Draft:Dark Patterns

WHAT IS DARK PATTERNS?

Dark patterns are design tricks built into websites and apps that quietly steer users toward choices they would not otherwise make, such as spending more money, giving up more personal data, or struggling to cancel something they no longer want. Instead of helping users complete a task, the interface is deliberately shaped to benefit the platform at the user's expense, often without the user realising they have been nudged.

The term was coined in 2010 by Harry Brignull to describe interface designs that intentionally coerce, control or deceive people into decisions they would likely avoid if they were fully informed and free to choose otherwise. He argued that interface design should instead follow ethical standards that respect user choice.

OFFICIAL DEFINITIONS OF DARK PATTERNS

This section discusses "Dark Patterns" as defined in authoritative sources particularly Indian legislation and the highest official publications on the subject. Where no binding definition exists reference are made to conceptually related provisions.

'Dark Patterns' as defined in legislation(s)

Guidelines for prevention and control of dark patterns, 2023

Section 2(e) defines dark patterns as practices or deceptive design patterns using user interface that are designed to mislead or trick consumers into doing something they did not originally intended thereby undermining their autonomy and choices and amounting to misleading advertisement and unfair trade practices. these guidelines identify 13 dark patterns which includes false urgency, basket sneaking, confirm shaming, forced action, subscription traps, interface interference, bait and switch, drip pricing and disguised advertisements.

Reserve Bank of India (Digital Lending) Directions, 2025

The Reserve Bank of India (Digital Lending) Directions, 2025, consolidated earlier RBI instructions and add new measures on arrangements with lending service providers (LSPs), disclosures to borrowers, data protection and the reporting of digital lending apps. Within this framework, the Directions also address dark patterns. Where an LSP operates a platform offering loans from multiple lenders, the content it displays must be unbiased and objective and must not push a particular lender's product, including through dark patterns or deceptive design intended to mislead borrowers into choosing a particular loan offer. This provision is consistent with the CCPA Guidelines and applies the same concern to regulated digital lending, where decisions are financially significant and a transparent presentation of loan options is essential to informed borrower choice.

Legal provision(s) relating to 'Dark Patterns'

These provisions do not clearly define dark patterns but they are conceptually necessary to understand it fully essentially for clarifying what makes consent legally defective and when manipulative design escalates from individual deception into market level harm and what pre-existing disclosure standards a practice like drip pricing is actually being measured against.

• section 2(47), 2(41) and 94 of Consumer Protection Act, 2019 they extend the general categories of unfair trade practice and restrictive trade practice to interface level conduct and by empowering the central government to act against unfair e-commerce practices generally show that dark patterns were treated as a species of unfair trade practice long before the term itself was adopted.
• Information Technology Act, 2000 and the intermediary guidelines and digital media code, 2021 These do not regulate interface design directly. However, section 79(1) protects an intermediary only for third-party information it hosts or makes available and section 79(3)(a) removes that protection where the intermediary has conspired, abetted, aided or induced the commission of an unlawful act. Rule 3 of the 2021 Rules adds due diligence and grievance redressal duties as further conditions of safe harbour. Dark patterns are built into the platform's own interface, not posted by a third party, so they are arguably the platform's own conduct, which safe harbour does not cover.
• section 6 Digital Personal Data Protection Act, 2023 Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action and limited to the personal data necessary for the specified purpose. Section 6(2) makes any part of a consent that infringes the Act, the Rules or any other law invalid to that extent. Section 6(3) requires a consent request to be in clear and plain language. Section 6(4) requires that withdrawal of consent be as easy as giving it. Consent obtained through a dark pattern would arguably fall short of these requirements as a pre-ticked box is not a clear affirmative action and consent bundled with an unrelated service or extracted by a forced action is not free or unconditional.
• section 13 to 19 Indian contract Act, 1872 Section 14 provides that consent is free when it is not caused by coercion (section 15), undue influence (section 16), fraud (section 17), misrepresentation (section 18) or mistake. Under section 19, when consent is caused by coercion, fraud or misrepresentation, the agreement is a contract voidable at the option of the party whose consent was so caused. Section 19A gives the same remedy for consent caused by undue influence. Section 17 is the closest fit for dark patterns, since it covers active concealment of a fact and any other act fitted to deceive, which can describe practices such as drip pricing or hidden cancellation options. A dark pattern can therefore be analysed as a digital-age way of procuring the very defect in consent that these sections address.

