Dark Patterns in App Design: Manipulative UX, Hidden Charges in E-Commerce Businesses in India
Introduction : Each extra click that consumers have to take to cancel a subscription, each pre-ticked checkbox that puts an object in a shopping cart, every countdown timer that creates urgency when it does not exist is now a regulatory concern, not a design decision. Academics and regulators call these "dark patterns" because they are interface strategies designed for conversion, retention, and revenue, not clarity.
In this blog, the legal framework of dark patterns in app and web design is explored, focusing mainly on: subscription patterns that are easy to join and hard to cancel; hidden costs only revealed towards the end of the purchase process; and tricks in the user experience that make it harder for users to make informed decisions.
Legal Provisions
A. Consumer Protection Act, 2019
The Consumer Protection Act, 2019 provides the basis of legislation for the control of Dark Pattern in India. Although Section 2(47) only includes those conditions which significantly affect a consumer's rights unfavourably, Section 2(28) is sufficiently broad to encompass false claims and the failure to disclose material facts. The Central Consumer Protection Authority (CCPA) has the authority to protect consumer rights, prevent unfair trade practices and prescribe guidelines, as per Section 18 of the Act, which led to the introduction of the dark patterns framework referred to above.
B. Guidelines for Prevention and Regulation of Dark Patterns, 2023
The CCPA has issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023, on November 30, 2023. The Guidelines define a 'dark pattern' as any practice or deceptive UI/UX interaction that tricks a consumer into making a choice they would not have made if they had not encountered it, or had not been led to it by the practice. This is a misleading advertisement, an unfair trade or a breach of consumer rights. The Guidelines are not intended to replace, but rather coexist with, other applicable laws, such as laws in the sectoral field.
C. The Consumer Protection (E-Commerce) Rules, 2020
The E-Commerce Rules, 2020 prescribe the disclosures of all the notices, pricing and terms at the point of sale for marketplace and inventory e-commerce entities separately. They also ban practices like changing search results, rejecting returns or refunds under certain circumstances. The disclosure-based reasoning of the Dark Patterns Guidelines, especially with regard to pricing transparency, is reinforced by these duties, which also significantly overlap with it.
D. Digital Personal Data Protection Act, 2023
The consent standard of the Digital Personal Data Protection Act, 2023 (DPDP Act) also applies to the use of dark patterns in consent architecture, such as a cookie banner that makes it easy to click accept all and hard to click reject. This criterion is difficult to reconcile with a consent interface that is intended to prevent a true "no" response, leading to a double exposure under consumer and data protection law.
E. Comparative Framework
In the United States, enforcement of dark patterns has been primarily handled by the United States Federal Trade Commission (FTC) through its Section 5 of the FTC Act (Unfair and Deceptive Acts and Practices) and the Restore Online Shoppers' Confidence Act (ROSCA), which include disclosure and consent requirements for negative-option and automatically renewing subscriptions. Platform design that significantly impairs a user's capacity to make free and informed decisions is forbidden in the EU by the Unfair Commercial Practices Directive and, more recently, the Digital Services Act. Though more modern, India's system is conceptually the same but considers manipulative design as an unfair trade practice instead of an independent tort.
Legal Analysis
Many dark patterns are not deceptive but rather are designed to influence the user's decision to choose a platform that is advantageous for the platform. All these are types of confirm-shaming language that leaves the user feeling bad for rejecting an offer, interface interference that makes the option a reasonable user would want not to seem that important and nagging that re-prompts the rejected action. The legal implications are that there is no requirement for there to be an actual misrepresentation for liability to arise under Indian law (as defined in the CCPA Guidelines), shifting the analysis from whether there was an actual misrepresentation to whether the choice architecture is unfair. This is a much lower standard than misrepresentation as is and one that app designers will fail to consider; the elements of the UI may all be defendable individually, but the composite may cause the user to come to a different conclusion.
