Dark Patterns in Indian Apps: What the CCPA Guidelines Ban and the Penalties

“Only 2 left in stock!” “12 people are viewing this right now.” “No thanks, I don’t like saving money.” A ₹49 “platform fee” that appears only on the final payment screen. An extra item quietly added to your cart. A subscription that takes one tap to start and fifteen screens to cancel.

These are dark patterns: design tricks that push users into decisions they didn’t intend. In India, they’re no longer just bad manners. They’re regulated under the Consumer Protection Act, 2019, and the regulator has started imposing penalties. This guide explains what the CCPA’s dark patterns guidelines ban, recent enforcement, what apps must do, and the remedies available to consumers and businesses.

The legal framework for dark patterns in India

The Central Consumer Protection Authority (CCPA) notified the Guidelines for Prevention and Regulation of Dark Patterns, 2023 on 30 November 2023 (ANI). The guidelines define dark patterns as deceptive user interface or user experience practices designed to mislead or trick users into doing something they didn’t originally intend. They treat such practices as misleading advertising, unfair trade practices or violations of consumer rights under the Act (Law.asia).

The guidelines apply to every platform that systematically offers goods or services in India, and to advertisers and sellers. That includes e-commerce marketplaces, food and grocery delivery, travel, fintech, edtech, gaming, subscription apps and SaaS products sold to consumers. They sit alongside the Consumer Protection (E-Commerce) Rules, 2020. For online games in particular, see our guide to the Online Gaming Act 2025.

The 13 dark patterns banned by the CCPA guidelines

The list is illustrative, not exhaustive. Any interface that manipulates a consumer can still be an unfair trade practice under the Consumer Protection Act even if it doesn’t fit neatly into one of the 13 categories. Consent screens are a common trap too; our DPDP Act compliance checklist explains what valid consent looks like for personal data.

Enforcement: self-audits, penalties and recent cases

The 2025 self-audit advisory

On 5 June 2025, the CCPA issued an advisory asking e-commerce platforms to self-audit for dark patterns within three months and submit self-declarations of compliance (Internet Freedom Foundation). Major platforms, including Flipkart, Myntra, Swiggy, Zomato, Zepto, Meesho, BigBasket, MakeMyTrip and Ajio, were among 26 companies that declared themselves free of dark patterns after completing these audits (Tribune).

Penalties

By August 2026, the government told Parliament that the CCPA had imposed penalties totalling about ₹20 lakh for dark patterns, and that interventions involving IndiGo, BookMyShow and SpiceJet, among others, had led to dark patterns being discontinued (ANI). In one round of action, the CCPA directed PhysicsWallah to pay ₹5 lakh for practices including basket sneaking, confirm shaming and forced action, and McAfee Software India ₹1 lakh for practices including confirm shaming, interface interference and trick questions (PIB).

The CCPA’s powers

Under the Consumer Protection Act, 2019, the CCPA can investigate, order a practice to be discontinued, order refunds, and impose penalties for false or misleading advertisements of up to ₹10 lakh, rising to ₹50 lakh for subsequent contraventions. False or misleading advertising is also a criminal offence under Section 89. Sectoral regulators are following suit: IRDAI has directed insurers to assess compliance, and SEBI has proposed aligning its advertising framework with the guidelines (Law.asia).

Regulators also have new tools. The CCPA has used a real-time monitoring dashboard to scan e-commerce sites for suspected dark patterns, and complaints through the National Consumer Helpline feed directly into its investigations. A startup can no longer assume that a small design trick will go unnoticed because it’s small. The penalties so far are modest. The reputational cost of a public CCPA order, and the regulator’s power to order refunds to all affected consumers, are what founders should really worry about.

A dark patterns compliance checklist for Indian apps

• Run a real self-audit of every user flow: sign-up, product pages, cart, checkout, subscription, cancellation and account deletion.
• Show the full price early, including platform fees, convenience fees and delivery charges, so the final price matches the first.
• Make every urgency or scarcity claim true and verifiable. Scarcity messages must reflect actual stock, and countdown timers must reflect real offers.
• Never pre-add items, donations, insurance or tips to the cart.
• Make cancellation as easy as sign-up, with clear reminders before free trials convert into paid plans.
• Use neutral language for decline options, with no confirm shaming.
• Label ads and sponsored content clearly, and keep paid placements visually distinct from reviews and organic results.
• Document your decisions. Keep a record of design reviews and A/B tests, so you can show the CCPA that your choices were made in good faith.

If you use AI agents or chatbots that interact with customers, the same rules apply to what they say and do; see our guide to liability for AI agent mistakes.

Remedies for consumers and businesses

For consumers who’ve been tricked by a dark pattern:

• Complain to the platform’s grievance officer, as e-commerce platforms must have one under the E-Commerce Rules.
• Call the National Consumer Helpline (1915) or use the NCH app or website, which can escalate complaints to companies.
• File a complaint with the CCPA about unfair trade practices or misleading advertisements affecting consumers as a class.
• File an individual case before the District Consumer Commission, online through e-Daakhil, for refunds and compensation.

For businesses that receive a CCPA notice: respond within the deadline with evidence, fix the identified dark pattern quickly (prompt correction counts in your favour), and take legal advice on the facts and the penalty. CCPA orders can be appealed to the National Consumer Disputes Redressal Commission within the statutory period.

Quick answers

Are dark patterns illegal in India?

Yes. The CCPA’s 2023 guidelines treat 13 listed dark patterns as unfair trade practices or misleading advertising under the Consumer Protection Act, 2019.

What is the penalty for dark patterns?

The CCPA can order discontinuation and refunds, and impose penalties for misleading advertising of up to ₹10 lakh, or ₹50 lakh for repeat contraventions. Criminal prosecution under Section 89 is also possible.

Is drip pricing banned?

Yes. Hiding charges until the end of checkout, or charging more than the price shown, is drip pricing under the guidelines.

Related reading: gig and platform workers and labelling AI-generated content; also children’s data and AI chatbots and consent managers under the DPDP Act; also selling SaaS to Indian customers from the UK; also India’s Online Gaming Act for UK gaming companies; also ads inside AI answers and Indian advertising law; also keyword advertising and trade marks in India.

Final word

At Halverton & Co., we advise startups, SaaS companies and technology-driven businesses on consumer protection compliance, dark pattern audits, e-commerce regulation and CCPA proceedings. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for companies that need senior legal support without a full in-house team. Halverton & Co.: Where tech needs law!

Write to us at office@halvertonandco.com, or get in touch, to discuss your situation.

This article reflects the law and developments reported up to early October 2026. Technology regulation changes quickly; please take advice on your specific facts before acting.