Consumer Protection In The Age Of AI
Author: LawSphereX
Category: Technology & Cyber Law
Published:
Updated:
CONSUMER PROTECTION IN THE AGE OF AI
Srishti Singh, LLM (IPR & Technology Law) O.P. Jindal Global University
ABSTRACT
Artificial intelligence now mediates ordinary consumer transactions in India through bundled device features, AI-mediated services, and platform interfaces that rank, price, and nudge choices across mobility, retail, finance, and health. This study asks who should bear legal responsibility when AI systems cause consumer harm, identifies the Consumer Protection Act, 2019 as the core statutory pathway, and integrates supporting instruments including the Consumer Protection (E-Commerce) Rules, 2020, the Guidelines for Prevention of Misleading Advertisements, 2022, the Guidelines for Prevention and Regulation of Dark Patterns, 2023, the Information Technology Act, 2000 with the Intermediary Rules, 2021, and the Digital Personal Data Protection Act, 2023.
It treats standardized AI modules as “goods” and bespoke deployments as “services” for pleading under product liability or deficiency in service, and allocates liability across manufacturers, service providers, sellers, and marketplaces according to control, knowledge, and representations. It consolidates enforcement, applications, and data-protection interplay into a single remedial track that uses consumer commissions for compensation and injunctive orders, and the Central Consumer Protection Authority for recall and corrective advertising. Real-world enforcement on differential pricing, misleading advertisements, and device defects shows that doctrinal hooks already exist. A safety-critical scenario on driver-assist malfunction illustrates interim orders such as feature toggles and warning banners.
The paper proposes a role–head– remedy matrix, a discovery checklist tailored to algorithmic systems, model prayers for relief, and targeted Suggestions, including audit-linked safe harbours and structured data-sharing between the DPDP Board and the CCPA to avoid duplicative proceedings. The goal is fast, accurate redress for consumers while preserving pathways for trustworthy AI development.
Introduction
AI reaches Indian consumers through bundled software in devices, AI-mediated services, and platforms whose interfaces steer choice and price, placing disputes within the Consumer Protection Act, 2019 for goods, services, unfair trade practices, and product liability. 1 Product liability in Chapter VI structures design defect, failure to warn, and breach of express warranty claims when model-driven features malfunction or mislead, while the Central Consumer Protection Authority can order recall and corrective advertising where harms scale across users.
2 The E-Commerce Rules bind marketplaces and inventory models, the Misleading Advertisements and Dark Patterns Guidelines target interface deception, the IT Act and Intermediary Rules set due-diligence baselines for platforms, and the DPDP Act supplies consent, access, and erasure rights that intersect with personalization disputes at the point of harm. 3 This study proceeds doctrinally and uses real enforcement and a safety-critical scenario to test remedies across commissions and the CCPA.
4 Roadmap: section 2 sets the legal framework that answers which provisions of the CPA, 2019 are most relevant; section 3 addresses whether AI is a product or service; section 4 allocates responsibility across the AI chain, including a matrix; section 5 merges enforcement, applications, and DPDP interplay; section 6 sets out procedure, evidence, and remedies with model prayers and interim orders; section 7 states four landmark cases; section 8 provides Suggestions; section 9 concludes by restating how each question is answered. 5 Legal Framework under CPA 2019 and Connected Instruments The CPA, 2019 defines product liability and creates distinct grounds against manufacturers, product sellers, and service providers, enabling pleading of design defect, manufacturing defect, failure to warn, and breach of express warranty for AI-embedded features and
1 Consumer Protection Act 2019, No 35 of 2019, ch VI, ss 82–87
accessed 9 October 2025.
2 Consumer Protection Act 2019 (n 1) ss 20–21
accessed 9 October 2025.
3 Central Consumer Protection Authority, ‘Guidelines for Prevention of Misleading Advertisements and
Endorsements for Misleading Advertisements, 2022’ accessed 9 October 2025. 4 Ministry of Electronics and Information Technology, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (updated 6 April 2023) accessed 9 October 2025.