'Dark Patterns' as defined in international instrument(s)

OECD Dark Commercial Patterns

The Organisation for Economic Co-operation and Development (OECD), through its Committee on Consumer Policy, published the report Dark Commercial Patterns (2022). The report proposes a working definition under which dark commercial patterns are business practices that use elements of digital choice architecture, particularly in online user interfaces, to subvert or impair consumer autonomy, decision-making or choice. It further notes that such practices often deceive, coerce or manipulate consumers and are likely to cause direct or indirect consumer detriment, although that detriment may be difficult to measure. The Committee expressly frames this as a working definition intended to facilitate discussion among regulators and policymakers across different jurisdictions. The OECD also notes that the appropriate scope of the definition may vary depending on its intended use and on the applicable policy or legal context.

UNCTAD (United Nations Conference on Trade and Development)

The issue has also been taken up at the United Nations level. At its second session in 2017, the Intergovernmental Group of Experts on Consumer Protection Law and Policy of the UN Conference on Trade and Development (UNCTAD) asked the UNCTAD Secretariat to convene a working group on consumer protection in e-commerce. One of the working group's three subgroups, on Consumer Education and Business Guidance, is co-led by the consumer protection agencies of Argentina and Kenya, and produced a report on consumer education and business guidance on "dark commercial patterns." Paragraph 4 of the report notes that there is no agreed definition of the term "dark commercial patterns." It cites an earlier OECD definition under which they are user interfaces used by some online businesses to lead consumers into decisions they would not otherwise have made if fully informed and able to select alternatives. The report adds that some dark commercial patterns deceive users, while others manipulate them into choices that are not in their best interests.

'Dark Patterns' as defined in official document(s)

ASCI (Advertising Standards Council of India) Discussions Document, Dark Patterns: The New Threat to Consumer protection

iThe Guidelines treat "dark patterns" as an umbrella term for a wide variety of practices in online user interfaces that lead consumers to make choices that often are not in their best interests. They acknowledge that a universally accepted definition is difficult to develop and instead adopt the working definition proposed by the OECD Committee on Consumer Policy. Under that definition, dark patterns are business practices that use elements of digital choice architecture, particularly in online user interfaces, to subvert or impair consumer autonomy, decision-making or choice. They often deceive, coerce or manipulate consumers and are likely to cause direct or indirect detriment. The Guidelines note that dark patterns share end-goals such as getting consumers to buy more, spend more money or time than intended, or give up more personal data, ultimately to increase business revenue. Because ASCI's remit is limited to self-regulation of advertising content, and Chapter 1 of the ASCI Code requires advertisements to be honest and not misleading, the Guidelines cover four patterns in digital advertising: drip pricing, bait and switch, false urgency and disguised ads. They acknowledge that other practices, such as guilting users into opting for something or adding products to a consumer's basket without their knowledge, fall outside their scope.t is the earliest Indian document to define dark patterns.

'Dark Patterns' as defined in case law(s)

Comparative dictum in FTC v. Amazon.com the Federal Trade Commission alleged that Amazon used manipulative, coercive or deceptive interface designs, which the FTC calls "dark patterns," to enroll consumers in automatically renewing Prime subscriptions without their informed consent while making cancellation difficult. In May 2024, the court denied Amazon's motion to dismiss and rejected its argument that the FTC's "dark patterns" theory was unconstitutionally vague or denied it fair notice, reasoning that whether the Restore Online Shoppers' Confidence Act (ROSCA) prohibits the conduct does not depend on the label the FTC uses. The court did not adopt its own definition of dark patterns. The case was later settled for US$2.5 billion in September 2025.

Indian Judicial evolution

• Re: McAfee Software India Private Limited (CCPA Order, Case No. YY-2/4/2025-CCPA) in this the authority found that McAfee's renewal interface which offered only accept risk or renew now with no neutral opt out amounted to confirm shaming and interface interference and held that the subsequent addition of a skip option option only confirmed the earlier design lacked a fair choice making it a dark pattern amounting to an unfair trade practice under the consumer protection act 2019 and the dark patterns guidelines 2023.

