Dark Patterns explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The last five specified dark patterns in Annexure 1 are disguised advertisement, nagging, trick question, SaaS billing and rogue malware. They cover content that hides its commercial nature, repeated interruptions, deliberately confusing wording, recurring charges taken silently and scareware. As with the other items, the Annexure says its practices and illustrations "provide only guidance and shall not be construed as an interpretation of law or as a binding opinion or decision".
The guidelines were issued by the Central Consumer Protection Authority (CCPA) on 30 November 2023 under section 18 of the Consumer Protection Act, 2019. This article takes them as amended up to 3 October 2026 (no amendment listed by the CCPA). Later amendments should be checked on the CCPA website. The scope is in the article on guidelines 1 to 7; items 1 to 4 and 5 to 8 are in the first and second articles. This article quotes no penalty.
A disguised advertisement poses as other content, such as user-generated content or news articles, to blend in and trick people into clicking; the seller or advertiser who posts it must disclose that it is an advertisement. Nagging is repeated, persistent interruptions to complete a transaction and make commercial gains, unless the user permits them. A trick question uses confusing or vague wording or double negatives. SaaS billing collects recurring payments from software users surreptitiously. Rogue malware uses ransomware or scareware to trick users into paying. Each has a plain test and a clean alternative.
Platforms, publishers and software businesses that want these five patterns checked in their product can ask for compliance advisory support before a new release.
Item 9: disguised advertisement
The definition
"Disguised advertisement" means "a practice of posing, masking advertisements as other types of content such as user generated content or new articles or false advertisements, which are designed to blend in with the rest of an interface in order to trick customers into clicking on them".
The Explanation
- (a) the expression also includes a misleading advertisement as defined in section 2(28) of the Act, and the 2022 Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements also apply to it;
- (b) in relation to content posted by a seller or an advertiser on a platform, the responsibility of making the disclosure that such content is an advertisement is on that seller or advertiser.
Item 9 prints no separate illustrations. An invented example: a shopping app shows a "Reader review" that is in fact a paid brand post, styled to match genuine customer reviews. It is an advertisement posing as user-generated content. Under Explanation (b), the seller or advertiser who posted it must disclose that it is an advertisement. For the endorsement and disclosure rules, see the article on guidelines 13 to 15 of the 2022 guidelines.
A compliant alternative: label paid content clearly as an advertisement, in a visible place, in language the user understands.
Item 10: nagging
The definition
"Nagging" means a dark pattern practice "due to which a user is disrupted and annoyed by repeated and persistent interactions, in the form of requests, information, options, or interruptions, to effectuate a transaction and make some commercial gains, unless specifically permitted by the user".
The printed illustrations
- (a) websites asking a user to download their app again and again;
- (b) platforms asking users to give phone numbers or other personal details for supposedly security purposes;
- (c) constant requests to turn on or accept notifications or cookies with no option to say "NO".
A compliant alternative: ask once, offer a clear "No" that is respected and do not ask again unless the user permits. Collect only the personal details that are needed. For personal data law, see the post on DPDP Act for e-commerce companies.
Item 11: trick question
The definition
"Trick Question" means "the deliberate use of confusing or vague language like confusing wording, double negatives, or other similar tricks, in order to misguide or misdirect a user from taking desired action or leading consumer to take a specific response or action".
The printed illustration
- (a) while giving a choice to opt, "Do you wish to opt out of receiving updates on our collection and discounts forever?" with answers such as "Yes. I would like to receive updates" and "Not Now", instead of a simple "Yes" option.
The confusion arises because the question asks about opting out while the answer "Yes" is worded as opting in, and "Not Now" does not clearly mean "No".
A compliant alternative: ask a plain question with plain answers: "Do you want to receive updates? Yes / No."
Item 12: SaaS billing
The definition
"SaaS billing" refers to "the process of generating and collecting payments from consumers on a recurring basis in a software as a service (SaaS) business model by exploiting positive acquisition loops in recurring subscriptions to get money from users as surreptitiously as possible".
The printed illustrations
- (a) no notification is given to the user when a trial at no charge is converted to paid;
- (b) silent recurring transactions in which the user's account is debited without being notified, or auto-renewing monthly subscriptions without telling users;
- (c) charging customers for features and services they do not use;
- (d) using shady credit card authorisation practices to deceive consumers.
A compliant alternative: tell users before a trial ends and before each renewal, show what is being charged and for what, and use clear authorisation steps. The related subscription trap in item 5 is in the previous article.
Item 13: rogue malwares
The definition
"Rogue Malwares" means "using a ransomware or scareware to mislead or trick user into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on their computer".
The printed illustrations
- (a) a pirating website or app promises content without charge but leads to embedded malware when the link is accessed;
- (b) consumers who gain access to content on pirated platforms keep getting pop-ups with advertisements embedded with malware;
- (c) consumers are prompted to click on an advertisement or are automatically redirected to one, but find their personal files locked, followed by a demand for payment to regain access.
A compliant alternative: do not run scareware or malware-linked advertisements at all. A platform that carries third-party advertisements should screen them.
Summary of all 13 specified dark patterns
| Item | Pattern | One-line test |
|---|---|---|
| 1 | False urgency | Is the scarcity or popularity message untrue? |
| 2 | Basket sneaking | Was something added at checkout without consent? |
| 3 | Confirm shaming | Do the words create fear, shame, ridicule or guilt to push a purchase? |
| 4 | Forced action | Must the user buy, subscribe or share data beyond the original purchase? |
| 5 | Subscription trap | Is cancellation hard, hidden or unclear? |
| 6 | Interface interference | Does design highlight one option and hide another? |
| 7 | Bait and switch | Is a different outcome served from the one advertised? |
| 8 | Drip pricing | Is the price revealed late or higher than shown? |
| 9 | Disguised advertisement | Is an advertisement posing as other content without disclosure? |
| 10 | Nagging | Is the user repeatedly interrupted without permission? |
| 11 | Trick question | Is the wording deliberately confusing? |
| 12 | SaaS billing | Are recurring charges taken silently or for unused features? |
| 13 | Rogue malwares | Is scareware or malware used to extract payment? |
Need help with subscription, notification or advertising design?
Silent renewals, repeated pop-ups and unlabelled advertisements can lead to complaints and regulatory attention. Our compliance advisory team can review your product screens and billing notices against items 9 to 13 and suggest plain, compliant alternatives.
Key takeaways
- A disguised advertisement poses as other content; the seller or advertiser must disclose that it is an advertisement.
- Nagging is repeated, persistent interruption to effect a transaction, unless the user permits it.
- A trick question deliberately uses confusing or vague wording or double negatives.
- SaaS billing collects recurring payments surreptitiously, including silent conversion from a trial at no charge, silent renewals and charges for unused features.
- Rogue malware uses ransomware or scareware to trick users into paying.
- The Annexure's illustrations are guidance only; the CCPA may specify other dark patterns.
Read next
- Guidelines 1–7: definitions, application and prohibition
- Annexure 1, items 5–8: subscription trap, interface interference, bait and switch, drip pricing
- Guidelines 13–15: endorsements, due diligence and material connection
- CCPA guidelines on dark patterns 2023: overview
Disclaimer: Based on the rules, regulations and guidelines named above as published in the Gazette of India or on the CCPA website, with the amending notifications the article names (consulted on 3 October 2026). Later amendments, the Consumer Protection Act, 2019 provisions referred to, State rules and CCPA advisories should be checked. This article is general information, not legal advice; check the official text before acting.