Hidden Charges and Duty of Upfront Disclosure
Drip pricing is when the headline price is low and extra required fees are added along the way in the shopping cart, and is explicitly addressed by the disclosure provisions in the CCPA Guidelines as well as the E-Commerce Rules, 2020. Platform fees and any other charge associated with a transaction, but not an optional extra feature, are now part of the transaction fee that should be paid upfront, and are a legal obstacle for platforms. The timing of the disclosure is an important factor in the enforcement action against quick commerce and e-commerce platforms for drip pricing and ‘basket sneaking' – pre-selection of paid add-ons that the consumer must actively deselect – not just the fact that it will happen at some point.
Check the default selections and pre-ticked boxes
If a checkbox, add-on or donation is checked for the consumer, it is presumed to be non-compliant under the ‘basket sneaking' category unless there is a documented, defensible basis for the default and an equally prominent opt-out.
Urgency and Scarcity Claims
Countdown timers and low-stock indicators should be based on real and verifiable data at the time they are displayed, and legal teams should ask engineering to verify the data source before these elements are shipped.
Match Consent Interfaces with the DPDP Standard
Consent banners and prompts for permissions should be equally visible with 'accept' and 'reject' options, and shouldn't have a friction differential that makes it easier to accept than to reject, and should not include pre-checked consent.
Ensure a Dark-Patterns Risk Register is kept
The legal teams should keep a register that correlates each of the thirteen CCPA-identified dark patterns with the platforms' current interfaces, and be prepared to prove that they comply with the law when requested to do so by a regulator, rather than having to try to recreate the interfaces after receiving a notice.
Educate Product and Growth Teams about Legal Thresholds
Periodic training of product managers and UX designers about the CCPA Guidelines and similar foreign standards helps to minimise the risk of a dark pattern being shipped and scaled out of legal sight as a result of growth experimentation.
Conclusion
In India and in similar jurisdictions, dark patterns have clearly transitioned from a design-ethics conversation to a legally enforceable standard. The CCPA's Guidelines for Prevention and Regulation of Dark Practices, 2023 provides regulators with a taxonomy of thirteen manipulative practices which has since been enforced in recent instances – one being a reasoned penalty order issued to a major edtech platform and the other, coordinated action involving e-commerce, quick-commerce and aviation platforms. As the FTC's settlement with Amazon makes clear, the potential liability for a subscription trap can reach billions of dollars, even in an established regulatory framework.
In the case of Indian digital businesses, the take-home message is that interface design decisions made by the product and growth teams now have a direct legal impact, and compliance can't be done after the regulator's notice is received. Only if these predatory practices are avoided in the first instance, and fair-trading practices are followed, can the online e-commerce space effectively continue to protect its customers.
Author: Aditi Kalluri in case of any queries please contact/write back to us via email to content@khuranaandkhurana.com or at Khurana & Khurana, Advocates and IP Attorney
References (Endnotes)
Consumer Protection Act, 2019, ss. 2(28), 2(47), 18 (India).
Central Consumer Protection Authority, Guidelines for Prevention and Regulation of Dark Patterns, 2023, F. No. J-24/34/2023-CPU (Reg.), notified 30 November 2023 (India).
Consumer Protection (E-Commerce) Rules, 2020 (India).
Digital Personal Data Protection Act, 2023, s. 6 (India).
Federal Trade Commission Act, 15 U.S.C. § 45 (United States).
Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. §§ 8401-8405 (United States).
Directive 2005/29/EC concerning Unfair Commercial Practices (European Union).
Regulation (EU) 2022/2065, Digital Services Act, art. 25 (European Union).
Central Consumer Protection Authority v. PhysicsWallah Limited, Case No. CCPA-2/94/2025-CCPA, Order dated 1 June 2026 (India).
Ministry of Consumer Affairs, Food and Public Distribution, Reply to Rajya Sabha Unstarred Question on Dark Patterns, August 2026 (India).
Federal Trade Commission v. Amazon.com, Inc., No. 2:23-cv-00932 (W.D. Wash., settled 25 September 2025) (United States).
Central Consumer Protection Authority, Advisory to E-Commerce Platforms on Self-Audit of Dark Patterns, 5 June 2025 (India).
Rahul Matthan, 'India's Dark Patterns Guidelines: A Welcome but Soft Start,' Mint, 2024.
Comments