Dark patterns refer to deceptive user interface designs employed by online services such as websites or applications to influence users to make decisions they otherwise might not. These misleading tactics are pervasive, extending from popular news websites to your favourite food delivery application. In response to the aforesaid issue, the Department of Consumer Affairs introduced Guidelines for Prevention and Regulation of Dark Patterns under Section 18 of the Consumer Protection Act, 2019 (“Guidelines”).
Their primary objective is to curb dishonest practices and promote transparency in the online marketplace. This marks a significant and commendable stride, considering that the Indian legal framework had been largely silent on dark patterns until now. The Guidelines define dark patterns as “any practices or deceptive design patterns using UI/UX (user interface/user experience) interactions on any platform; designed to mislead or trick users into doing something they originally did not intend or want to do; by subverting or impairing the consumer autonomy, decision making or choice; amounting to a misleading advertisement or unfair trade practice or violation of consumer rights.”
These Guidelines apply to (i) all platforms offering goods or services in India; (ii) to advertisers; and (iii) to sellers; and prohibit engagement in dark patterns by any person, including platforms. Dark patterns are influenced by human thinking and are designed deliberately to get you to click somewhere where you don't want to or get you to agree to something you don’t want to. Under the Guidelines, 13 (thirteen) deceptive patterns have been outlined as banned. The most common patterns include:
False Urgency: This dark pattern refers to an act of misleading a user into believing that there is a false sense of urgency or scarcity to persuade them to act quickly and make a purchase, e.g. showing false popularity of a product or service to influence a user’s decision. A lot of times, when users are adding products to their cart, there is an instant pop-up stating, “only a few items are left”, when in fact the product remains in stock even after weeks (sometimes even at reduced prices!).
Basket Sneaking: This dark pattern is the act of automatically adding extra items like products, services, charitable contributions or donations during the checkout process on a platform without the user's consent, resulting in an unintended increase in the total amount payable by the user. The most common example being the Rs. 1/- donation, which is automatically added during checking out and does not usually meet the eyes of the customers (given that the addition made to the cart is almost negligible).
Forced Action: This dark pattern refers to compelling a user to purchase extra items, subscribe to unrelated services, or share personal information just to access or buy the initially desired product or service. A very common example of ‘Forced Action’, is that of gated websites. There are numerous websites/applications which allow the users to access the information/data only after signing up. These are a means to collect personal data for targeted advertisements, et al.
Subscription traps: Also known as a “Roach Motel”, this pattern makes it difficult or impossible for users to cancel a subscription, such as by requiring them to call a customer service number or navigate through a complex maze of menus. There are several applications, which do not show the option of closing or de-activating the account in a straight-forward manner. In a market where every user is not tech savvy or has the patience of going through several steps to de-activate his/her account, the accounts of such users remain active, thereby granting perpetual access to their personal data.Punishment for engaging in Dark Patterns
Post induction of Guidelines, the Consumer Protection Act has inculcated an Annexure, namely Annexure 1, whereby penalties and punishments are prescribed for Dark Pattern practices reported till date. The said Guidelines are newly inducted and hence, are only indicative in nature and do not envisage an exhaustive list of all the Dark Pattern practices which may be devised by online aggregators and advertisers in the future.
Under the current regime, any non-compliance exposes Dark Pattern users to punishments, such as imprisonment for up to 6 months or a fine of up to ₹20 lakh, or both. This is in addition to the pre-existing punishments prescribed under the Consumer Protection Act, 2019 for false, deceptive and misleading advertisements floated around by Dark Pattern which are punishable with imprisonment up to 2 years and a fine of up to ₹ 10 lakh. The stringency of the said punishments increases many folds for Dark Pattern users who are identified as repeat offenders.
Anticipating the insurgency of new Dark Pattern practices in the future, the said guidelines are expected to mitigate such future practices by empowering consumers, civil society, and market players to report new instances of Dark Patterns, through an institutionalised and automated feedback mechanism, to the Department of Consumer Affairs. The Department, post evaluation, may notify and include the same in Annexure 1 of the said guidelines. This approach endeavours to encourage industry self-regulation with necessary proctoring by the Department of Consumer Affairs and ultimately aims to boost online consumer protection.
The internet is flooded with content aimed at grabbing attention, but there's a distinction between trustworthy content and manipulative tactics like subscription traps. Legislation like the Information Technology Rules of 2011 and the Digital Personal Data Protection Act of 2023 prioritises obtaining informed consent before collecting sensitive personal data.
To mitigate such unwarranted collection of data legislations, like the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 are enacted which specifically mandate the requirement of a user’s informed consent before their sensitive personal data is collected.
Similarly, the newly enacted Digital Personal Data Protection Act, 2023 places importance on obtaining explicit consent from the Data Principal before processing such data. Implicit or opt-out consent which lacks a clear, positive, and affirmative action is not considered valid under these regulations.
The Global trend towards prioritising a user’s free and informed consent is evident in data protection laws worldwide. For instance, in the US, the California Consumer Privacy Rights Act, 2020, and the California Consumer Privacy Act, 2018 and in the EU, legislations such as the General Data Protection Act, the Digital Services Act, the Digital Markets Act, and the Unfair Commercial Practices Directive recognize dark patterns and discourage their usage by rendering consent obtained through them invalid, which in turn, provides safeguards against such manipulative tactics online.
Notably, the French Data Protection Act resulted in a €8 million fine on Apple for implementing the ‘personalised ads’ setting as the default without prior consent thereby making it challenging to change the setting through multiple steps. Another such instance of dark patterns is observed on the online platform of an e-Commerce Giant which makes it challenging for a user to disband its account once created, thus creating a vicious trap.
In conclusion, despite the enactment of the Digital Personal Data Protection Act in 2023, there is still a notable gap in safeguarding against Dark Patterns. The Act does not directly address the interfaces or designs utilised by Dark Patterns operators, who often manipulate user experience under the pretext of creative freedom. Consequently, such designs evade classification under deceptive advertising or personal data piracy, highlighting the need for further regulatory measures.
—The authors; Juhi Khanna, is Senior Associate in the Corporate and Commercial practice, and Manbhar Mittal and Aman Jhawar, are associates in the Dispute Resolution & ADR practice, at law firm Gravitas Legal.
(Edited by : C H Unnikrishnan)
First Published: Mar 7, 2024 10:30 AM IST
