Dark Patterns in Cookie Banners: India's Rules and How to Fix Them

The short answer

In India, a consent banner has to satisfy two sets of rules at once:

1. The Guidelines for Prevention and Regulation of Dark Patterns, 2023, issued by the Central Consumer Protection Authority (CCPA) on 30 November 2023 under the Consumer Protection Act, 2019.
2. The DPDP Act 2023, which says consent must be free, specific, informed, unconditional and unambiguous (Section 6(1)), and that withdrawing must be as easy as giving it (Section 6(4)).

A banner that tricks people into clicking “Accept” fails both.

The 13 dark patterns in India’s guidelines

The CCPA guidelines apply to all platforms offering goods or services in India, as well as advertisers and sellers. They list 13 specified dark patterns:

1. False urgency
2. Basket sneaking
3. Confirm shaming
4. Forced action
5. Subscription trap
6. Interface interference
7. Bait and switch
8. Drip pricing
9. Disguised advertisement
10. Nagging
11. Trick question
12. SaaS billing
13. Rogue malwares

Five of these show up again and again in consent banners.

Five banner patterns to remove

Interface interference: a bright Accept and a hidden Reject

The most common problem. “Accept all” is a big coloured button while “Reject” is grey text or buried in a settings screen. This pushes the user towards one choice, which is the opposite of free consent under Section 6(1).

Fix: give Accept and Reject the same size, colour weight and position on the first screen.

Forced action: no consent, no access

Blocking the whole site until someone accepts marketing cookies forces a choice. Under the DPDP Act, consent must be unconditional, and you cannot make a service depend on consent to data it does not need.

Fix: let people use the site after rejecting non-essential cookies.

Confirm shaming: guilt-trip wording

“No thanks, I don’t care about a better experience” is confirm shaming.

Fix: use neutral labels such as “Accept” and “Reject”.

Nagging: asking again and again

Showing the banner on every page after someone has said no wears them down until they accept.

Fix: remember the choice, and only ask again when your purposes change.

Trick question: confusing wording

Double negatives (“Uncheck to not opt out”) or pre-ticked boxes make it unclear what the user agreed to. The DPDP Act requires a clear affirmative action, so a pre-ticked box is not consent.

Fix: every purpose starts unticked, in plain language.

A banner that passes: checklist

• Accept and Reject are equal on the first screen.
• No purpose is pre-ticked.
• Each purpose is listed separately, as Section 5 requires.
• Analytics and ad scripts stay blocked until consent. See consent before ads and tracking scripts.
• Users can read the notice in English or any of the 22 Eighth Schedule languages if they choose.
• A link or button to change or withdraw consent is always available.
• You keep proof of what each person saw and chose (Section 6(10)).

What happens if you get it wrong

Dark patterns are handled by the CCPA under consumer protection law. Consent failures under the DPDP Act fall under the Board’s general penalty cap of up to ₹50 crore in the Schedule. The ₹250 crore figure you may have seen applies only to failing reasonable security safeguards under Section 8(5). Estimate your exposure with the free penalty calculator.

Check your banner now

Run the free DPDP website scanner to see whether trackers fire before consent. ConsentPlix banners are built with equal choices, no pre-ticked boxes and one-click withdrawal by default. Try it free.

Dark patterns list from the CCPA Guidelines, 2023. DPDP references checked against Act No. 22 of 2023, as of October 2026.