CCPA’s Guidelines On Dark Patterns: An Overview

Introduction

The visual interface of ecommerce platforms increasingly influences how consumers select, purchase, subscribe to and cancel goods and services. Before the issuance of a framework specifically addressing dark patterns, the Consumer Protection Act 2019 (“Consumer Protection Act”)¹ and the Consumer Protection (E-Commerce) Rules 2020 (“E-Commerce Rules”)² already prohibited unfair trade practices in e-commerce.

The E-Commerce Rules also prescribe specific consumer safeguards³. Among other things, they require an e-commerce entity to record consent, to a purchase, only through an explicit and affirmative action, prohibit automatic consent (including through pre-ticked checkboxes), restrict asymmetric cancellation charges, and prohibit certain forms of price manipulation and discrimination between consumers of the same class.

Before the CCPA Guidelines were issued, the Advertising Standards Council of India (“ASCI”) had addressed certain dark patterns in digital advertising through its Guidelines for Online Deceptive Design Patterns in Advertising, issued on 15 June 2023 and applicable from 1 September 2023⁴. However, ASCI’s framework is self-regulatory and limited to advertising.

On 30 November 2023, the Central Consumer Protection Authority (“CCPA”), established under the Consumer Protection Act, issued the Guidelines for Prevention and Regulation of Dark Patterns 2023 (“Guidelines”). The Guidelines identify and prohibit deceptive or manipulative practices embedded in user interfaces (“UI”) and user experiences (“UX”).

On 5 June 2025, the CCPA advised e-commerce platforms to conduct self-audits within three months to identify dark patterns and take necessary remedial measures.⁵ The CCPA has also subsequently applied the Guidelines in enforcement proceedings concerning individual platforms.

Regulatory attention has recently extended to the financial-services sector. On 2 April 2026, the Insurance Regulatory and Development Authority of India (“IRDAI”) advised regulated entities offering insurance products through e-platforms to assess their compliance with the Guidelines and submit a report within 15 days⁶. Where non-compliance was identified, an action plan setting out timelines for removal was required to be submitted within one month.

Separately, on 25 May 2026, the IRDAI included the removal of dark patterns from an insurer’s public interactions, including those undertaken through distributors, as a mandatory parameter for determining the variable remuneration of Key Management Persons from FY 2026–27⁷.

The Reserve Bank of India (“RBI”) has similarly introduced requirements, effective from 1 January 2027, governing the use of dark patterns by specified regulated entities in the advertising, marketing and sale of financial products and services.⁸ On 23 June 2026, the Securities and Exchange Board of India (“SEBI”) also released a consultation paper proposing a corresponding prohibition under its proposed Common Advertisement Code for specified SEBI-regulated entities⁹.

What are “Dark Patterns?

The Guidelines apply to platforms systematically offering goods or services in India, advertisers and sellers. They prohibit any person, including a platform, from engaging in a dark pattern practice and operate in addition to, and not in derogation of, other applicable laws.

¶2(1)(e) defines “dark patterns” as practices or deceptive design patterns using UI or UX interactions on a platform that are designed to mislead or trick users into doing something they did not originally intend or want to do, by subverting or impairing consumer autonomy, decision-making or choice, and that amount to a misleading advertisement, unfair trade practice or violation of consumer rights¹⁰. ¶5 further provides that a person engaging in a practice specified in Annexure 1 will be considered to be engaging in a dark pattern practice.

Accordingly, an interface feature does not constitute a dark pattern merely because it influences a user’s choice or makes one option more prominent. Its design, purpose, presentation and effect must be considered against the applicable definition and, where relevant, the particular practice specified in Annexure 1.

The Guidelines presently identify 13 “specified dark patterns” and contemplate that the CCPA may specify additional dark patterns from time to time. The Guidelines also clarify that the illustrations accompanying these categories provide guidance only and are not a binding interpretation of law, as different facts or conditions may entail different interpretations.

