Two Regulators, One Screen: DPDP Act and Consumer Protection Law

Introduction

A customer orders groceries on a quick-commerce app. At checkout a full-screen prompt asks for her phone contacts "to find friends", with "Not now" in small grey text. A pre-ticked box shares her order history and phone number with a "pay-later partner". A week later a lender she has never heard of texts her a pre-approved credit offer.

From 13 May 2027 two statutes will apply to that screen. The Digital Personal Data Protection Act, 2023 (the DPDP Act) asks whether the app, as a data fiduciary (the business that decides why and how personal data is processed), had a lawful ground to share the data of a data principal (the person the data is about). The Consumer Protection Act, 2019 (the CPA) asks whether the app treated a consumer unfairly. Each has its own enforcers.

Trayambic's dark patterns blog covers screen design and its e-commerce study covers sector duties. This article covers where the regimes meet: overlapping wrongs, enforcers, saving clauses and forum choice.

The legal position

Consumers and e-commerce. A "consumer" buys goods or avails services for consideration, online or offline (CPA, s.2(7)). "E-commerce" means buying or selling goods or services, including digital products, over a digital or electronic network (s.2(16)). The Consumer Protection (E-Commerce) Rules, 2020 (G.S.R. 462(E)) define an "e-commerce entity" as any person who owns, operates or manages a platform for electronic commerce, excluding marketplace sellers (rule 3(1)(b)). The DPDP Rules borrow the CPA's concept for the Third Schedule's three-year erasure rule.

Three CPA wrongs that can involve data.

• An unfair trade practice is a trade practice that, to promote sales or services, uses an unfair or deceptive method (s.2(47)). It includes disclosing to another person personal information given in confidence by the consumer, unless the disclosure is in accordance with law (s.2(47)(ix)).
• A deficiency includes negligence causing the consumer loss or injury, and deliberate withholding of relevant information (s.2(11)).
• An unfair contract has terms causing a significant change in the consumer's rights (s.2(46)); State and National Commissions may declare such terms void (ss.49(2), 59(2)).

E-Commerce Rules. Platforms may not adopt unfair trade practices (rule 4(3)). A grievance officer must acknowledge complaints within 48 hours and redress them within a month (rules 4(4), 4(5)). Consent to a purchase must be explicit and affirmative, never a pre-ticked box (rule 4(9)).

The Central Consumer Protection Authority. The Authority protects "consumers as a class" (s.10(1)). It may inquire on its own motion (s.18(2)(a)), file complaints before commissions (s.18(2)(b)), issue guidelines (s.18(2)(l)), investigate through its Director-General (ss.15, 19) and search premises (s.22). It may order recall, reimbursement or discontinuation of unfair practices (s.20). Its power to impose money penalties is tied to false or misleading advertisements: up to ₹10 lakh, or ₹50 lakh for a repeat, with endorsers barred for up to one year, or three on repeat (s.21). Appeals go to the National Commission within 30 days (s.24).

Under s.18 the Authority issued the Guidelines for Prevention and Regulation of Dark Patterns on 30 November 2023, naming 13 patterns. Its advisory of 5 June 2025 asked e-commerce platforms to self-audit within three months and self-declare the result, and a Joint Working Group was formed to identify violations (Lok Sabha, 23 July 2025). In August 2026 the Government told the Rajya Sabha that the Authority had penalised nine platforms for dark patterns, including a quick-commerce marketplace and an ed-tech company that made personal information mandatory for free courses.

Consumer commissions. District, State and National Commissions hear complaints by the consideration paid: up to ₹50 lakh, up to ₹2 crore, and above (G.S.R. 912(E), 30 December 2021). A consumer may file where she lives or works (s.34(2)(d)), online (s.35(1)), within two years (s.69), and, with permission, for numerous consumers with the same interest (s.35(1)(c)). A District Commission can order compensation for loss or injury caused by negligence, punitive damages, discontinuance of an unfair trade practice and corrective advertising (s.39(1)).

The DPDP side. A data principal must first use the fiduciary's grievance process (s.13(3); up to 90 days under Rule 14), then may complain to the Data Protection Board. Penalties, capped per obligation in the Schedule, go to the Consolidated Fund of India (s.34). The Act provides neither compensation nor representative complaints. The Board had no members as of October 2026; its inquiry powers start on 13 May 2027, when s.43A of the IT Act, a compensation remedy for negligent handling of sensitive personal data, is omitted.

Saving clauses. The DPDP Act is "in addition to and not in derogation of" other laws but prevails "to the extent of such conflict" (s.38). The CPA is likewise in addition to, and not in derogation of, other laws (s.100).

Analysis

One act, three characterisations

The CPA asks whether a consumer was treated unfairly, not whether data was processed lawfully. The tests overlap without matching.

