Dark Patterns and Consent Design for Indian E-Commerce
Under the DPDP Act, valid consent depends on how the screen is designed. E-commerce platforms now answer to two regulators for the same buttons.
- CATEGORY
- Blog post · E-commerce
- POSITION AS OF
- October 2026
- READING TIME
- 3 min read
- TAGS
- E-commerce, Dark patterns, Consent, Consumer protection
A countdown timer that resets when the page reloads. A newsletter opt-in hidden inside the delivery-address form. A "Remind me later" button that is the only way to close a permissions prompt. These are design choices, and in India they are now legal ones too. The Digital Personal Data Protection Act, 2023 (the DPDP Act) decides whether the consent they produce is valid. Consumer protection law decides whether the design itself is unfair.
What the DPDP Act demands of a consent screen
Section 6(1) sets the standard. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the specified purpose. Three practical tests follow:
- Affirmative action. Silence, pre-ticked boxes and continued browsing are not consent.
- Specific and unconditional. Bundling marketing consent with the terms needed to complete a purchase fails, because the customer cannot refuse one without losing the other.
- Language. Section 6(3) requires the request to be in clear and plain language, with an option to read it in English or any language listed in the Eighth Schedule to the Constitution.
Withdrawal must be as easy as giving consent (section 6(4)). One tap to opt in and an email to customer support to opt out does not meet that test.
From 13 May 2027, Rule 3 also requires the notice behind each consent to be understandable on its own, to itemise the personal data and the specific purposes, and to give a link for withdrawing consent, exercising rights and complaining to the Data Protection Board.
Where the dark patterns rules overlap
The Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023 were notified on 30 November 2023 and list 13 practices.
Several of these map directly onto consent:
| Design practice | Consumer protection concern | DPDP consequence |
|---|---|---|
| "Accept" button prominent, "Reject" hidden | Interface interference | Consent may not be free |
| Repeated pop-ups after refusal | Nagging | Consent may not be free |
| Must share contacts to check out | Forced action | Consent not unconditional |
| Confusing double negatives | Trick question | Consent not informed |
| Unsubscribe buried in settings | Subscription trap | Withdrawal not as easy as consent |
One poor design can therefore breach both regimes, with exposure under each.
Large platforms: a three-year erasure clock
The Third Schedule to the DPDP Rules sets a specific erasure rule for e-commerce entities with at least two crore registered users in India. Where a user has not engaged with the platform for three years, counted from their last contact or from the commencement of the DPDP Rules, 2025, whichever is later, the platform must erase their personal data after giving 48 hours' notice. Rule 8 also requires at least one year's retention of related logs and traffic data. Because the Rules commenced on 13 November 2025, the earliest deletions could fall due in November 2028. If the clock is read as starting only when Rule 8 itself takes effect in May 2027, the first deletions fall due in May 2030. Platforms near the threshold should build the dormancy clock now.
Five steps for e-commerce teams
- Audit every consent prompt against section 6(1): sign-up, checkout, app permissions, cookies, WhatsApp opt-ins.
- Unbundle. Separate the purchase from marketing, personalisation and data-sharing consents.
- Make "Reject" equal to "Accept" in size, colour and position, and stop asking again after a refusal.
- Build one-tap withdrawal in the account settings, mirrored in every channel where consent was collected.
- Offer the consent text in the languages your customers shop in, starting with the languages your platform already supports.
Close
Consent under the DPDP Act is a product feature, and product teams will build it. Bring them into the compliance programme now, using the dark patterns list as a design checklist, so that the screens shipping in 2027 work under both laws.
Key takeaways
- DPDP consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6(1)).
- Withdrawal must be as easy as giving consent (s.6(4)).
- Dark patterns such as nagging, forced action and interface interference can also invalidate consent under the DPDP Act.
- E-commerce entities with two crore or more registered users must erase data of users inactive for three years, after 48 hours' notice.
- Consent requests must be available in English or any Eighth Schedule language (s.6(3)).
The DPDP Act in 15 Terms: A Plain-Language Glossary
Fifteen of the 28 definitions in section 2 of the DPDP Act decide whether your data is covered, who carries the duty and what counts as a breach.
Your First DPDP Task: A Data Inventory in Two Weeks
The DPDP Act never asks for a data inventory, yet notices, access requests, erasure, breach scoping and proof of consent all depend on one.
Run a Breach Tabletop Exercise Before May 2027
A 90-minute scripted drill, with injects from the first email to the 72-hour Board report, will show where your breach plan breaks before a real incident does.