• Jatin Bansal v. M/S Amazon Reseller Services Pvt. Ltd. in this the State Consumer Disputes Redressal commissions U.T. Chandigarh own prologue expressely framed the dispute as one of engaging in dark patterns and phishing emails, applying frauds,and found that displaying a falsely branded product under a searched brand name to induce purchses constituted a dark patterns amounting to an unfair and fraudulent trade practice.
• Ashwani Chawla v. Flipkart Internet Pvt. Ltd. & Ors in this the commission directed the flipcart oneplus and the retailers to discontinue the practice of issuing two separate bills for a single transaction on the pretext of offer handling fee and it was expressly characterised as an unfair contract & unfair trade practice and 'dark patterns' practice.

VARIATION IN INTERNATIONAL FRAMEWORK OF THE TERM DARK PATTERNS

the term dark patterns exhibits variations in nomenclature, conceptual scope, legislative scheme and functional application across jurisdictions. while the common underlying concern is the manipulation or impairment of consumer autonomy and decision making the terminology legal threshold and regulatory mechanism differ across jurisdiction.

Variation	India	European Union	United States	internaionally
Nomenclature	Dark Patterns	dark patterns under DSA (misleading/aggressive commercial practices) under UCPD	dark patterns are under state privacy laws while FTC generally uses dark pattern in a descriptive way	OECD says dark commercial patterns while ICPEN says Dark patterns
Conceptual Scope	Specified practice that affects autonomy decision making or choices	Material distortion of autonomous and informed choices	it is a substantial effect of impairing autonomy decision making or choices	deceiving, coercing or manipulating consumers
Legislative Scheme	Dedicated CCPA Guidelines 2023 under consumer protection law	express prohibition provided by DSA and UCPD discusses overlapping conduct indirectly	FTC act enforcement + state specific privacy legislation	Primarily policy
Functional Variation	consumer protection and e-commerce focused	online platforms are focused under DSA while consumer commercial practices under UCPD	it is privacy focused under state privacy laws and there is broader consumer protection enforcement by FTC	focuses on consumer policy and cross border enforcement focus
regional/state variation	there is no separate state dark patter legilation	No equivalent state level variation within the EU framework	California Colorado Connecticut employ different statutory approaches

Nomenclature variation

the terminology is not uniform internationally the OECD refers the term as dark commercial patterns and describing it as digital practices that steer, deceive, coerce or manipulate consumers while the ICPEN uses dark patterns the EU also uses dark patterns in recital 67 of digital service act while its unfair commercial practices directive regulates overlapping conduct through categories of misleading and aggressive commercial practices without using the term itself.

Conceptual and Definational Variation

The EU Digital Services Act (DSA) describes dark patterns as practices that materially distort, whether on purpose or in effect, the ability to make autonomous and informed choices. California and Colorado adopt a substantial-effect-based formulation, focusing on the substantial effect of impairing autonomy, decision-making or choice. India, in contrast, identifies specified dark patterns through its dedicated Guidelines, with the listed practices constituting the principal regulatory framework.

Variation in legislative scheme

India is distinctive in having a dedicated instrument that specifically regulates dark patterns: the Guidelines for Prevention and Regulation of Dark Patterns, 2023. These Guidelines prohibit engagement in specified dark pattern practices and apply to platforms, advertisers and sellers. The EU adopts a multi-instrument approach, in which the DSA regulates dark patterns on online platforms while the Unfair Commercial Practices Directive (UCPD) addresses related conduct through its general rules on misleading and aggressive commercial practices. The US follows a federal-state model. The Federal Trade Commission (FTC) addresses dark pattern conduct through its consumer protection enforcement framework, while state privacy laws introduce more specific rules concerning consent and user choice.

Functional Variation Across Regions and States

In India, dark patterns operate primarily as a consumer protection and e-commerce concept. In the EU, the DSA focuses primarily on online platform interfaces, while the UCPD addresses the same or overlapping conduct as unfair commercial practices. In the US, state-level treatment has a stronger privacy and consent dimension. For example, Colorado expressly provides that consent obtained through dark patterns is not valid consent, and it regulates interface design within its privacy framework.

Divergence from Indian Practice

India therefore differs principally in adopting a dedicated centrally issued dark pattern framework with specified prohibited practices whereas the EU relies on overlapping platforms and consumer protection instruments and US combines federal enforcement with state specific privacy regimes. the principle variation is consequently not in exsistance of the concept but in what is called dark patterns what legal threshold is applied which instrument regulates it and the regulaatory function it performs.

