# Dark Patterns Guidelines 2023: An Audit Checklist for Apps

> Updated 2026-10-25 - 9 min read

India's Central Consumer Protection Authority (CCPA) - not to be confused with California's privacy law of the same acronym - issued its Guidelines for Prevention and Regulation of Dark Patterns on November 30, 2023, under Section 18 of the Consumer Protection Act, 2019. The guidelines name 13 types of dark patterns as unfair trade practices, and the list is explicitly non-exhaustive - the CCPA can add more. This checklist covers the patterns most relevant to a typical app or e-commerce site.

## Patterns to check for

- False urgency - fake countdown timers or "only 2 left" claims not based on real inventory or time pressure
- Basket sneaking - adding items, warranties or services to a cart without the user's clear consent
- Confirmshaming - guilt-tripping language on a decline or opt-out option ("No thanks, I don't want to save money")
- Forced action - requiring an unrelated action (a forced app install, a forced subscription) to complete an unrelated task
- Subscription trap - making cancellation deliberately hard to find or complete, compared to signing up
- Interface interference - visually obscuring, pre-selecting or disguising an option the user would reasonably want to see clearly
- Bait and switch - advertising one product, price or outcome and delivering a different one
- Drip pricing - not disclosing mandatory fees upfront, revealing them only late in checkout
- Disguised advertisement - content styled to look like organic content or navigation that is actually a paid placement
- Nagging - repeated, intrusive requests for the same action after a user has already declined it
- Trick questions - confusing wording, including double negatives, that leads a user toward an unintended answer
- SaaS billing patterns - recurring-payment structures in software subscriptions designed to exploit a free-trial or low-friction signup
- Rogue malware - fake virus warnings or scareware used to sell an unnecessary "removal" product or service

## Where to check first

- Checkout and payment flows - drip pricing and basket sneaking concentrate here
- Subscription signup and cancellation - subscription traps and forced action are most common here
- Cookie/consent banners and account deletion - interface interference and confirmshaming show up in both
- Pop-ups, countdowns and stock indicators across the site - false urgency

## Enforcement basis

Practices that match the guidelines are treated as misleading advertisement and unfair trade practice under the Consumer Protection Act, 2019, with penalties under Section 89. There's no separate penalty schedule specific to the dark-patterns guidelines themselves - enforcement runs through the Act's existing unfair-trade-practice and misleading-advertisement provisions.

## This list is a starting point, not the final word

The CCPA's guidelines explicitly state the list of 13 is not exhaustive. For the authoritative, complete text of all 13 named patterns, refer to the official CCPA notification rather than any third-party summary, including this one.

## FAQ

**Is India's CCPA the same as California's CCPA?**
No - India's CCPA is the Central Consumer Protection Authority, a regulator under the Consumer Protection Act, 2019. California's CCPA is the California Consumer Privacy Act, an unrelated US privacy law. The shared acronym is a coincidence that causes real confusion.

**What's the penalty for a dark pattern violation?**
There's no separate penalty schedule specific to the dark-patterns guidelines - enforcement runs through the Consumer Protection Act's existing misleading-advertisement and unfair-trade-practice provisions, including penalties under Section 89.

**Do these guidelines apply to apps, or just websites?**
Both - the guidelines apply to any platform used for the sale of goods or services, which covers apps and e-commerce websites alike.