You know the funnel. Seven days free, a card on file, a run of notifications, and a charge on day eight that you did not quite agree to. In India that funnel has a legal name. It has had one since November 2023. It is called a subscription trap, and it is an unfair trade practice.
On 5 August 2026 the government told the Rajya Sabha how much that has cost the industry so far.
THE VERDICT
The drafting is among the best consumer work India has produced this decade. Thirteen patterns, named and defined. The enforcement attached to it totals Rs 20 lakh across nine platforms in nearly three years.
Twenty lakh rupees. Across every digital platform in the country. Since November 2023.
What did India actually ban?
The Central Consumer Protection Authority notified the Guidelines for Prevention and Regulation of Dark Patterns on 30 November 2023. This is the part people skip, and it is the part worth respecting.
The Guidelines do not gesture at manipulation in general. They name thirteen specific patterns and define each one. False urgency. Basket sneaking. Confirm shaming. Forced action. Subscription trap. Interface interference. Bait and switch. Drip pricing. Disguised advertisement. Nagging. Trick question. SaaS billing. Rogue malware.
Naming things is not a small regulatory achievement. A rule against “misleading design” is a rule nobody can enforce and everybody can argue with. A rule that says basket sneaking and then describes it is a rule an investigator can open a laptop and check.
The definition of a dark pattern in the Guidelines is equally precise. Practices deployed in the user interface or user experience that are designed to mislead or trick users into doing something they did not originally intend, that subvert or impair consumer autonomy, decision making or choice, and that amount to a misleading advertisement, an unfair trade practice, or a violation of consumer rights.
THE PART NOBODY GIVES CREDIT FOR
A rule against manipulative design is unenforceable. A rule that says basket sneaking, then defines it, is something an investigator can open a laptop and check. India named thirteen. That is the good half of this story.
What is a subscription trap, in the regulator’s words?
Indirectly forcing users to keep a subscription. Making cancellation impossible or complex. Hiding the cancellation option. Requiring payment details or authorisation to access a free trial.
That last clause is the free-trial funnel, described precisely, in a government instrument, two and a half years ago. Anyone building one in India has been building something the law has a word for.
We have written before about how the traps themselves are built. This piece is about what happens to the people who build them.
Who has actually been fined?
Nine platforms have been acted against. Seven of them paid something. Here is the entire enforcement record, as the government set it out for Parliament.
Every dark pattern penalty the CCPA has imposed
Rs lakh, per platform. IndiGo and BookMyShow were acted against without a penalty.
The seven penalties sum to the Rs 20 lakh total the government gave Parliament. Source: Free Press Journal, 5 August 2026, reporting the Rajya Sabha written reply; PIB, 3 June 2026, for the PhysicsWallah and McAfee orders.
| Platform | Penalty | What the CCPA found |
|---|---|---|
| Zepto Marketplace | Rs 7 lakh | Handling charges and a membership fee added after the initial price was shown. Classified as drip pricing and basket sneaking. |
| PhysicsWallah | Rs 5 lakh | A Rs 10 donation to its PW Foundation pre-selected at checkout, plus messaging that discouraged removing it. Basket sneaking, confirm shaming, forced action. |
| Anuj Jindal | Rs 3 lakh | False urgency. Reported as a misleading 24-hour countdown timer. |
| FirstCry | Rs 2 lakh | Drip pricing. |
| PharmEasy | Rs 1 lakh | Membership plans automatically added to consumers’ carts. |
| McAfee | Rs 1 lakh | A subscription renewal interface that gave consumers no neutral choice. Confirm shaming, interface interference, trick question, forced action. |
| SpiceJet | Rs 1 lakh | Not itemised separately in the reporting. |
| IndiGo | No penalty | Confirm shaming on its mobile app. Corrected after the CCPA acted. |
| BookMyShow | No penalty | A pre-ticked Re 1 contribution to BookASmile. Removed after the CCPA acted. |
Add the seven penalties up. Seven, five, three, two, one, one, one. Twenty lakh, exactly.
Total penalties imposed by the CCPA for dark patterns since the Guidelines were notified on 30 November 2023
Source: Ministry of Consumer Affairs written reply, Rajya Sabha, reported by ANI and Free Press Journal, 5 to 6 August 2026.
Is twenty lakh a lot?
It is less than the regulator was allowed to impose on a single company, once.
Under section 21 of the Consumer Protection Act 2019, the CCPA can impose up to Rs 10 lakh for a false or misleading advertisement, and up to Rs 50 lakh for each subsequent contravention. Those are the tools available.
The largest dark pattern penalty issued so far is Rs 7 lakh. Not one order has reached the first-offence ceiling. The total across nearly three years and nine platforms is twice what a single first offence could have cost one of them.
Not one order has reached the first-offence ceiling.