DARK PATTERNS INTERNATIONAL EXPERIANCE

How Other Countries Define, Operationalise, and Collect Data

Most jurisdictions define dark patterns by their effect on consumer autonomy, not by a fixed list of techniques, which keeps the concept flexible. The OECD defines them as practices that impair consumer autonomy and decision-making. The EU has gone furthest, regulating through three instruments: the DSA, the Digital Markets Act (DMA), and the GDPR, linked with European Data Protection Board (EDPB) guidance. These are backed by a government-commissioned study that combined mystery shopping with consumer experiments. The study found that 97% of the most popular EU websites and apps use at least one dark pattern, and that disclosure alone does not reduce harm, which has pushed the EU toward outright bans. The US has no single definition. The FTC treats dark patterns as deceptive under existing law and sorts them into four categories (fake urgency, hard-to-cancel subscriptions, hidden fees and data trickery), based mostly on past cases. States such as California (under the CPRA) have their own statutory definitions, with fixed per-violation penalties. The UK avoids the term "dark patterns" altogether, preferring "online choice architecture." It has catalogued 21 practices, some of which are flagged as almost always harmful, and enforcement is split between the CMA and the Information Commissioner's Office (ICO).

Deviations from Indian Practice

India's CCPA Guidelines rely on a closed list of 13 named practices rather than an open, effect-based test, which is narrower than the US or EU approach. The Guidelines do not carry any penalty provision of their own and rely instead on the general Consumer Protection Act.There is no India-specific prevalence study like the EU's, and there is no harm grading: effectively, all 13 categories sit on an equal footing, even though the Guidelines admit that classification can vary case by case. Monitoring depends on complaints and, since 2025, on voluntary self-audits by platforms rather than independent audits. India has a single regulator and lacks the UK's cross-regulator coordination, although a joint working group has been formed. Thus, India uses "dark patterns" as its only term, with no neutral umbrella term (like the UK's "choice architecture") to separate benign designs from harmful manipulation.

APPEARANCE OF 'DARK PATTERNS' IN DATABASE

How the Concept is Invoked in Official Databases and Tracking Systems

Dark patterns does not exist as an isolated data point anywhere in India's consumer protection data architecture it is invoked as a sub record they are first entered as a grievence tag inside the National Consumer Helpline's INGRAM intake system then if escalated or independently investigated then it is embodied as a named violation inside a CCPA enforcement order.

Apex Departments and Their Data Collection Methods

• Department of consumer affairs, ministry of consumer affairs, food and public distribution
• central consumer protection authority (CCPA)
• national consumer dispute redressal commission (NCDRC)
• National Informatics Centre (NIC)

Their methodology is that data is not independently collected by a dedicated dark patterns unit it is entered once a grievance gets registered or once a case is filed and CCPA enforcement findings are separately drafted and published order-by-order rather than fed into a structured shared database. NIC built and hosts the underlying case management system in coordination with the department of consumer affairs and the consumer commission.

Non-Governmental Database

Deceptive patterns (Testimonium Ltd)

deceptive patterns is a private non-governmental platform that tracks and catalogues manipulative interface designs worldwide on behalf of researchers, journalists, and the public performing a similar function to a government enforcement register, covering a far wider set of cases across the US, EU, and UK that no single national regulator compiles.

Deceptive Patterns Thus Accomplishes the following goal.: -

• Documents real world example in a continuously updated public hall of shame tagged by brand
• Compiles formal regulatory actions and court cases into a searchable enforcement database which are filterable by pattern type and jurisdiction
• maintains a standing taxonomy of named patterns types used as the tagging scheme across both repositories
• enables fast cross referencing by brand patterns type or jurisdiction ublike scattered national records
• Draws its Enforcement data from the Leiser, Santos & Doshi Database which is an academic compilation broader than any single regulators output

RESEARCH THAT ENGAGES WITH 'DARK PATTERNS'

Dark Patterns Cost Indian Online Shoppers Up to ₹28,000 Crore a Year: A Datum Intelligence Study

It is a direct market Data Analytics engagement with the concept conducted by datum intelligence in Q1 2026 across 2,590 consumers in 50 cities and 12 leading e-commerce, quick commerce and travel platforms, it goes beyond official documentation by measuring a cost the government's own system don't report in these terms the CCPA names and penalizes individual violation but has never quantified aggregate consumer harm, whereas this study puts a rupee figure on it, estimating up to ₹28,000 crore lost annually to dark patterns with 73% of platforms found still deploying forced action mechanism and 69% still using drip pricing. This research also directly evaluates the CCPA's own June 2025 self audit advisory noting a limitation the government's own material doesn't state, hidden charge and drip pricing exposure actually rose from 52% in 2024 to 63% in 2026 after the guidelines and the advisory had already taken effect meaning the self declared compliance mechanism but not measurably reduced the underlying practices it was meant to police. however such study cannot fix the deeper entrenched problem it identifies an awareness paradox where 81% report being misled regareless indicating the harm servuves even where consumer vigilance is present.