5 Consumer Protection Act 2019 (n 1) pts II–VI
accessed 9 October 2025. algorithmic services. 6 Misleading advertisement captures targeted AI claims and synthetic testimonials that overstate accuracy or outcomes, while sections 20–21 empower the CCPA to discontinue or modify advertisements and impose penalties, which matters when AI-optimized creatives scale harm quickly across cohorts. 7 CCPA Notices by Category (FY 2023–24) Misleading Advertisement Remaining ad sectors (betting, alcohol, travel) Unfair Trade Practice (e- Consumer Rights (various sectors) commerce, durables, Violations banking) Electronics & Durables Health & Education Digital Platforms Figure 1: CCPA Notices by Category (FY 2023–24). 8 The figure 1 shows the distribution of notices issued by the Central Consumer Protection Authority under three main categories: misleading advertisements, unfair trade practices, and consumer rights violations.
Electronics and durables made up the largest share, followed by health and education services. The E-Commerce Rules cover goods and services sold over digital networks, bind marketplaces and inventory platforms, and link contraventions to remedies under the Act, which supports disclosure orders on ranking parameters when AI orders search results. 9 The
6 Consumer Protection Act 2019 (n 1) s 2 and ch VI
accessed 9 October 2025.
7 Consumer Protection Act 2019 (n 1) s 2(28) and ss 20–21
accessed 9 October 2025. 8 Central Consumer Protection Authority, Annual Report 2023–2024 (Department of Consumer Affairs, New Delhi 2024) accessed 10 October 2025.
9 Consumer Protection (E-Commerce) Rules 2020, rr 4(4), 5–6, 8
accessed 9 October 2025.
Guidelines for Prevention of Misleading Advertisements codify substantiation duties and endorser diligence that limit over-promises amplified by AI targeters, while the Dark Patterns Guidelines give categorical hooks for patterns such as false urgency and basket sneaking in AItuned interfaces. False Urgency Basket Sneaking Confirm Shaming Forced Action Subscription Interface Interference Bait and Switch Drip Pricing Trap Disguised Advertisement Nagging Trick Question SaaS Billing Manipulation Rogue Malware Warning Figure 2: Dark Pattern Categories Recognised by the Central Consumer Protection Authority under the Guidelines for Prevention and Regulation of Dark Patterns, 2023 (Notified 30 Nov 2023).
10 The IT Act with the Intermediary Rules frames platform due diligence, grievance handling, and transparency statements that can be pleaded alongside consumer claims where algorithmic optimization contributes to harm, and the DPDP Act supplies consent, access, correction, erasure, and breach notification duties that surface personalization facts relevant to unfair trade practice analysis. 11 Key takeaways: the CPA, 2019 remains the anchor; the E-Commerce Rules and CCPA Guidelines translate interface harms into justiciable claims; the IT and DPDP statutes add procedural leverage and evidence for consumer fora without displacing consumer 10 Central Consumer Protection Authority, ‘Guidelines for Prevention and Regulation of Dark Patterns, 2023’ accessed 9 October 2025.
11 Digital Personal Data Protection Act 2023, No 22 of 2023, chs II–IV
accessed 9 October 2025. remedies. 12 Threshold Characterisation: AI as Product or Service Standardized software bundled with devices or distributed off-the-shelf exhibits attributes of “goods,” as recognised when the Supreme Court treated canned software as capable of sale, transmission, and possession, a logic that travels to AI modules compiled into phones and appliances. 13 Bespoke and dynamically tuned deployments, such as fraud-scoring models maintained as a continuing service, map to “service,” inviting deficiency analysis including omission of material information and inadequate instructions for safe use, which aligns with the statutory text and commission practice on recurring updates and uptime promises.
