Dark Patterns Guidelines India: 13 Banned Practices and Audit

The dark patterns guidelines India’s consumer regulator issued are the Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified by the Central Consumer Protection Authority (CCPA) on 30 November 2023. They ban 13 specified deceptive design practices, including false urgency, basket sneaking, drip pricing and subscription traps, and apply to platforms, advertisers and sellers. On 5 June 2025 the CCPA asked e-commerce platforms to self-audit and remove dark patterns within three months, and by August 2026 it had penalised nine digital platforms.

What the dark patterns guidelines India uses cover

A dark pattern is any practice or deceptive design pattern in a user interface or user experience that is designed to mislead or trick users into doing something they did not originally intend or want to do, by subverting or impairing their autonomy, decision-making or choice. Because a specified dark pattern can amount to a misleading advertisement or unfair trade practice, the CCPA can use its powers under sections 18 to 21 of the Consumer Protection Act, 2019, including directions and penalties.

The dark patterns guidelines India has adopted are not limited to marketplaces. A D2C brand’s own website and app, a travel booking site, an edtech platform and a subscription app are all covered, as advertisers and sellers.

The 13 specified dark patterns

The 2025 self-audit and what enforcement looks like

On 5 June 2025 the CCPA issued an advisory asking e-commerce platforms to carry out self-audits to identify and remove dark patterns within three months, and encouraged them to file self-declarations that their platforms are free of dark patterns. Enforcement followed. In a reply in the Rajya Sabha in August 2026, the government said the CCPA had penalised nine digital platforms, with penalties of about ₹20 lakh in total. The practices reported included fees added at checkout (drip pricing), memberships or donations pre-added to the cart (basket sneaking) and guilt-based opt-out wording (confirm shaming). Several platforms also had to change their interfaces.

The penalties were modest, but the orders are public and the interface changes are costly. Treat the dark patterns guidelines India now enforces as a live compliance item, not a future one. The pattern is clear: the regulator is now testing real user journeys.

How to run a dark pattern self-audit

1. Map journeys: sign-up, product page, cart, checkout, payment, subscription, cancellation, unsubscribe, account deletion, consent banners, push and email flows.
2. Screenshot every step on mobile and desktop, logged in and logged out.
3. Test against the 13 patterns in a simple matrix: journey step against pattern, marked yes, no or unsure.
4. Check price: does the first price include all mandatory fees? Are optional add-ons unticked by default?
5. Check urgency: are stock counts and timers real and system-generated?
6. Check exits: is cancelling as easy as subscribing? Is unsubscribing one click?
7. Fix, record and sign off: keep a dated audit report with the fixes and owners.
8. Repeat after major releases, and add “no dark patterns” to product requirement and A/B test approvals.

Example: Safarnama Trips, an online travel company in Gurugram, found that its flight page showed “Only 3 seats left at this fare” from a static script, pre-selected travel insurance and added a convenience fee only at payment. The fix: live inventory for seat counts, unticked insurance with neutral “Add” and “Skip” buttons, and all mandatory fees in the first fare shown. A pre-ticked marketing consent box is also a data protection problem: from 13 May 2027 the DPDP Act requires consent by a clear affirmative action.

Frequently asked questions

What are the dark patterns guidelines India has notified?

The CCPA’s Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified on 30 November 2023. They list 13 banned practices and apply to platforms, advertisers and sellers offering goods or services in India.

Is a countdown timer illegal in India?

A genuine timer for a real deadline is fine. A timer that resets on refresh, or a fake “only 2 left” message, is false urgency, one of the 13 specified dark patterns.

Has the CCPA fined any company for dark patterns?

Yes. The government told the Rajya Sabha in August 2026 that the CCPA had penalised nine digital platforms, about ₹20 lakh in total, for practices such as drip pricing, basket sneaking and confirm shaming.

Do dark patterns guidelines apply to small D2C brands?

Yes. They apply to advertisers and sellers as well as platforms, so a brand’s own website, app and ads are covered.

Quick quiz

To audit your product against the dark patterns guidelines India enforces, see the Marketing and Advertising Law certificate course.

Sources

• CCPA Guidelines for Prevention and Regulation of Dark Patterns, 2023 (30 November 2023)
• CCPA advisory on self-audit of dark patterns by e-commerce platforms (5 June 2025)
• Consumer Protection Act, 2019: ss.2(28), 2(47), 18 to 21
• Government reply in the Rajya Sabha on CCPA dark pattern penalties (August 2026), as reported by Outlook Business
• Digital Personal Data Protection Act, 2023: s.6

This page is for education and general information, not legal advice for a specific case. Law as on 31 October 2026.