Dark Patterns As A Corporate Governance Issue: Why Governance Must Begin Within The Business

I. Introduction

A consumer books a service online at a price that appears final, only to discover at checkout that an additional amount has already been added, a subscription has been selected by default, or the option to refuse has been made less visible than the option the platform prefers. The consumer may technically remain free to click “no”, but the interface has already shaped the decision. This is the basic concern behind dark patterns, which use design and choice architecture to steer, deceive or pressure users into decisions they may not otherwise have taken.

Recognizing the risks that such practices pose to informed consumer choice, the Central Consumer Protection Authority (“CCPA”) issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023, on 30 November 2023, identifying thirteen specified dark patterns including false urgency, basket sneaking, confirm shaming, forced action, subscription traps, interface interference and drip pricing. Actively enforcing the mandate, the CCPA has imposed penalties on companies such as PhysicsWallah, McAfee, SpiceJet, and Rapido for consumer-facing practices found to involve dark patterns.

Sectoral regulators have also begun addressing dark patterns directly. On 15 June 2026, RBI issued the series of Responsible Business Conduct (Second Amendment) Directions, 2026, for commercial banks, NBFCs and other RBI-regulated entities, effective from 1 January 2027, which specifically addresses dark patterns in the context of mis-selling, by requiring such regulated entities to ensure that their interfaces do not deploy dark patterns. Thereafter, on 09 September 2026, the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, also effective from 1 January 2027, required e-commerce entities to comply with the guidelines issued by CCPA, undertake annual self-audits and prominently display a certificate of compliance.

More recently, in its consultation paper dated 23 September 2026 titled “Recalibrating Economics of Insurance Distribution – Part 1, Distribution Reforms”, the Insurance Regulatory and Development Authority of India proposed prohibiting dark patterns under insurance regulations and identified requiring consumers to provide personal details merely to access product features and pricing details as one such practice. It further proposed that such information should be made available without seeking personal details and that access to it should not be used as a lead-generation opportunity.

These developments are usually discussed as consumer-protection enforcement; however, they also expose a deeper failure in a company’s corporate governance framework.

A dark pattern is not merely an interface feature ultimately seen by the consumer; it is the outcome of decisions made within the business itself. These decisions include target design, the means to achieve them, the customer journey, the presentation of prices and choices, how consent is obtained, how subscriptions are renewed, how complaints are handled, and how changes to digital interfaces are approved.

When companies implement such decisions without adequate internal review, oversight, and accountability, the resulting consumer harm reflects not only a breach of consumer-protection requirements but also a failure of the company’s governance framework.

Therefore, this article’s central proposition is simple. Because companies create the consumer interface for their business, governance against dark patterns must be embedded into how business is done.

The objective is to ensure that business, product, technology, legal, and compliance teams operate within a system design that strikes a critical balance between aggressive growth objectives and consumer autonomy. In their pursuit of more users and scaled services, businesses must align their choice architecture with consumer rights.

The article therefore examines the consumer problem, the governance failure behind it, the structures available to listed and unlisted companies, and how those structures can be used effectively.

II. The Consumer Problem: When Design Distorts Choice

 For consumers, the concern with dark patterns lies in the way they can distort the conditions in which a decision is made. The interface may create confusion about what is being agreed to, increase the effort required to refuse or exit, obscure important information, or place pressure on the consumer to act quickly, with the result that the eventual choice does not reflect a fully informed and voluntary decision.

Therefore, the problem is not merely that the interface is inconvenient, but that its design can materially affect the consumer’s ability to understand, compare and exercise available choices.

Psychologists Daniel Kahneman and Amos Tversky have demonstrated through their work on heuristics and cognitive biases that people often rely on mental shortcuts when making decisions under uncertainty. Dark patterns exploit familiar tendencies such as default bias, scarcity, loss aversion and social proof, making the consumer’s formal ability to choose different from the consumer’s practical ability to make a free and informed choice.

