1 November 2026 • 6 min read
If you run a consumer app, a marketplace or a subscription service in India, the Central Consumer Protection Authority (CCPA) has a list of interface designs it treats as unfair trade practice. This page sets out what the Guidelines for Prevention and Regulation of Dark Patterns, 2023 say, what the regulator has done with them since, and the changes a product team should make. For a broader look at ethical design, see our guide to dark patterns in Indian apps.
The CCPA issued the Guidelines on 30 November 2023 under Section 18 of the Consumer Protection Act, 2019, and they took effect when published in the Gazette. They apply to all platforms systematically offering goods or services in India, to advertisers and to sellers.
The core rules are short. No person, including any platform, shall engage in any dark pattern practice. A person is treated as engaging in one if it carries out any practice listed in Annexure 1. The Annexure can grow, because the CCPA may specify other dark patterns later. The guidelines add to other laws and do not replace them, and where the meaning is unclear, the CCPA's decision is final.
The Annexure carries a caution: its illustrations are guidance and not a binding interpretation of law, because different facts may lead to different readings. Do not treat an example as the outer edge of a rule.
A dark pattern is defined as a deceptive design using user-interface or user-experience interactions that is designed to mislead or trick users into doing something they did not intend, by subverting or impairing their autonomy, decision-making or choice.
| Pattern | What the Annexure covers | What to check in your product |
|---|---|---|
| False urgency | Falsely stating or implying urgency or scarcity, such as false popularity or overstated limited quantities | Show counters and "people viewing" only if they come from real data |
| Basket sneaking | Adding items, services or donations at checkout without consent, so the total rises | No pre-ticked add-ons, insurance or charity; fees must be disclosed at purchase |
| Confirm shaming | Fear, shame or guilt wording to push a purchase or keep a subscription | Make "No thanks" neutral, with no insults or warnings |
| Forced action | Requiring an extra purchase, sign-up, unrelated app or personal data to get what the user came for | Do not ask for contacts, Aadhaar or card details that the purchase does not need |
| Subscription trap | Impossible, complex or hidden cancellation; card or auto-debit required for a free plan; vague cancellation steps | Cancel in the same place and with about the same effort as sign-up |
| Interface interference | Highlighting some options and hiding others, such as a faint "No" or a close icon that opens an ad | Give accept and decline equal weight, and make close buttons close |
| Bait and switch | Advertising one outcome and delivering another, such as an item shown as available then "out of stock" | Show true stock; do not swap a dearer product at the last step |
| Drip pricing | Price elements hidden until late, a higher charge than the checkout price, "free" apps that need payment to continue | Show the full price early; say in the store listing what is free and what is paid |
| Disguised advertisement | Ads posing as user content or articles | Label every ad; the seller or advertiser must disclose it |
| Nagging | Repeated requests that disrupt the user, such as endless prompts to download the app or accept notifications | Cap prompts and always offer a clear "no" |
| Trick question | Confusing wording or double negatives | Test consent wording with real users; use plain "Yes" and "No" |
| SaaS billing | Recurring billing run surreptitiously: no notice when a trial turns paid, silent renewals, charging for unused features | Send a notice before a trial converts and before each renewal |
| Rogue malware | Scareware or ransomware tricks | Vet the ad networks and redirects your app shows |
The enforcement record is short but real.
The June 2026 orders show how the Annexure is applied. PhysicsWallah had a ₹10 donation selected by default at checkout, with emotional messages encouraging users to keep it, and courses advertised as "free" that required a mobile number and email first. The CCPA called these basket sneaking, confirm shaming and forced action. McAfee's renewal screen offered "Renew Now" or "Accept Risk", which the CCPA read as presenting non-renewal as a security risk. It named confirm shaming, interface interference, trick question and forced action. In both cases the CCPA also cited Rule 4(9) of the Consumer Protection (E-Commerce) Rules, 2020, which the PIB summary describes as automatic recording of consent through a pre-ticked checkbox.
If you sell on a marketplace, also read our page on the e-commerce amendment rules for 2026. For billing and cancellation design, see subscription retention.
This is a plain-words summary of published government texts, not legal advice; check your own flows with a qualified lawyer.
They apply to platforms systematically offering goods or services in India, to advertisers and to sellers. A consumer app selling to Indian users falls inside that.
Thirteen, in Annexure 1 of the guidelines. The CCPA can add more.
The Annexure lists automatic addition of paid services with a pre-ticked box as an example of basket sneaking. The CCPA also cited the E-Commerce Rules on pre-ticked consent in its June 2026 orders.
The guidelines do not set a fine. The CCPA fined PhysicsWallah ₹5 lakh and McAfee ₹1 lakh in June 2026 under the Consumer Protection Act, the E-Commerce Rules and these guidelines.