![\"\"](\"https:\/\/onyxdigi.com\/blog\/wp-content\/uploads\/2026\/08\/02-twenty-lakh-ledger-654x1024.png\")
<\/figure>\n\n\n\n- \n
- Zepto took the largest fine at seven lakh<\/strong>, for two separate things. Handling charge<\/strong>s that surfaced at checkout after you had already committed to a lower price, which is drip pricing<\/strong>. And a membership that added itself to your cart, which is basket sneaking<\/strong>.
<\/li>\n\n\n\n- Physics Wallah paid five lakh<\/strong>, and this one the CCPA opened on its own rather than waiting for a complaint. A ten rupee donation to the PW Foundation came pre-selected, wrapped in copy engineered to make unticking it feel petty. Separately, the “free” courses were not free in the sense students assumed, because you had to hand over personal information before you could reach them. That is three patterns stacked in one flow: basket sneaking, confirm shaming, forced action.
<\/li>\n\n\n\n- Anuj Jindal, the coaching platform, paid three lakh for false urgency<\/strong>. Timers that were not counting down toward anything real.
<\/li>\n\n\n\n- FirstCry paid two lakh for drip pricing.<\/strong>
<\/li>\n\n\n\n- PharmEasy paid one lakh for dropping membership plans<\/strong> into carts that nobody asked for.
<\/li>\n\n\n\n- McAfee paid one lakh for interface interference<\/strong>. Renewal screens built on fear, and consent flows confusing enough that agreeing was simply the faster way out.
<\/li>\n\n\n\n- SpiceJet paid one lakh for pre-ticked boxes that enrolled customers into SpiceClub<\/strong> and its promotional mail. Rule 4(9) of the E-Commerce Rules has said since 2020 that a tick the user did not make is not consent. This was not a grey area.
<\/li>\n\n\n\n- IndiGo received a notice, no fine. <\/strong>When you declined travel protection, the opt-out button read “No I will take risk.” That is confirm shaming written by somebody who knew precisely what they were doing, because the alternative phrasing was available and free. It now reads “No, I will not add to the trip.”
<\/li>\n\n\n\n- BookMyShow received a notice, no fine. <\/strong>A one rupee donation to BookASmile, pre-ticked at checkout. Removed after the intervention.<\/li>\n<\/ul>\n\n\n\n
The fine is the least interesting number in the story<\/h2>\n\n\n\n
In September last year, Amazon settled with the American FTC for two and a half billion dollars over a single cancellation flow inside Prime. Epic Games paid five hundred and twenty million over Fortnite’s purchase screens. Measured against those, twenty lakh is not a deterrent. It is a receipt.<\/strong><\/p>\n\n\n\n
The number worth reading is buried elsewhere in the same reply: forty two notices issued. Nine companies got named in Parliament. Thirty three did not. Add the standing Joint Working Group that the Department set up with members drawn from MeitY, IRDAI, Civil Aviation and half a dozen other regulators, the self audit advisory that went out in June 2025 with a three month window, and the URL scanning dashboard that now sits behind the Jagriti app, and the direction of travel is not ambiguous.<\/p>\n\n\n\n
Then look at how widespread the practice actually is. LocalCircles audited 290 major Indian platforms through the second half of 2025 and found dark patterns on 97 percent of them. Meesho was the only platform that cleared every check. Separately, ASCI Academy went through more than twelve thousand screens across 53 apps and found deceptive patterns in 52, averaging 2.7 per app. Health tech was the worst offender at 8.8 patterns per app, with travel and e-commerce behind it.<\/p>\n\n\n\n
So the honest summary is this. Almost every consumer app in the country is doing some version of what these nine were caught doing. The regulator has started naming names. And the price of being named is currently trivial. That gap between prevalence and penalty is the whole story, and gaps like that close. They always do, usually faster than the companies sitting inside them expect.<\/p>\n\n\n\n
The uncomfortable part for designers<\/h2>\n\n\n\n
I have argued before that dark patterns<\/strong> are efficient, and I stand by it. That is the entire problem. Nobody ships a pre-ticked donation box by accident. Somebody ran the test, watched conversion move, wrote a triumphant Slack message, and shipped it. The pattern survives because it works in the window most teams measure.<\/p>\n\n\n\n
The test I keep coming back to is embarrassingly simple. Would the user thank you for this design if they understood it completely? A countdown sitting on genuinely limited seat inventory passes that test. A countdown that resets when you hit refresh fails it. Both of them move the same number this quarter, which is exactly why the question has to be asked before the test is run rather than after.<\/p>\n\n\n\n
We work with a framework I built called TAPE: trust, attach, persuade, emotion. The order is the argument. Trust comes first, and every technique that follows is borrowing against it. Persuasion applied before trust exists reads as pressure. The same persuasion applied after trust exists reads as helpfulness. Identical mechanism, opposite result, and the only variable is whether the user believes you are on their side of the transaction.<\/p>\n\n\n\n
Dark patterns invert that order. They persuade first and spend trust to fund it. The bill shows up later, denominated in refunds, chargebacks, support volume, one star reviews about billing, and the quiet attrition of people who cannot quite articulate why they stopped opening your app.<\/p>\n\n\n\n
What to do on Monday morning<\/h2>\n\n\n\n
Start with the three patterns the CCPA has actually fined companies for. Drip pricing, basket sneaking, confirm shaming. Every rupee of that twenty lakh went to one of the three. Open your own checkout on a phone, on a slow connection, and watch whether the total changes between the product page and the payment screen. If it moves, you have a problem that a regulator can price.<\/p>\n\n\n\n