To illustrate, recent CCPA orders provide practical examples. In the PhysicsWallah matter, a Rs. 10 donation to the PW Foundation was pre-selected and added at checkout without the consumer's affirmative choice, while attempts to remove it were accompanied by emotionally framed messages about children’s education and healthcare. The CCPA, vide order dated 01 June 2026, treated these practices, inter alia, as basket sneaking and confirm shaming, since the consumer had to first notice the additional charge and then actively reject a choice already made by the interface.

A similar concern arose in the matter of McAfee concerning subscription renewal, where consumers were presented with choices such as “Renew Now” Or “Accept Risk” instead of a neutral option to renew or decline renewal. The way the alternatives were framed made non-renewal appear inherently unsafe rather than simply another available choice. By its order dated May 20, 2026, the CCPA treated the practice as involving confirm shaming, interface interference, trick question and forced action.

These cases matter because a consumer may technically be free to choose, but that freedom becomes less meaningful when interface architecture adds, conceals, pressures, or frames choices in ways that influence the consumer’s decision.

III. Why Dark Patterns Are Governance Issues

Dark patterns become a governance issue when a company fails to supervise the consumer interface throughout its life cycle.

An existing website, application or consumer journey itself become a governance concern where it remains operational without periodic review. Pricing, default settings, consent, subscriptions, cancellation or the presentation of information continue in a form that creates or facilitates a dark pattern, yet the company do not revisit the interface merely because it has already been deployed.

Even if the company revisits, governance also fails when changes to an existing consumer journey are implemented without a coordinated review across product, technology, marketing, operations and legal or compliance functions. Each team examine only its own part of the change, while no one assesses the combined effect on the consumer, and legal or compliance review occur only after the design has substantially been fixed or no legal or compliance review at all.

A similar weakness arises with a new website, application or consumer interface where governance is not built into the planning, design and development process before launch.

The way performance is measured and rewarded within the business compound these weaknesses. Where product, sales or marketing teams are assessed primarily on conversions, renewals, engagement or revenue without corresponding safeguards for consumer choice and compliance, design decisions become oriented towards pushing a preferred outcome rather than preserving a neutral consumer journey.

Consumer complaints and internal concerns provide another indication of whether the governance framework is functioning effectively. Repeated complaints about hidden charges, unwanted subscriptions, difficult cancellation or confusing consent, or concerns raised by employees, reveal a wider problem, but the risk remain unaddressed when such information is not escalated beyond the team that first receives it. Therefore, dark patterns reflect more than a design defect. They expose a failure of governance because a company do not adequately review and monitor the business processes itself that shape the consumer-facing interface.

IV. The Existing Governance Architecture

Dark patterns are addressed under the CCPA’s Guidelines for Prevention and Regulation of Dark Patterns, 2023. What is not presently prescribed for companies (either listed or unlisted) is a standalone corporate-governance framework specifically addressing internal oversight of dark-pattern risk. Nevertheless, the existing provisions of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (“LODR”) already contain certain oversight structures and mechanisms that can support companies in identifying, reviewing and addressing such risks until a specific governance framework is introduced.

The architecture could be wider than what is set out below; however, the table below gives only a start point, focusing on the Board of Directors and the Risk Management Committee (“RMC”) because their risk-management functions are most directly relevant to enterprise-level oversight of material dark-pattern risk.

The effectiveness of the above structures in addressing dark-pattern risks depends on how closely they are integrated with the company’s day-to-day business processes. Material or recurring dark pattern risks identified through product reviews, compliance checks or consumer complaints should be capable of being escalated to RMC or the Board of Directors where the nature or seriousness of the issue so warrants because the objective is to ensure that the existing governance architecture operates as an effective system of oversight rather than remaining merely a formal institutional arrangement.

However, internal oversight is only one part of the governance framework. Where the applicable regulatory framework also requires consumer-related reporting, the company must ensure that issues identified through its governance processes are appropriately reflected in its disclosures.

For listed entities covered by the Business Responsibility and Sustainability Report (“BRSR”) framework, Regulation 34(2)(f) of the LODR requires the top 1,000 listed entities by market capitalization to include BRSR disclosures in their annual reports in the format specified by SEBI. Principle 9 of the BRSR format, inter alia, requires disclosure of the number of consumer complaints received or pending during the year in relation to advertising, restrictive trade practices and unfair trade practices, as well as the mechanisms available for receiving and responding to consumer complaints.