Dark Pattern	Hypothetical Illustration
False Urgency: This involves falsely stating or implying urgency, scarcity or popularity to mislead a consumer into making an immediate purchase or taking an immediate action that may lead to a purchase.	This hypothetical illustration assumes that the countdown, stock and popularity claims are false or unsupported.
Basket Sneaking: This involves adding products, services or payments, such as donations, to a consumer’s cart at checkout without the consumer’s consent, so that the total amount payable exceeds the amount payable for the chosen product or service. Disclosed necessary fees, free samples and complimentary services are excluded.
Confirm Shaming: This involves using a phrase, visual, audio or other prompt to create fear, shame, ridicule or guilt and thereby nudge a consumer into purchasing a product or service, or continuing a subscription, for commercial gain.
Forced Action: This involves forcing a consumer to purchase additional goods, subscribe or sign up for an unrelated service, or share personal information in order to purchase or subscribe to the product or service originally intended.
Subscription Trap: This includes making cancellation of a paid subscription impossible, complex or lengthy; hiding the cancellation option; requiring payment details or authorisation for auto-debits to obtain a free subscription; or making cancellation instructions ambiguous, latent, confusing or cumbersome.	This hypothetical illustration assumes that the support-only process makes cancellation unnecessarily complex or lengthy.
Interface Interference: This involves using a design element to highlight certain information and obscure other relevant information, thereby misdirecting a consumer from taking a desired action.
Bait and Switch: This involves advertising a particular outcome based on a consumer’s action but deceptively providing a different outcome.	This hypothetical illustration assumes that the unavailable product was deceptively presented as available to draw the consumer into the purchase journey.
Drip Pricing: This includes withholding elements of the price upfront or revealing them surreptitiously; charging more than the amount disclosed at checkout; advertising a product or service as free without appropriately disclosing that continued use requires payment; or preventing use of an already-paid service unless something further is purchased.	;             This hypothetical illustration assumes that the payment requirement is disclosed only after the consumer selects the option advertised as free.
Disguised Advertisement: This involves presenting or masking an advertisement as another form of content, such as user-generated content or a news article, so that it blends into the interface and is not readily recognisable as an advertisement.
Nagging: This involves disrupting and annoying a consumer through repeated and persistent requests, information, options or interruptions to effect a transaction or obtain commercial gain, unless the interactions have been specifically permitted by the consumer.	This hypothetical illustration assumes that the upgrade prompt repeatedly reappears after being dismissed by the consumer.
Trick Question: This involves deliberately using confusing or vague wording, double negatives or similar techniques to misguide or misdirect a consumer from a desired action or towards a particular response.
SaaS Billing: This involves surreptitiously generating or collecting recurring payments in a software-as-a-service business model. Examples include converting a free trial into a paid subscription without notification, silent recurring transactions and auto-renewal without adequate disclosure.	This hypothetical illustration assumes that the free trial was converted into a paid subscription without prior notification.
Rogue Malwares: This involves using ransomware or scareware to mislead a consumer into believing that a device contains a virus and inducing the consumer to pay for a fake malware-removal tool which itself installs malware.	This hypothetical illustration assumes that the alert is false and directs the consumer to pay for a fraudulent removal tool which installs malware.
Disclaimer: The hypothetical mock-ups above have been created solely to illustrate how the specified practices may appear in a digital interface. They are not taken from any particular platform or from the Guidelines. Whether a particular design constitutes a dark pattern will depend on its complete factual context.

We note that dark patterns may arise at different stages of a customer journey, including advertising, product selection, checkout, subscription, renewal and cancellation. The Guidelines are concerned not only with whether information and choices are technically available, but also with how they are presented and whether the design appears to subvert or impair the autonomy, decision-making or choice of the consumer.

This may also become relevant where a digital interface is used to obtain consent for processing personal data¹¹. Once operative, we note that §6(1) of the Digital Personal Data Protection Act 2023 (“DPDP Act”) will require consent to be free, specific, informed, unconditional and unambiguous, evidenced by a clear affirmative action and limited to the personal data necessary for the specified purpose.

Once these requirements become operative, a design practice used to obtain consent for processing personal data may require consideration under both the consumer-protection and data-protection frameworks. The applicable assessment will depend on whether the respective requirements of each framework are satisfied.

Application Across Regulatory Frameworks

The Guidelines apply to digital interfaces and online interactions across the consumer journey. A compliance assessment may therefore extend to advertising, onboarding, product selection, checkout, subscription, renewal and cancellation, depending on the nature of the goods or services and the platform concerned.

For regulated entities, the Guidelines must be considered together with applicable sectoral requirements. Where a digital interaction also involves processing personal data, the consent architecture will additionally need to be assessed under the DPDP Act once the relevant provisions become operative. The same interface or practice may therefore engage consumer-protection, data protection and other sector-specific regulatory requirements.

Footnotes

^{1  §94 and §101(2)(zg) of the Consumer Protection Act.}

^{2 Rules 4(3) and 6(1) of the E-Commerce Rules.}

^{3 Rules 4(8), 4(9) and 4(11) of the E-Commerce Rules.}

^{4  ASCI’s “Guidelines for Online Deceptive Design Patterns in Advertising” of 15 June 2023.}

^{5 CCPA-1/1/2023-CCPA dated 5 June 2025.}

^{6 IRDAI’s press release on “Compliance with Guidelines on Prevention and Regulation of Dark Patterns” of 2 April 2026.}

^{7 IRDAI’s circular on “Remuneration of Key Management Persons” of 25 May 2026.}

^{8 RBI press release and relevant Responsible Business Conduct Amendment Directions of 15 June 2026.}

^{9 SEBI’s consultation paper on the “Common Advertisement Code for Specified SEBI Regulated Entities” of 23 June 2026.}

^{10 §2(9) of the Consumer Protection Act.}

^{11 §6(1) of the DPDP Act read with the Central Government’s phased commencement notification dated 13 November 2025. The substantive consent obligations are scheduled to become operative on 13 May 2027.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.