What The Dark Pattern Filings That CCPA Got Reveal About Gaps in India’s Consumer-Protection Framework

this research document builds the concept from a field level angle rather than a systems angel examining the actual self declaration filings platforms submitted to the CCPA rather than the Guidelines text which is sourced through an RTI application the investigation found that of 26 platforms that filed self-audit declarations but only 18 were made public and several of those were one paragraph statements disclosing no methodology, no checklist, and no findings, this granularity of gap the CCPA's own advisory which prescribes no standard audit format or minimum evidence requirement and does not itself surface. It focuses on state of play enforcement gaps in the filing process itself rather than a national policy prescription and with concrete sources shows that Zepto was fined ₹7 lakh for dark patterns weeks after filing a declaration claiming zero violations and that amazon was also issued a clarification notice alongside fourteen other platforms in the same period despite an earlie compliance filing.

CHALLENGES

Transparency, Accessibility, and Reliability of Data

A core challenge is that the data India does have on dark patterns compliance is neither fully transparent nor independently verified. The CCPA's June 2025 advisory required platforms to self audit and submit compliance declarations but they prescribed no standard format, no minimum evidence requirement and no mechanism for the CCPA to verify submissions. Of the 26 platforms that filed declarations in them only 18 were made public and that release followed a Right to Information request by MediaNama not as a proactive disclosure. The reliabiliy gap is confirmed not just suspected as an independent LocalCircles survey found dark patterns still present on 21 of the 26 platforms that had self-declared compliance and its founder stated publicly that the CCPA performs no cross-checking of claims.

Standardization and Harmonization of Data

No common taxonomy for classifying dark patterns exists even internationally which make data collection under one scheme difficult to compare with data collected under another, a 2024 academic study states plainly that (an all encompassing taxonomy has yet to be established) and this lack of standardization hampers efforts to investigate identify and address dark patterns. competing schemes such as Brignull's original eight categories, Conti and Sobiesk's typology, Bösch et al.'s privacy-specific taxonomy, Gray et al.'s five high-level strategies and Mathur et al.'s e-commerce-focused categories are often labeled as the same underlying practice differently, Brignull's roach motel is functionally the same as Mathur et al.'s "obstruction" and the EDPB's "dead end," yet each treats it as a distinct category. To reconcile these attempts were made like AidUI project's fused taxonomy and a 2024 effort to build a unifyinng ontology mapping 245 taxonomy elements into a three-tier hierarchy which confirms the scale of the fragmentation rather than resolving it. India adds to this fragmentation rather than easing it meaning Indian compliance and enforcement data cannot currently be cross referenced against global academic or regulatory datasets without first resolving which categories are functionally equivalent.

Implementation Status of Processes and Nature of Barriers

Even where the concept is clearly defined enforcing it faces structural barrier. first India's Guidelines operate as an advisory rather than a binding regulation as there is no penalty provision within the Guidelines themselves and enforcement relies on the general unfair trade practice provisions of the parent Consumer Protection Act 2019 making the framework as one commentary put it as more suggestive than compulsory. second enforcement authority is fragmented across regulators as in a single manipulative design such as pre ticket consent box can raise both consumer protection and data privacy concerns simultaneously but India's consumer and data regulators do not yet coordinate formally on this though a Joint Working Group of government departments, sectoral regulators and consumer bodies has recently been constituted to study the issue. thirdly enforcement capacity remains limited, India currently relies on complaint intake through the National Consumer Helpline and voluntary platform self-audits, rather than independent, automated, or systematic technical audits of the kind seen in academic research or some international regulators, Until this capacity gap closes, enforcement is likely to stay reactive while responding to complaints or media investigations rather than proactive.

PIB Press Release E-Commerce Platforms Urged to Self-Audit and Eliminate Dark Patterns

Ministry of consumer affairs recorded the CCPA's 5 june 2025 advisory requiring e-commerce platforms to self audit for dark patterns within three months and submiting self decleration confiming their removal. it also recorded the constitution of a joint working group comprising government ministries, national law universities and voluntary consumer organisation to identify and address dark patterns. the advisory followed a ministerial consultation with major e-commerce platforms and consumer and industry representatives which demonstrates the government continuance of institutional approach to dark patterns as a consumer protection concerns.