14 Characterisation is outcome-determinative for pleadings: in “goods,” the consumer may rely on strict product-liability heads, while “service” claims engage deficiency standards and misrepresentation; both routes can run with unfair trade practice where onboarding screens and ads inflate model performance. 15 Key takeaways: label standardized AI features as goods to invoke Chapter VI; treat bespoke, continuously maintained models as services; add unfair trade practice where UI and ads mislead.
Allocation of Legal Responsibility Across the AI Supply Chain Manufacturers bear responsibility when AI features fail because of design choices such as default thresholds, training data curation, or latent safety constraints that trigger design-defect and failure-to-warn heads, while service providers incur liability where platform-level ranking, pricing, or triage performs deficiently or essential instructions are missing. 16 Product sellers are answerable when labels, warranties, or control over product information create independent assurances or when the manufacturer is unknown or unreachable, which is common when cross-border AI components are embedded in devices; marketplaces face duties where ranking and interface flows shape choice and conceal add-ons or opt-outs. 17 Statutory exceptions,
12 Consumer Protection (E-Commerce) Rules 2020 (n 9).
13 Tata Consultancy Services v State of Andhra Pradesh (2005) 1 SCC 308 accessed 9 October 2025.
14 Consumer Protection Act 2019 (n 1) ss 2(42), 85
accessed 9 October 2025.
15 Consumer Protection Act 2019 (n 1) ch VI and s 2(47) ‘unfair trade practice’
accessed 9 October 2025.
16 Consumer Protection Act 2019 (n 1) ss 82–85
accessed 9 October 2025.
17 Consumer Protection (E-Commerce) Rules 2020 (n 8) rr 4–6.
including misuse, obvious dangers, and expert-only goods, exist but sit uneasily with opaque systems where consumers cannot see internal risk trade-offs; the burden to warn persists across updates for known failure modes and foreseeable misuse, especially at scale. 18 A safety-critical scenario clarifies duties: a driver-assist feature fails to detect pedestrians at dusk due to threshold settings and dataset gaps; a consumer pleads design defect and failure to warn against the manufacturer, deficiency in service against the platform that propagated inaccurate “autopilot-like” messaging, and unfair trade practice for onboarding screens that downplayed limitations; interim orders include forced warnings, feature toggles, and a software recall by patch.
19 Role–Head–Remedy Matrix AI actor Statutory head (CPA 2019) Typical liability theory Primary remedies before Commissions/CCPA Manufacturer of AIenabled device/module Product liability, Sections 82– Design defect; failure to warn; breach of express warranty Refund, replacement, compensation, corrective advertising, recall Service provider operating AI function Service deficiency, section 85; unfair trade practice Inadequate instructions; misleading claims; dark patterns Compensation, injunctions on UI, discontinuation/modification of ads Consolidated Enforcement, Applications, and DPDP Interplay Consumer commissions can award compensation, refunds, and corrective ads in productliability and service-deficiency actions when AI defects or missing instructions cause harm, while the CCPA may direct recall and order discontinuation or modification of misleading advertisements, including penalties for endorsers who fail diligence, which is salient for AItargeted campaigns.
20 Live applications illustrate possibilities: government notices to ridehailing firms on alleged device-based differential pricing justify unfair trade practice pleadings and discovery into device fields, consent flows, and ranking or routing logic;21 penalties against education and wellness claims demonstrate granular parsing of over-promises that AIoptimized creatives may amplify; 22 device defect orders show how software faults and unkept update promises ground manufacturing-defect and deficiency findings.
23 DPDP rights to access, correction, and erasure surface data fields and uses that simultaneously prove omission of material information or unfair trade practice where profiling drives interface choices, while breach-notification and penalty provisions create compliance pressure for systems that leak or repurpose personal data feeding recommendation and pricing engines; complainants can coordinate DPDP requests with consumer pleadings to accelerate disclosure and relief. 24 Key takeaways: use a dual track in significant AI incidents, combining commission compensation with CCPA market-wide directions; leverage DPDP rights to obtain logs and profiling fields that inform consumer claims; pursue UI-level fixes with dark-pattern categories and rankingdisclosure duties.
