Dark patterns: what India's consumer regulator bans in apps

Dark patterns are interface designs that steer, trick or pressure people. A pre-ticked box that adds insurance to a cart, a countdown timer that is not real, or a cancel button hidden five screens deep are common examples. The word 'dark' refers to the intent: the design serves the business at the cost of the user's free choice.

Indian regulators treat these as unfair trade practices. A live case is Ola, a ride-hailing app run by ANI Technologies, where the consumer regulator ordered the removal of an advance tipping prompt and imposed a ₹10 lakh fine, according to reports of the order.

The Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified by the CCPA on 30 November 2023 under section 18 of the Consumer Protection Act, 2019, name 13 patterns. They apply to all platforms that offer goods or services in India, as well as advertisers and sellers, whether they are Indian or foreign.

The list is not meant to be closed, since the guidelines say any design that fits the definition counts.

• False urgency: a fake timer or claim that stock is running out.
• Basket sneaking: adding items or charges during checkout without consent.
• Confirm shaming: wording that guilt-trips a user who declines.
• Forced action: requiring an unrelated step, such as sharing data, to get a service.
• Subscription trap: easy sign-up but hidden or difficult cancellation.
• Interface interference: hiding or highlighting options to misdirect.
• Bait and switch: advertising one outcome and delivering another.
• Drip pricing: revealing extra charges late in checkout.
• Disguised advertisement: ads made to look like content.
• Nagging: repeated requests that disrupt the user.
• Trick question: confusing wording to lead to a wrong choice.
• SaaS billing: charging a subscription in ways that are hidden or unclear.
• Rogue malwares: software or ransomware used to coerce payment.

The CCPA is set up under the Consumer Protection Act, 2019, and has powers to inquire into unfair trade practices, order a business to stop and withdraw a practice, and refund consumers. It can also fine a business. In several 2026 reports, the authority fined digital platforms over deceptive design, with amounts that vary by case.

The guidelines themselves do not fix a penalty. Penalty sections of the Act, such as those for misleading advertisements, are used in orders, and the amount depends on the facts. Court appeals are available.

Enforcement has widened since the guidelines took effect. In May 2025 the consumer affairs ministry sent notices to a group of companies, and the authority asked platforms to audit their own interfaces. Reports through 2026 describe fines on several digital platforms. Each order turns on its own facts, so a pattern that one order accepted as acceptable design may be judged differently on another screen.

A company that gets a notice usually replies with its design history, explains the user flow and offers changes. Early cooperation and a prompt fix tend to shape the outcome.

A consumer can complain through the National Consumer Helpline, the government's consumer portal, or to the CCPA directly. The authority can also act on its own and has issued notices to many companies. The company usually has to reply, may be asked to fix its design, and may have to file a compliance report within a set time.

Companies are also encouraged to audit their own apps for dark patterns and to publish a declaration of compliance.

Consumers can also help themselves. Screenshots of the screen, the booking confirmation and the price at each step make a complaint much stronger. Many orders begin with a pile of similar complaints on the helpline, which is why a single clear record is valuable.

Growth teams often test designs that raise conversions, such as timers, default add-ons and nudges. Some of these cross the line. Getting a CCPA notice can lead to a fine, a forced redesign and press coverage, and it can affect an investor's view of a business or a DRHP's risk disclosures.

Sectors with heavy checkout flows, such as food delivery, quick commerce, travel booking, ride-hailing and ticketing, receive more attention. Building consent-aware design from the start costs less than fixing it after an order.

Dark patterns also overlap with privacy design, because a consent screen can itself be a dark pattern. The Digital Personal Data Protection (DPDP) Act, 2023, regulates how personal data is collected and requires clear consent. The CCPA guidelines deal with consumer choice in general. An app can break both rules with one screen.

The consumer law is enforced by the CCPA, and the data law by the Data Protection Board once the rules are fully in force.

A simple test is to ask whether a user would feel tricked if each step were explained aloud. Show the full price early. Keep opt-in boxes unticked by default. Make cancelling as easy as signing up. Use real stock and time data for urgency messages, and word the decline button as neutrally as the accept button.

Teams can add a review step to launches, where legal or policy staff check flows against the 13 listed patterns. Keeping screenshots of old designs and their approval helps if a regulator asks later.

Disguised advertisements are one of the 13 patterns, so the rules overlap with advertising standards. A sponsored result that looks like an organic one, or an influencer post that hides its payment, can be treated as a problem under the consumer law as well as under advertising codes.

Marketplaces and apps that sell sponsored placements therefore need clear labels. Regulators also look at how an ad is shown on the page, not just the words used.

Check which of the 13 patterns is named, who ordered what, and whether the order is final or can be appealed. A fine of ₹10 lakh and an order to remove a feature are different outcomes from a notice. Also check whether the company disputes the finding.

This page is a general explainer, not legal advice, and a business should check its design with a lawyer.