Set that against what the patterns earn. Zepto’s finding was handling charges and a membership fee appearing after the price. That is revenue per order, on a platform doing orders at quick-commerce volume. Rs 7 lakh is not a number that appears in a discussion about whether to keep the design.
What the Guidelines promise against what the file shows
On paper
- Thirteen dark patterns named and defined
- Dark patterns are unfair trade practices
- Penalties up to Rs 10 lakh, then Rs 50 lakh
- Platforms formally told to self-audit in June 2025
In the enforcement record
- Nine platforms acted against in nearly three years
- Seven penalties, totalling Rs 20 lakh
- Largest single penalty Rs 7 lakh, below the first-offence ceiling
- Most orders end in discontinuation rather than money
Why the McAfee order is the one to read
Because it is the funnel from the top of this article, written down by a regulator.
The CCPA examined McAfee’s subscription renewal process and found that consumers were not given a neutral choice about whether to renew. The renewal option was given greater visual prominence. The design of the interface, in the authority’s words, created pressure on consumers to continue their subscriptions.
Four dark patterns were identified in that one flow: confirm shaming, interface interference, trick question, forced action. McAfee was directed to ensure no dark patterns are employed on its platform, website, application or any other digital interface.
The penalty was Rs 1 lakh.
A design review at a company that size costs more than the fine for skipping it. That is the entire problem in one line, and no amount of good drafting upstream fixes it.
What is the CCPA actually doing about it?
THE CASE FOR THE REGULATOR
Measured in rupees the regime looks weak. Measured in interfaces changed it does not. The CCPA moved on PhysicsWallah without waiting for a complaint, and nine of India’s most-used consumer flows were altered: Zepto dropped the pattern, PhysicsWallah paid and dropped it, IndiGo changed its prompt, BookMyShow removed the pre-ticked contribution. Deterrence and correction are different jobs, and this regime is doing the second one.
There is a real case for the regulator here, and the file supports it.
The CCPA took suo motu cognisance of PhysicsWallah, meaning nobody had to complain first. It issued an advisory on 5 June 2025 telling e-commerce companies and digital platforms to self-audit their interfaces and remove dark patterns. And the outcome it reports on most orders is not the money. It is discontinuation.
Zepto discontinued the pattern. PhysicsWallah deposited the penalty and discontinued the pattern. IndiGo changed its prompt. BookMyShow removed the pre-ticked contribution.
Judge the regime on behaviour changed rather than rupees collected and it looks considerably better. Nine of India’s most-used consumer interfaces were altered. That is not nothing.
So does the law work?
It works exactly as far as a company’s compliance instinct carries it, and no further.
A platform that wants to be clean now has something it never had: thirteen named patterns, published definitions, worked examples with named companies, and a self-audit it was formally asked to run. There is no longer any version of “we did not know that counted”.
A platform that does not want to be clean has learned something too. The pattern runs until somebody notices. Noticing takes years. The bill, when it comes, is smaller than one week of the revenue the pattern produced. Then you turn it off and the file closes.
Both of those are true at once, and pretending otherwise is how this stuff gets written badly. The Guidelines are among the better pieces of consumer drafting India has produced this decade. The enforcement attached to them is currently a rounding error on a quarterly P&L.
Thirteen patterns are named and defined, with published orders naming real companies. The June 2025 self-audit advisory removed the last honest version of we did not know that counted. Price the risk properly though: every company in the record has now been formally told, so a second finding is a subsequent contravention and the ceiling jumps from Rs 10 lakh to Rs 50 lakh.
If a free trial asks for your card before it gives you anything, Indian law has a name for that. It is a subscription trap, and it is an unfair trade practice. Complaints work: the CCPA acted on IndiGo after complaints, and it opened the PhysicsWallah case on its own.
What would change it?
Nothing in this record suggests the regulator lacks powers. It suggests it has not used the top of the range it already holds.
The ceiling for a subsequent contravention is Rs 50 lakh. Every company in that table has now been told, formally and in writing, that dark patterns are unfair trade practices. Any of them found doing it again is a subsequent contravention, and the arithmetic changes by an order of magnitude.
Whether it does is the only question worth watching. Until then, the honest read on India’s dark patterns regime is that the law is good, the naming is good, and the price of ignoring it is Rs 1 lakh a flow.
Sources: Guidelines notification date, the thirteen named patterns, the June 2025 self-audit advisory, and the PhysicsWallah and McAfee orders including the dark patterns identified in each: Press Information Bureau, Ministry of Consumer Affairs, Food and Public Distribution, 3 June 2026. The Rs 20 lakh total, the Rajya Sabha written reply by Minister of State B.L. Verma, and the list of platforms: ANI, 6 August 2026. The itemised penalties per platform, and the IndiGo and BookMyShow outcomes: Free Press Journal, 5 August 2026. Penalty ceilings: section 21, Consumer Protection Act 2019.
