What dark patterns are, in plain terms
A dark pattern is an interface choice that steers a person toward a decision they might not otherwise make. In a privacy setting, that usually means steering them toward giving more consent, or keeping consent they would withdraw if the path were clear.
The problem is not that a design is persuasive. The problem is that the design removes a real, equal choice. The DPDPA cares about whether the choice was genuine, and that is where design and law meet.
The consent standard that dark patterns fail
Section 6(1) sets out what consent must be. Dark patterns tend to fail one or more of these requirements:
| Requirement | What it means | Design that defeats it |
|---|---|---|
| Free | No pressure or penalty for refusing | Nagging, confirm shaming, blocked access for refusal |
| Specific | Tied to a stated purpose | Bundled consent for unrelated purposes |
| Unambiguous | A clear affirmative action | Pre-ticked boxes, consent inferred from silence |
| Withdrawable | As easy to withdraw as to give | Hidden or multi-step withdrawal flows |
Section 6(4) is the clearest line. If giving consent is one tap and withdrawing it takes five screens and an email, the design does not meet the Act.
Two regimes, one interface
The Central Consumer Protection Authority issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023 under the Consumer Protection Act, 2019. They list specified dark patterns, including false urgency, basket sneaking, confirm shaming, forced action, subscription traps, interface interference, bait and switch, drip pricing, disguised advertisement, nagging, trick questions, SaaS billing and rogue malware.
This means a consent interface can raise two separate questions. Under the DPDPA, did the design produce valid consent? Under the 2023 guidelines, did the design deceive or coerce the consumer? A review should look at both at once, because the same screen is evidence in both.
Designing consent that holds up
A consent flow that meets the Act tends to share a few traits.
- Accept and refuse options are presented with equal weight, with no pre-selection.
- Each purpose is stated separately, so a person can agree to one and decline another.
- Withdrawal is reachable in the same number of steps as giving consent, from the same place.
- No access or feature is withheld for refusing consent that is not necessary to provide it.
How AMLEGALS reviews consent design
AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder and Managing Partner, with Rohit Lalwani, Associate Partner, working on DPDPA compliance.
The team reviews consent screens, cookie banners and withdrawal flows against Section 6 and against the 2023 dark patterns guidelines, and sets out the specific changes that bring a design within both.