PIB Press Release 26 Lending E-Commerce Platform Declare Compliance with Self Audit to Eliminate Dark Patterns

26 major platforms which includes Flipkart, Myntra, Swiggy, Zomato, Blinkit, Meesho and JioMart etc have submitted self declerations in persuance to 5th june 2025 advisory some of these platforms including Flipkart, Myntra, Cleartrip and Walmart India have reported third party audits. The CCPA recognise these declarations as industry best practice and encouraged other digital businesses to follow suit by marking a significant instance of industry wide certification against the Government's 13 category dark pattern taxonomy.

AI related challenges with dark patterns

Artificial intelligence (AI) complicates the regulation of dark patterns because it changes who designs them and how they work. Interface design is increasingly delegated to AI systems that personalise and continuously adjust what each user sees to maximise engagement or conversion. This allows dark patterns to be tailored to an individual's browsing history and behaviour, which makes them harder to detect. Scholars argue that AI-powered dark patterns work differently from human designed ones. A human designed pattern exploits a known bias to push a user into an unwanted action, and the user may later notice and complain. An AI-powered pattern can instead shift behaviour gradually, so that the user believes the resulting choice was made freely. AI also enables new forms, such as AI-generated media and fake reviews that appear authentic, and chatbots or AI companions that create the illusion of a human relationship.

WAY AHEAD

Improving Data Collection

Indias self audit compliance data is currently unverifiable and several voices have proposed fixes. Sachin Taparia (founder of Localcircles) has pointed that the CCPA accepts platform self declaration without any cross checking which means companies have little incentive to audit thoroughly he warns these risks becoming a box ticking exercise that ultimately damages consumer trust in both platforms and the regulator. The Internet Freedom Foundation has offered a specific, low cost remedy basically a standardized dark patterns self audit and remediation statement that every platform would publish with a copy sent to the CCPA to build a simple public registry and deliberately designed to require no new law or penalty just better visibility into what already exists. Shravan Kalluri in writing for the IAPP adds that a resourcing angle are often missed in these discussions even a well designed audit requirement is meaningless if the regulator lacks the budget and staff to actually conduct investigations, so he recommends funding enforcement capacity alongside any new reporting rule.

Enabling Systemic Analysis

A recurring theme is that dark patterns shouldn't be studied only through individual e-commerce complaints but as a systematic issue cutting across sectors and population. Beni Chugh and Pranjal Jain of Dvara Research argue the analysis needs to extend into fintech (where manipulative interfaces can push people into unsuitable financial products) and into political/civic contexts (where similar techniques shape voting or civic behavior) and they specifically flag that users with lower income or lower digital literacy are more vulnerable a distributional angle indias e commerce focused guidelines dont currently capture. ansruta, debnath and shubham singh push this further institutionally recommending that multiple ministries and regulators jointly assess the impact of dark patterns regulation rather than each working from its own silo and that the Digital Personal Data Protection Act be built into this joint analysis so that consumer-harm and privacy-harm are evaluated together rather than separately. Legal scholars have also revived the Justice B.N. Srikrishna Committee's "fiduciary duty" concept which was originally proposed for India's data protection framework as a way to analyse dark patterns more broadly, a fiduciary standard judges a platform's overall conduct and relationship with users, so it can catch manipulative designs that don't fit neatly into any of the 13 named categories in India's current list.

Process Efficiency

Several discussionns target the specific procedural weakness slowing india's enforcement down. Sharavan Kulluri lays out a three part sequence, firstly by codifying the 13 identified dark patterns into enforcible rules with clearly defined panelties rather than leaving them as advisory guidance, secondly create joint oversight between the CCPA and the Data Protection Board so cases involving both consumer harm and data privacy don't fall between two separate processes and thirdly mandatetting standardised consent and privacy UX elements across platforms, similar to steps already underway in the EU, so compliance doesn't have to be assessed case by case each time. The Internet Freedom Foundation has identified a more technical but consequential gap, the final 2023 Guidelines dropped a draft clause that would have made any breach of the Guidelines automatically count as a breach of the Consumer Protection Act itself without that direct lines, the CCPA has to built each case through slower, more general statutory provisions, adding delay and legal uncertainty to every enforcement action. Debnath and Singh propose a related drafting fix, they wrote the term data fiduciary directly into the dark patterns guidelines so that when a dark pattern case also inolves aa privacy violation, the consent and fairness obligations already established under the DPDP Act apply automatically instead of needing to be argued afresh each time.

