudicial to consumers’ interests. Under Section 88, failure to comply with such a direction is punishable with imprisonment of up to six months, a fine of up to ₹20 lakh, or both. On the data protection side, non-compliance with consent requirements and purpose limitation may invite substantial penalties under Section 33 of the DPDP Act.

Neither regime displaces the other. Paragraph 6 of the Guidelines and Section 38(1) of the DPDP Act both declare that they operate in addition to, and not in derogation of, other laws. In practice, consumer law governs how a choice is presented, while data protection law will govern the consent behind it from May 2027. A single consent screen may therefore be examined by two authorities against two sets of rules.

One caveat remains. The Data Protection Board of India was established in law on 13 November 2025, but its Chairperson and Members had reportedly not been appointed as of August 2026, and the Board is designed as an adjudicator rather than a regulator. Once it is fully constituted, the combined oversight of the CCPA and the Board will form a formidable (powerful) safeguard for consumer choice and consent.

Conclusion

The CCPA Guidelines ask whether a choice was presented fairly; the DPDP Act asks whether the consent behind it is untainted. Businesses already aligning with the Guidelines will have covered much of what the DPDP Act demands of free consent. The remaining diligence is a change of mindset: treat every consent screen as a legally binding document, because that is precisely how regulators will read it.

AgreyaLegal’s data protection team helps businesses audit user journeys, consent flows and privacy notices against both frameworks, before a regulator does it for them.

Frequently Asked Questions

1. Is the list of dark patterns in the Guidelines exhaustive?

No. Annexure 1 lists 13 specified dark patterns, and the CCPA may specify more. The illustrations are for guidance only, and in a dispute over interpretation the CCPA’s decision prevails. A design that is not on the list can still be challenged under the general definition in Paragraph 2(1)(e).

2. Does clicking “Accept” amount to valid consent under the DPDP Act, 2023?

Not automatically. A click is only one element. Section 6(1) also requires consent to be free, specific, informed, unconditional and unambiguous. Whether a platform meets that standard depends on its design and the facts, and will be decided case by case.

3. Do the Dark Pattern Guidelines apply only to large e-commerce marketplaces?

No. Paragraph 3 applies the Guidelines to all platforms systematically offering goods or services in India, as well as to advertisers and sellers, with no threshold of turnover, influence or user base. Rule 3(1)(i) of the Consumer Protection (E-Commerce) Rules, 2020 likewise defines a “platform” broadly as an online interface in the form of any software, again without any size criterion.

4. When do the DPDP Act’s consent obligations become enforceable?

The substantive obligations, including the consent requirements under Section 6 and the penalty regime under Section 33, become enforceable in May 2027, eighteen months after the DPDP Rules, 2025 were notified.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts