Dark Patterns
Interface designs that push or trick people into choices they would not otherwise make.
Dark patterns are design tricks that steer or pressure people into choices they might not otherwise make, such as hiding the refuse button or making it very hard to cancel. Consent obtained this way is unlikely to count as free.
Meaning of Dark Patterns
The DPDP Act does not define dark patterns, but consent must be free, unambiguous and given by a clear affirmative action. Hidden opt-outs, confusing wording, pre-ticked boxes and a much louder "Accept" than "Reject" risk making consent invalid. Consumer-protection guidelines also address dark patterns.
The DPDP Act does not define "dark patterns", but Section 6(1) sets a standard they cannot meet. Consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. A design that exploits confusion, urgency, repetition or an unequal layout undermines each of these. Section 6(4) adds that withdrawal must be as easy as giving consent, which rules out interfaces that make leaving harder than joining.
Common patterns in consent flows include: a large coloured "Accept all" button next to a pale "Manage options" link; pre-ticked boxes; double negatives such as "do not uncheck to stop not receiving offers"; repeated pop-ups until the person gives in; guilt wording such as "No, I do not care about my savings"; hiding the refuse option in a sub-menu; and bundling consent with account creation. Withdrawal flows can be rigged with extra confirmation steps, hidden settings or a phone call requirement.
Other regimes already address the issue. In India, the Central Consumer Protection Authority has issued guidelines on dark patterns in consumer-facing business, under the Consumer Protection Act, 2019, and the EU has regulator guidance on deceptive design in consent. These sit alongside the DPDP Act. Under Section 38, the Act is in addition to other laws, so a single interface can raise both data-protection and consumer-protection questions.
The key difference from ordinary persuasion is whether the person can still choose freely. Clear benefits, honest reminders and tidy design are not dark patterns. A button can be attractive; it becomes a problem when the layout, wording or process makes one answer far easier than the other, or hides the consequences. Where children use a service, the concern is greater because Section 9(2) bars processing likely to harm a child's well-being.
Examples of Dark Patterns
A banner with a large green "Accept all" button and a tiny grey "manage options" link buried three screens deep is a dark pattern.
The app's permission screen shows a bright "Allow all" button and a grey "skip" text link, and re-asks at every launch. After review, the team shows two equal buttons, asks once, and re-asks only after a long period or a feature change.
A user can start a plan in two taps but must call a support number during office hours to stop her data being shared. The company adds a settings toggle and an in-app cancellation page so withdrawal matches sign-up.
A checkout page has a pre-ticked box adding "share my details with partners" in small print. The privacy team switches it to unticked, moves it out of the fee summary and makes the wording specific about the partners and purpose.
Why Dark Patterns matters
Dark patterns put the whole consent record in doubt. If a regulator or court finds that agreement was extracted through confusing or coercive design, the consent was not free or unambiguous, and everything built on it, such as marketing lists and profiles, has no ground under Section 4. Section 6(10) leaves the burden of proving valid consent on the Fiduciary, which is hard to carry if the interface is itself the evidence against it.
The consequences can compound: residual DPDP penalties of up to ₹50 crore, possible consumer-protection proceedings, and reputational damage that spreads quickly on social media. For individuals, dark patterns erode autonomy, and the most affected are people with low digital literacy or limited time to read, who are numerous among Indian users of mobile-first services.
How it works in practice
- 1Review every consent, cancellation and data-sharing journey against a checklist: default settings, button size and colour, wording, number of steps, hidden options and urgency cues.
- 2Compare accept and refuse paths by counting taps and screens; they should be symmetrical, and withdrawal should be about as quick as sign-up.
- 3Test with real users from varied backgrounds, including non-English readers, and ask them to explain their choice. Misunderstanding is a signal of design problems.
- 4Set a design standard that product and marketing teams follow, with a sign-off step from legal or privacy before launching consent screens or changing existing ones.
- 5Keep records of screen versions and A/B tests. If a variant improves opt-in by confusing people, retire it.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Measuring success only by opt-in rate. A high rate produced by pressure invites challenge; measure comprehension and complaints too.
Making refusal possible but burdensome, for example through five extra clicks. Keep the effort equal on both sides.
Using confusing or emotional language in prompts. Use neutral, factual wording and describe the consequence of each choice.
Leaving design decisions to marketing alone. Privacy and legal review should be part of changes to consent screens.
Compliance tips
Adopt the rule that the refuse option is always visible without scrolling or opening menus.
Run a quarterly dark-pattern audit of your top ten user flows, and fix findings before adding features.
Build a consistent component library for consent controls so every team uses the same fair design.
Monitor customer complaints and support tickets for phrases such as "could not unsubscribe"; these are early indicators of problem flows.
Common questions about Dark Patterns
Does the DPDP Act mention dark patterns?
Not by name. But Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, and Section 6(4) requires withdrawal to be as easy as giving. Deceptive interface design that undermines those standards can make consent invalid. Consumer-protection rules separately address dark patterns.
Is a pre-ticked consent box a dark pattern?
It is commonly treated as one and it does not meet the requirement for a clear affirmative action. Because the person does nothing to agree, the box fails Section 6(1). Use unticked boxes or explicit buttons for each purpose.
Can making the Accept button bigger be a dark pattern?
Visual emphasis alone is not always unlawful, but a design that makes accepting easy and refusing hard can undermine free and unambiguous consent. Give both options similar prominence and clear wording, and test whether users understand what each choice does.