Dark Patterns in the Spotlight as CCPA Pushes for Platform Accountability – SpicyIP

On the recently released advisory by CCPA directing e-commerce platforms to detect dark patterns, SpicyIP Intern Anureet Kaur explains the mode of operation under the advisory and assesses its effectiveness. Anureet is a second-year B.A. LL.B. (Hons.) student at Rajiv Gandhi National University of Law, Punjab. She has a keen interest in Intellectual Property Law and enjoys exploring the intersection of legal principles with innovation and creativity through research and writing. Her previous posts can be accessed here.

Dark Patterns in the Spotlight as CCPA Pushes for Platform Accountability

By Anureet Kaur

Recently, the Central Consumer Protection Authority (CCPA) issued an advisory directing all e-commerce platforms (hereinafter ‘platforms’) to detect dark patterns. The advisory urges all these platforms to conduct self-audits within three months of the issuance of this advisory. This is another significant step that the government has taken to ensure that these platforms restrain from indulging in deceptive and unfair trade practices. In 2023, the Department of Consumer affairs took the first step to regulate and prevent the dark patterns on these platforms by releasing the Guidelines for Prevention and Regulation of Dark Patterns (hereinafter ‘guidelines’) in the public domain (to learn more about it, kindly refer to this post).

To better understand the significance of the advisory, we should first look at the term “dark patterns”. Section 2(1)(e) of the 2023 Guidelines defines “dark patterns” as:

“any practices or deceptive design patterns using UI/UX (user interface/user experience) interactions on any platform; designed to mislead or trick users to do something they originally did not intend or want to do; by subverting or impairing the consumer autonomy, decision making or choice; amounting to misleading advertisement or unfair trade practice or violation of consumer rights;”

In simple words, dark patterns are such practices or design patterns that deceive or delude the users by making them undertake certain strides that end up subverting or impairing consumer autonomy, decision-making or choice. The use of these patterns benefits the company or platform at the cost of consumer welfare.

In the 2023 guidelines and the recent advisory, the government has identified thirteen kinds of dark patterns:

1. False urgency- falsely creating a fake sense of urgency or scarcity which may mislead users into purchasing. Eg: Only three shoes left, however, the actual number is 40.
2. Basket sneaking- insertion of additional items at the time of checkout without the consent of the user. Eg: A user purchases a service and a subscription gets automatically added.
3. Confirm shaming- using a particular kind of language to nudge the user to act in a certain way. Eg: Use of “No thanks! I hate charity”
4. Forced action- forcing a user to purchase some other good(s) in order to purchase the intended one. Eg: Coercing a user to purchase the subscription of the website in order to buy the intended good(s).
5. Subscription trap- making the process of cancellation of a subscription complex or impossible. Eg: a website hiding the cancellation option of a subscription.
6. Interface interference- manipulates or misdirects the user interface. Eg: providing a less coloured ‘No’ option in comparison to ‘Yes’
7. Bait and switch- advertising a particular outcome on the basis of user’s action, however giving a different final outcome. Eg: advertising a dress at Rs 1000 but when the user is going to purchase pointing that it is no longer available and shows up an expensive dress in place of that.
8. Drip pricing- revealing price at a later stage when additional amounts are added. Eg: A user was purchasing a bus ticket through an online platform which showcased its price as Rs. 2000, however the final price charged was Rs 4000.
9. Disguised advertisement- making false or misleading advertisements. 
10. Nagging- repeated unrelated prompts that disrupts the intended user transaction. Eg: giving repeated prompts of turning ‘ON’ the notifications
11. Trick question- use of vague or deliberate language to misguide or misdirect a user.
12. Saas billing- collecting and generating payments from users by exploiting the loops in recurring subscriptions. Eg: converting a free trial of a user into a paid one without notifying him/her.
13. Rogue malwares- misleading a user by convincing them that there is a virus on their computer and to install a fake malware removal tool which ends up installing malware on their computer.

The intent of the 2023 guidelines was to prevent and restrict the exploitation of users by these e-commerce platforms. The advisory goes one step further in the same direction by highlighting the government’s broader strategy and ongoing efforts to strengthen consumer protection in this digital era.

The use of these dark patterns can further violate provisions of the trademark, copyright, design patents and other Intellectual Property (IP) law by targeting the foundational principles of IP (pls refer to this post to better understand the intersection of dark patterns with the IP). This is done by deceptively replicating trademarks, misappropriating protected designs, using copyrighted content and through other means, thus eroding the integrity of IP law and undermining consumer welfare. This highlights why regulating these patterns requires a focus on adherence to IP laws and the protection of consumers from deceptive practices and patterns. If the 2023 guidelines, recent advisory and other measures taken by the government are implemented effectively, then they can serve as a strong regulatory framework to curb such violations.

Platforms Given Three Months to Act

This advisory requires platforms to conduct a self-audit within three months from the date of its issuance. The audit must identify whether any dark patterns exist in their interfaces. Based on the findings, platforms are encouraged to issue self-declarations confirming their compliance with the 2023 guidelines and stating that they do not engage in any of the proscribed patterns.

It also needs to be noted that the self-declaration is not mandatory and is rather framed as a trust-building mechanism aimed at strengthening consumer confidence in online platforms. This process is not merely recommendatory in spirit, as mentioned in the advisory itself, the CCPA has already issued notices to platforms found violating the 2023 guidelines, reinforcing that this is an enforceable directive and not just a policy nudge.

Now, the question arises: what will happen once the notice is issued- will the platform conduct an internal inquiry or is there a legal process involved?

As per the Consumer Protection Act, 2019 (hereinafter ‘Act’), after the issuance of notice, the process becomes neither internal nor voluntary. Section 19 of the Act gives the power to CCPA to conduct or direct to conduct a preliminary inquiry. If the investigation reveals a violation then the CCPA can issue binding directions as per Section 20 of the Act, such as discontinuation of unfair practices, reimbursement to affected consumers or other appropriate measures.

Moreover, to support the rollout and enforcement of the advisory, the Department of Consumer Affairs has also set up a Joint Working Group (JWG). This group includes representatives from government ministries, regulators, consumer rights groups, and law schools like NLUs.

The group has three main tasks:

1. track how dark patterns are being used across different platforms,
2. then report violations to the Department of Consumer Affairs regularly,
3. suggest ways to raise consumer awareness about these unfair tactics.

A New Direction in Consumer Protection

More than anything else, this advisory is about changing the way digital platforms operate. For years, user interface design has focused on nudging users into spending more or agreeing to services without fully realising it. These deceptive tactics don’t just hurt consumers rather they create unfair advantages and distort fair competition in the market (as discussed here).

A 2024 study by ASCI Academy and design studio Parallel highlighted just how widespread and embedded these patterns have become. They analysed over 12,000 screens across 53 widely used Indian apps and found that 52 of them used at least one dark pattern. Moreover, each app featured an average of 2.7 deceptive patterns. The findings confirm that dark patterns are not isolated design flaws but systematic features of digital platforms.

Thus, the advisory is a welcome step in recognising and responding to this reality. However, the success of this step will depend on its implementation. The answers to these questions in the long term will determine its success: Whether the e-commerce platforms will take the self-audit seriously? Will they enforce it in the intended manner? Whether the government will be successful in verifying its claims? Whether the introduction of third-party audits could have added a better dimension?