Way Ahead

• Make audits verifiable and public. A Right to Information (RTI) response reported in late 2025 showed that 25 platforms had filed dark pattern audits with the authorities, but none of the reports were public. Without disclosure, neither users nor regulators can tell whether platforms have changed their interfaces. The proposals above point in one direction publish audit reports in a standardised format (the IFF registry), cross-check a sample of declarations (Taparia) and move towards independent third party audits. D91 Labs and The Pranava Institute recommend annual independent design audits for significant fintech platforms, paired with incentives for ethical design.
• Give the Guidelines enforcement teeth. Restoring the dropped clause that links a breach of the Guidelines to the Consumer Protection Act would give the CCPA a direct enforcement route. This should be combined with codified penalties,[7] and with the funding and staffing the regulator needs to investigate.
• Institutionalise joint oversight. The Department of Consumer Affairs has already formed a 19-member Joint Working Group to study dark patterns and recommend safeguards.[8] It could be made a standing body that includes the Data Protection Board and sectoral regulators such as the RBI and SEBI for fintech, as the Dvara and Debnath–Singh proposals suggest.
• Widen the legal test. India's 13-pattern list sits uneasily with AI-driven and personalised designs. Chauhan and Anupriya note that interfaces tailored to individuals make deception hard to prove, and they discuss Lauren Willis's proposals: courts could presume that consumers' false beliefs were instigated by the business that benefits from them, or liability could be made strict, so that profiting from consumer confusion is itself unlawful. Together with the fiduciary standard, these point to an effect-based residual test alongside the named list. A neutral umbrella term, like the UK's "online choice architecture," could also separate benign designs from harmful manipulation.
• Use technology for monitoring. The government has already built tools from the 2023 Dark Patterns Buster Hackathon, with IIT-BHU: the Jagriti app for user reports, the Jago Grahak Jago app for link safety scores, and the Jagriti dashboard for regulators. These tools target the 13 specified patterns on e-commerce platforms. They could be extended to mobile apps, fintech and subtle or personalised patterns, which matter because research finds that mild dark patterns can be more effective than aggressive ones.
• Build the evidence base. India lacks a prevalence study like the EU's mystery-shopping and consumer-experiment study, and it has no harm grading across the 13 patterns. A baseline study, standardised data fields in audit reports, and periodic publication of complaint and enforcement data (for example, from Jagriti) would allow progress to be measured.
• Invest in education and business guidance. The UNCTAD working group report recommends strengthening cross-border cooperation, creating a business guide and self-assessment tool that firms can use to check their own conduct, and expanding consumer education and reporting mechanisms. These measures complement enforcement and support the ethical design incentives proposed above.

RELATED TERMS

• Deceptive Patterns: the rebranded term now preferred by the original coiner of dark patterns (Harry Brignull) and used as the primary label on platforms like deceptive. design adopted to avoid unintended association between dark and race or morality.
• Deceptive Design Patterns: the term was used by the European Data Protection Board (EDPB) in its 2022 Guidelines on Dark Patterns in Social Media Platform Interfaces referring to interface features that steer users towards unintended, unwilling or harmful decisions
• Manipulative User Interface: A broader descriptive term used across legal and academic literature to denote interface choices that exploit cognitive biases to influence user behaviour against their own interests.
• Online Choice Architecture (OCA): The umbrella term preferred by the UK's Competition and Markets Authority which covers the full environment in which user decisions are shaped of which "dark patterns" are treated as the harmful subset.
• Dark Nudge: A term drawn from behavioural economics (building on Thaler and Sunstein's concept of the "nudge") by denoting a nudge deliberately designed to work against rather than for the user's own interest.
• Sludge: A related behavioural economics term describing excessive friction deliberately introduced into a process (e.g. a complicated cancellation flow) to discourage a user from completing an action that benefits them.
• Unfair Trade Practice: The broader statutory umbrella category under Section 2(47) of India's Consumer Protection Act, 2019 within which dark pattern conduct is legally situated and prosecuted since India has no standalone dark patterns offence.
• Deceptive Design Interface: The specific phrase used within India's own Guidelines for Prevention and Regulation of Dark Patterns, 2023, functioning as a near synonym for "dark pattern" within the same document.