Remove every pre-ticked box. Not soften, not relabel, not move lower on the page. Remove.<\/p>\n\n\n\n
![\"\"](\"https:\/\/onyxdigi.com\/blog\/wp-content\/uploads\/2026\/08\/03-enforcement-gap-819x1024.png\")
<\/figure>\n\n\n\nRead your decline copy aloud. If the negative option would sound rude coming out of a human mouth, it is confirm shaming, and the rewrite costs you nothing but an afternoon.<\/p>\n\n\n\n
Count the taps from signup to active subscription, then count them from active subscription to cancelled. If the second number is larger, you are running a small version of the flow that cost Amazon two and a half billion dollars.<\/p>\n\n\n\n
After that, go through the remaining ten patterns in Annexure I of the 2023 guidelines. Trick questions, SaaS billing, nagging, disguised advertisement, bait and switch, subscription traps, rogue malware and the rest. The list is public. The government has told you in advance what it intends to look for, which is more warning than most regulation offers.<\/p>\n\n\n\n
Write down what you found and what you changed, with dates. When a notice arrives, a documented remediation trail is worth considerably more than a defence built after the fact.<\/p>\n\n\n\n
Where we come in<\/h2>\n\n\n\n
We built the 122 Point CRO Checklist at Onyx well before any of this was regulated, because these flows were already quietly costing our clients money. Roughly a third of that checklist maps onto the CCPA’s thirteen patterns almost line for line. That overlap was not planned. It turns out the interactions regulators call deceptive are usually the same ones that inflate your refund rate and depress your repeat purchase numbers.<\/p>\n\n\n\n
![\"\"](\"https:\/\/onyxdigi.com\/blog\/wp-content\/uploads\/2026\/08\/04-confirm-shaming-before-after-1024x768.png\")
<\/figure>\n\n\n\nWhat we run is a single audit that answers two questions at once: where you are exposed, and where you are leaking revenue. We go through every acquisition, onboarding and checkout flow against Annexure I, mark each finding as a violation, a grey area or clean, and hand back a prioritised remediation plan with estimated revenue impact attached to each fix rather than vague severity labels. Then we redesign the flows that need it and test the replacements properly, because the objection I hear in almost every room is that the honest version will convert worse.<\/p>\n\n\n\n
Occasionally it does, for a week or two. In the work we have done across e-commerce, fintech and edtech, the honest version usually holds conversion and improves retention, because you stop acquiring people who feel tricked and leave in month two. I would rather demonstrate that with your own funnel data than ask anyone to accept it as a principle.<\/p>\n\n\n\n
If you are currently in a meeting arguing about whether to remove a pre-ticked box, the calculation has changed. Seven companies just found out what the other side of that argument looks like, and the next seven will pay more.<\/p>\n\n\n\n
We are at onyxdigi.com. If you would like your checkout examined before somebody in Delhi examines it, that is the work we do.<\/p>\n\n\n\n
\n\n\n\nAmolendu Hajraa is the founder of Onyx UX Studio, an AI native product design and CRO consultancy working across India, the UAE and Saudi Arabia. He is the author of four books on UX, including Success Centered Design and The AI Powered UX Designer.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
On 4 August, in a written reply to the Rajya Sabha, the Minister of State for Consumer Affairs put a number on India’s first real enforcement drive against dark patterns. Twenty lakh rupees. Split across seven companies. That is about twenty three thousand dollars, which is less than most of those companies spend on a single week of performance marketing.<\/p>\n
I want to start with a correction, because the headlines got this wrong and I would rather be accurate than fast. Nine platforms were named in that reply. Seven were fined. Two of them, IndiGo and BookMyShow, received notices, fixed their screens, and paid nothing. The version that travelled across timelines was “nine platforms penalised.” That is not what happened, and the difference matters if you are one of the two.<\/p>\n","protected":false},"author":1,"featured_media":239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,22,20,5,21,24,3],"tags":[],"class_list":["post-234","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-in-design","category-cro","category-edtech-ux","category-fintech-ux","category-insurtech-ux","category-ui-design","category-ux"],"_links":{"self":[{"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/posts\/234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/comments?post=234"}],"version-history":[{"count":3,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/posts\/234\/revisions"}],"predecessor-version":[{"id":242,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/posts\/234\/revisions\/242"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/media\/239"}],"wp:attachment":[{"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/media?parent=234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/categories?post=234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/onyxdigi.com\/blog\/wp-json\/wp\/v2\/tags?post=234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Physics Wallah paid five lakh<\/strong>, and this one the CCPA opened on its own rather than waiting for a complaint. A ten rupee donation to the PW Foundation came pre-selected, wrapped in copy engineered to make unticking it feel petty. Separately, the “free” courses were not free in the sense students assumed, because you had to hand over personal information before you could reach them. That is three patterns stacked in one flow: basket sneaking, confirm shaming, forced action.