In the context of dark patterns, complaints that do not squarely fall within the specifically identified categories may be captured under the “Others” category in the said BRSR format. This enables listed entities to capture dark-pattern related complaints within their consumer-complaint disclosures and provide visibility on the number of such complaints received and pending during the reporting period.

Therefore, governance and reporting serve distinct but complementary functions. A company may identify and correct a dark-pattern issue internally, but where the applicable framework requires disclosure of a reportable consumer complaint or related information, internal correction does not dispense with that reporting obligation. Good governance requires both effective internal management of dark pattern risk and transparent compliance with applicable disclosure requirements.

V. What Companies Should Do: Governance Before the Interface Reaches the Consumer

What companies should do is ensure that dark-pattern risks are governed at every stage at which consumer-facing interfaces are designed, modified, reviewed or operated.

Firstly, companies should review their existing websites, applications and consumer journeys to identify whether any current pricing, checkout, subscription, renewal, consent, cancellation or other interface feature involves or facilitates a dark pattern. Where a problematic feature is identified, the company should modify or remove the relevant design, disclosure, default setting, consent flow or transaction step, as the case may be, and re-test the revised interface to ensure that the consumer is presented with a clear, neutral and informed choice.

Secondly, where an existing website, application or consumer journey is modified, the change should be brought within a defined governance process before deployment, with the company identifying and assessing all risks associated with the proposed modification/ change. The relevant business or product team should be identified, legal or compliance should be involved where required, and the review and approval should be documented so that the modification does not introduce a dark pattern or otherwise compromise the existing interface.

Thirdly, for a new website, application or consumer interface, governance should begin at the planning and design stage by again identifying all the risk areas such as pricing, checkout, subscriptions, renewals, consent and cancellation and by setting out who is responsible for reviewing them and what standards apply.

Furthermore, governance should continue while the new interface is being designed and developed, with the business, product, design and technology teams working at each stage within the identified standards and legal or compliance review being built into the process rather than left until the end. Before launch, the interface should be tested to ensure, inter alia, that the total price is visible, optional items require affirmative choice, refusal is as clear as acceptance, cancellation is not made harder than sign-up, urgency claims are genuine and important information is disclosed before commitment.

Fourthly, companies should maintain an audit trail throughout the above process by recording the individual/ team responsible for proposing and implementing the change, approvals obtained and the basis on which the design was considered compliant. This is particularly important in digital businesses, where consumer journeys change frequently through experiments, software releases and configuration changes.

Fifthly, companies should make effective use of their existing governance structures (as mentioned in table above) and ensure compliance with applicable reporting requirements.

Finally, self-audit should become a continuing process rather than a one-time exercise.

VI. Conclusion

Dark patterns become visible as a consumer problem, but they begin as a business-governance problem. The consumer sees a pre-ticked box, hidden fee, difficult cancellation path or manipulative prompt; behind that interface lies a chain of corporate decisions about design, implementation, approval, and correction.

Good governance must therefore operate before the process begins, continue while the product or consumer journey is being designed or modified, apply at the point of launch, and remain active afterwards through monitoring, escalation, audit and reporting. A compliance review conducted only after the interface is complete, or after complaints arise, cannot substitute for governance embedded throughout the life cycle of the business process.

The broader lesson is that good governance is above and beyond the bare letter of law. A company cannot wait for a dark-pattern-specific corporate governance code before using the structures already available to them to identify, report, escalate and correct dark pattern risks.

Good governance requires a company to go beyond minimum legal compliance and proactively strengthen its internal processes wherever existing practices can affect consumers, stakeholders or the integrity of the business. In that sense, governance reflects a step-up approach, where the company uses the structures already available to it, identifies emerging risks early and adopts safeguards even before the law expressly mandates them. The objective is not to convert every dark pattern into an LODR or Companies Act violation, but to ensure that consumer facing risks are governed early enough to prevent avoidable harm and are reported transparently where the applicable framework requires it.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.