Dark patterns prohibition in consent flows

Introduction

Dark patterns are deceptive or manipulative design techniques used in digital platforms to influence users into making decisions that may not reflect their actual preferences. In consent flows, these practices may encourage individuals to share personal information, accept unnecessary permissions, subscribe to services or agree to conditions without fully understanding their consequences.

Common examples include pre-selected consent options, misleading buttons, hidden rejection options, repeated consent requests and confusing cancellation procedures. Such practices undermine informed consent, individual autonomy and consumer rights.

With the expansion of artificial intelligence, biotechnology, healthcare applications and digital services, protecting individuals from manipulative consent mechanisms has become an important legal responsibility. India regulates dark patterns through consumer protection legislation, data protection law and guidelines issued by regulatory authorities.

Legal framework in India

1. Consumer protection act, 2019

The Consumer Protection Act, 2019, provides protection against unfair trade practices and misleading advertisements.

Section 2(47) defines unfair trade practices and covers specified deceptive commercial practices. Section 18 establishes the responsibilities of the Central Consumer Protection Authority (CCPA), including protecting consumer rights and preventing unfair trade practices.

Under this framework, businesses using deceptive consent interfaces may face regulatory action where their conduct amounts to an unfair trade practice.

2. CCPA guidelines on dark patterns, 2023

The Central Consumer Protection Authority issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023.

These guidelines identify 13 prohibited dark patterns, including:

False urgency.

Basket sneaking.

Confirm shaming.

Forced action.

Subscription traps.

Interface interference.

Bait and switch.

Drip pricing.

Disguised advertisements.

Nagging.

Trick wording.

SaaS billing.

Rogue malware.

These practices are particularly relevant to digital consent mechanisms because they may manipulate users into accepting unnecessary conditions or services.

3. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, establishes India's framework for processing digital personal data.

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It also provides for withdrawal of consent.

Therefore, consent interfaces should not use misleading buttons, forced acceptance or confusing options that undermine genuine user choice.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms.

The judgment established the importance of individual autonomy, informational privacy and protection against unjustified interference.

Relevance: Dark patterns in consent flows may undermine individual autonomy by manipulating users into disclosing personal information. Consent mechanisms must respect privacy and meaningful individual choice.

2. Shreya Singhal v. Union of India (2015)

The Supreme Court declared Section 66A of the Information Technology Act, 2000, unconstitutional because it violated freedom of speech and expression under Article 19(1)(a).

Relevance: The judgment demonstrates that digital regulation must respect constitutional freedoms and legal certainty. Regulations addressing deceptive digital practices should also operate within clear statutory boundaries.

3. Central Inland Water Transport Corporation Ltd. v. Brojo Nath Ganguly (1986)

The Supreme Court examined unfair and unreasonable contractual terms imposed through unequal bargaining power.

The Court recognised that certain oppressive contractual conditions may be contrary to public policy.

Relevance: Digital platforms may use complicated consent conditions and manipulative interfaces that exploit unequal bargaining power. The judgment provides broader principles concerning fairness and protection against oppressive contractual arrangements.

4. LIC of India v. Consumer Education and Research Centre (1995)

The Supreme Court examined unfair contractual conditions and consumer protection principles.

The judgment emphasised fairness, reasonableness and protection against arbitrary contractual arrangements.

Relevance: Digital consent agreements should not impose misleading or unreasonable conditions that prevent consumers from exercising meaningful choices.

Requirements for lawful consent flows

Organisations should adopt transparent consent mechanisms that provide users with genuine control over their personal information.

Important requirements include:

Present acceptance and rejection options clearly.

Avoid pre-selected consent boxes.

Explain the purpose of collecting personal information.

Separate consent for different processing purposes.

Provide an accessible withdrawal mechanism.

Avoid repeated requests designed to pressure users.

Ensure that consent is not obtained through misleading language.

Regulatory challenges

Dark patterns create several enforcement challenges. Digital platforms frequently change their interface designs, making deceptive practices difficult to identify. Cross-border platforms may also create jurisdictional difficulties. Furthermore, users may not recognise when interface design is influencing their decisions.

Regulatory authorities must therefore encourage independent audits, transparent interface design, consumer awareness and effective complaint mechanisms.

Conclusion

The prohibition of dark patterns in consent flows is essential for protecting consumer autonomy, privacy and informed decision-making in the digital economy. In India, the Consumer Protection Act, 2019, CCPA Dark Patterns Guidelines, 2023, and Digital Personal Data Protection Act, 2023, provide important legal protections against deceptive consent practices. Judicial decisions such as Puttaswamy, Central Inland Water Transport Corporation and LIC of India establish broader principles of privacy, fairness and individual autonomy. Digital platforms must therefore adopt transparent, accessible and voluntary consent mechanisms that allow individuals to make genuine choices without manipulation.