Introduction

Imagine, you're trying to cancel a software subscription. Instead of a simple "Cancel" button, you're given two choices: "Renew Now" or "Accept Risk." Not "No thanks." Not "Skip.”

This isn't hypothetical. It's what India’s Central Consumer Protection Authority (CCPA) found when it fined McAfee ₹1 lakh (~USD 1000) in May 2026 for exactly this design. Twelve days later, it fined Ed-tech giant PhysicsWallah ₹5 lakh (USD 5,223) for a pre-ticked "donation" checkbox that had quietly collected ₹2.47 crore (USD 258,000) from over 21 lakh users - most of them students, many of them minors before anyone noticed it could be unchecked.

For years, dark patterns occupied a grey area between persuasive design and consumer manipulation. That ambiguity is now being tested in India, with the CCPA's penalty orders against PhysicsWallah and McAfee marking a shift from issuing regulatory guidance to actively enforcing it.

India’s Legal Framework on Dark Patterns

India Formally addressed dark patterns in 2023 through the Guidelines for Prevention and Regulation of Dark Patterns, 2023, issued by the Central Consumer Protection Authority (CCPA) under the Consumer Protection Act, 2019. The Guidelines identify thirteen specific dark patterns and prescribe practices considered deceptive or manipulative in digital interfaces. 

Importantly, the Guidelines do not operate as an independent source of liability; rather, they identify and regulate design practices that may constitute unfair trade practices or violate consumer rights under the existing consumer protection framework. 

The CCPA has since supplemented the Guidelines through advisories and enforcement action, signaling a move from identifying prohibited practices towards actively scrutinizing and penalizing their use by digital businesses.

From Advisory to Action: CCPA’s Crackdown on Dark Patterns

In June 2025, CCPA issued an advisory, advising e-commerce platforms to conduct a self-audit of their interfaces and business practices to identify and remove dark patterns. Platforms were required to complete this review within three months and confirm compliance. However, the question arose: Would this finally get platforms to listen, or was it just another warning they'd learn to live with? The CCPA in the PhysicsWallah and McAfee decision gets us closer to a solution.

The PhysicsWallah Case

The CCPA took suo motu cognizance of certain practices on the PhysicsWallah (PW) platform and found that consumers were being influenced through interface designs affecting their ability to make free and informed choices.

On PW’s website, a donation of ₹10 to the PW Foundation was automatically selected during checkout and added to the total payable amount without the consumer's prior affirmative consent. Users had to disable it manually. Additionally, a “Know more” option provided the intended use of donated funds; including financial assistance for education, healthcare and marriages. Also, courses advertised as “free” could only be accessed after users provided personal information (mobile numbers and e-mails).

CCPA examined and identified several dark patterns. The pre-checked donation option was identified as “Basket Sneaking” as the inclusion of donation was done without prior affirmative consent of the user. Secondly, emotional messages were displayed that created a sense of shame or guilt in the mind of the users indicating “Confirm Shaming”. And lastly, conditioned disclosure of personal information to access the “free” courses was found to be “Forced Action”, creating compulsion for the users. This raised serious consumer protection concerns, especially for students, including minors.

The McAfee Controversy

McAfee notified its users for subscription renewal of anti-virus software by presenting two options on their interface, “Accept Risk” or “Renew Now”. Also, the renewal option was given greater visual prominence, as compared to ‘x’ or close mechanism which appeared in subdued grey colour.

The CCPA, after examination, held that “Accept Risk” created the impression that consumers would face cybersecurity threats if they didn’t renew, exerting psychological pressure, framing the user’s choice of non-renewal as irresponsible, as “Confirm Shaming”. Also, that “Accept Risk” was ambiguous and misleading, designed to influence consumers into renewing their subscriptions, thereby constituting a “Trick Question”. The Authority further held that McAfee engaged in “Interface Interference” because the subscription renewal option was given substantially greater visual prominence than the option to close or decline the renewal prompt, impairing consumers' ability to make a free and informed choice and “Forced Action” for not providing a clearly visible and neutral opt-out choice.

In both cases, CCPA held that the use of dark patterns constituted Unfair Trade Practices under Section 2(47) of the Consumer Protection Act, 2019, violating consumers' rights. The Authority further found that these practices contravened the Consumer Protection (E-Commerce) Rules, 2020, that mandates free and affirmative consent, prohibiting unfair trade practices, as well as the Guidelines for Prevention and Regulation of Dark Patterns, 2023.

The Authority further observed that post-facto modifications do not extinguish liability for past violations, emphasizing that subsequent compliance cannot absolve responsibility for deceptive practices that had already infringed consumers' rights.

Consequently, CCPA imposed a penalty of ₹5 lakh on PhysicsWallah and ₹1 lakh on McAfee, directing both entities to discontinue the identified dark patterns, modify their digital interfaces and ensure compliance.

Persuasion vs. Manipulation: Where does CCPA Draw the Line?

The regulation of dark patterns raises a fundamental question that extends beyond the recent enforcement actions: where does legitimate interface design end and unlawful manipulation begin? Modern digital platforms rely extensively on behavioral design to improve user experience, personalize content, increase engagement, and encourage transactions. Features such as personalized recommendations, countdown timers, etc., routinely influence consumer behavior. However, influencing a decision is not synonymous with manipulating it. The Consumer Protection Act, 2019 and the Dark Pattern Guidelines prohibit interfaces that mislead, coerce, or impair a consumer's ability to make a free and informed choice, yet many design practices operate in a grey area where they simultaneously enhance usability and increase the likelihood of a purchase.

This ambiguity has given rise to competing perspectives. A broader interpretation of dark patterns may be necessary to address increasingly sophisticated methods of influencing consumer behavior, particularly where cognitive biases are exploited. Equally, an expansive interpretation may blur the distinction between deceptive practices and legitimate user experience optimization, creating uncertainty for businesses regarding the limits of permissible interface design. Since digital platforms rely on user engagement, website traffic, and conversion rates to sustain their business models, an overly restrictive approach could discourage innovation and incentivize excessively simplified interfaces designed primarily to minimize compliance risks.

The continuing challenge, therefore, lies in developing a principled framework that distinguishes legitimate commercial persuasion from practices that materially undermine consumer autonomy.

Conclusion

CCPA's recent enforcement actions signal a shift from advisory-based compliance to active regulation of dark patterns. However, the effectiveness of this framework will depend on the development of clear assessment criteria, standard operating procedures and consistent enforcement standards to ensure regulatory certainty and distinguish legitimate interface design from manipulative practices. 

Equally important is ensuring that penalties serve as an effective deterrent. If sanctions remain disproportionately low compared to the commercial gains derived from dark patterns, they risk being viewed as a cost of doing business rather than a meaningful regulatory consequence. A balanced and predictable enforcement framework will therefore be crucial to protecting consumer autonomy while preserving innovation in digital markets.