• Disclosure. Clause (ix) reaches sharing that serves a trade purpose, such as passing order data to a lending partner. A criminal hack is not a trade practice; a leak caused by weak security is better pleaded as a deficiency, which needs loss or injury.
• "In accordance with law". In our view, from May 2027 the DPDP Act will largely supply this test. Disclosure on valid consent or a listed legitimate use (s.7) is lawful; disclosure in breach of the Act is not. A Board finding would weigh heavily before a Commission; DPDP compliance is the best defence.
• Terms. A privacy policy that makes the service conditional on sharing with "affiliates and partners" for any purpose fails the DPDP rule that consent be unconditional and limited to necessary data (s.6(1)). In our view it may also be an unfair contract term.
• Design. A dark pattern is judged by whether it deceives or manipulates; DPDP consent by whether it is free, specific, informed and unambiguous. An honest screen that bundles three purposes into one tick can pass the first test and fail the second.

Remedies that do not overlap

The Board penalises and may issue binding directions (s.27(2)) but pays the complainant nothing. A Commission compensates the individual and can add punitive damages. The Authority changes conduct across a platform.

Once s.43A goes, in our view a consumer commission becomes the main forum in which a paying customer can recover money for a privacy harm. And the regimes protect different people: the DPDP Act covers every data principal, including free users, gift recipients and children, while the CPA covers only those who paid or promised consideration. We know of no ruling on whether personal data given in place of money counts as consideration.

How sections 38 and 100 fit together

Both statutes declare themselves additional; only the DPDP Act claims priority, and only "to the extent of such conflict", which needs two commands that cannot both be obeyed. Most overlaps are not of that kind. The CPA adds a compensation remedy the DPDP Act lacks, and the one-month redress deadline in rule 4(5) can be met within Rule 14's 90-day limit.

Section 39 of the DPDP Act bars civil courts from matters within the Board's powers. In Imperia Structures Ltd v Anil Patni (2 November 2020), the Supreme Court held that a similar bar in s.79 of the Real Estate (Regulation and Development) Act, 2016 did not stop consumer commissions, which are not civil courts, and read the 1986 Act's saving clause, now CPA s.100, as preserving consumer remedies, leaving buyers a choice of forum. In our view the same reasoning will apply to s.39, though no court has yet decided the point.

Coordination is the gap. The Authority may refer a matter to the "concerned Regulator" (s.19(2)), meaning a body established under any other law (s.2(40)). In our view the Board fits that definition, but it acts only on the triggers in s.27(1): a breach intimation, a data principal's complaint, a government reference or a court direction. Any such referral would therefore have to arrive as a Central Government reference.

Choosing a forum

For an aggrieved customer, in our view:

• Money: usually a District Commission, within two years, filed online.
• Erasure or a halt to processing: the grievance officer, then the Board from May 2027.
• A practice affecting every user: the Authority.
• More than one aim: both routes. Imperia treats the choice as the consumer's, and nothing in s.38 forces an election.

Until 13 May 2027 there is no Board route, only consumer law and s.43A.

Practical implications

Worked example (illustrative). In mid-2027 the customer, who lives in Pune, complains to the app's grievance officer and gets a template reply. Her complaint moves on three tracks.

1. 1.District Commission, Pune. She alleges an unfair trade practice under s.2(47)(ix) and rule 4(3), claiming ₹1 lakh and discontinuance. The defence turns on whether the sharing was "in accordance with law"; on our reading, after May 2027 that needs a valid DPDP consent, which a pre-ticked box cannot give.
2. 2.The Board. Having exhausted the grievance process, she complains that consent was neither free nor specific (s.6(1)). The residual Schedule maximum of ₹50 crore applies, and the lender, a separate fiduciary, needs its own ground. In our view, compensation paid to her would count as mitigation under s.33(2).
3. 3.The Authority. Similar complaints prompt a preliminary inquiry into "interface interference" in the contacts prompt, which may end in a discontinuation order for every user.

One fix answers all three: a checkout without the contacts prompt or pre-ticked sharing, separate consents, erasure by the lender and a contract barring reuse. Documented early, it limits damages, counts as mitigation and gives the Authority reason to close its inquiry.

Dual-regime checklist

Key takeaways

The two laws stack rather than compete. The DPDP Act sets the standard for lawful use of data and, in our view, will define "in accordance with law" in consumer cases; consumer law adds compensation and platform-wide Authority orders. Valid DPDP consent removes the strongest consumer claim, but screens must still pass the dark patterns test.

• Disclosing personal information given in confidence is an unfair trade practice unless done in accordance with law (CPA s.2(47)(ix)); in our view the DPDP Act will largely define what is lawful from May 2027.
• Consumer commissions can award compensation and punitive damages; the Data Protection Board can only penalise and direct, with penalties going to the Consolidated Fund of India.
• The Central Consumer Protection Authority acts for consumers as a class: suo motu inquiries, guidelines such as the 2023 Dark Patterns Guidelines, discontinuation orders, and penalties of up to ₹10 lakh (₹50 lakh for repeats) for misleading advertisements.
• Both statutes are additional to other laws (DPDP s.38, CPA s.100); in our view s.39's bar on civil courts does not reach consumer commissions, by analogy with Imperia Structures (2020).
• Once IT Act s.43A is omitted on 13 May 2027, a consumer commission becomes, in our view, the main route to money for a paying customer harmed by misuse of personal data.