25 Procedure, Evidence, and Remedies Jurisdiction lies in district, state, and national commissions according to consideration-based valuation thresholds and the situs of the complainant, with limitation running from the date of
20 Consumer Protection Act 2019 (n 1) ss 34, 39, 49, 59, 20–21.
21 Press Information Bureau, ‘Central Consumer Protection Authority (CCPA) imposes penalty of ₹10 lakh on Rapido for misleading advertisement’ (21 August 2025) accessed 9 October 2025. 22 Press Information Bureau, ‘CCPA fines Drishti IAS ₹5 lakh for misleading UPSC 2022 result ads’ (3 October
2025) accessed 9 October 2025.
23 BW Legal World, ‘Delhi Consumer Commission Orders Refund And Compensation Against Samsung For
Defective Mobile Phone’ (4 October 2025) accessed 9 October 2025.
24 Digital Personal Data Protection Act 2023 (n 11) ss 5–9 and Sch.
25 Consumer Protection (E-Commerce) Rules 2020 (n 9) r 4(4); CCPA ‘Guidelines for Prevention and
Regulation of Dark Patterns, 2023’ (n 10). cause of action and condonation standards applying to delayed filings; arbitration clauses do not oust consumer jurisdiction, which preserves AI disputes from boilerplate terms. 26 Evidence in AI disputes should be pleaded with specificity: inputs to automated pricing or ranking, feature lists and weightings for prominence, and A/B test records that show dark-pattern experimentation; screenshots and session logs establish user flows and visibility of warnings; version identifiers, known-issues registers, and safety-test summaries situate the model at the time of harm; ranking disclosures under the Rules justify requests for parameters, paid boosts, and meaningful criteria.
27 Model prayers for relief can combine refund or compensation with corrective advertising, forced update notices to all users, toggle-off of hazardous features pending patch, and public disclosure of material limitations in onboarding and help centres; interim orders should require warning banners, feature throttling, and data preservation, with post-market monitoring logs to be filed with commissions in a sealed form where necessary to protect sensitive code. 28 Key takeaways: front-load discovery with precise algorithmic artefacts; combine individual redress with interface-level corrections; preserve data and logs early to prevent spoliation.
29 Landmark Cases and Doctrinal Anchors Lucknow Development Authority v M K Gupta confirms that compensation under consumer law addresses harassment and capricious conduct and that punitive damages may be justified, which guides relief when automated choices predictably impose hardship through opaque systems that deny corrective service. 30 Indian Medical Association v V P Shantha recognises medical services as “service” under consumer law, supporting claims against AI-augmented diagnostics and tele-consultation flows where reasonable care is not met and instructions for safe reliance are inadequate. 31 Tata Consultancy Services v State of Andhra Pradesh classifies standardized software as “goods,” enabling product-liability pleading against off-the-shelf AI modules bundled with devices or licensed features that consumers acquire as part of composite
26 Emaar MGF Land Ltd v Aftab Singh (2019) 12 SCC 751.
27 CCPA, ‘Guidelines for Prevention and Regulation of Dark Patterns, 2023’ Annexure (n 10).
28 CCPA, ‘Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading
Advertisements, 2022’ (n 3).
29 Digital Personal Data Protection Act 2023 (n 11).
30 Lucknow Development Authority v M K Gupta (1994) 1 SCC 243
accessed 9 October 2025.
31 Indian Medical Association v V P Shantha (1995) 6 SCC 651
accessed 9 October 2025. goods.32 Emaar MGF Land Ltd v Aftab Singh ensures that arbitration clauses do not displace consumer fora, an essential shield for AI disputes where app terms attempt to shunt claims to private arbitration despite public-facing harms.33 Key takeaways: relief can include punitive components; AI-linked clinical and platform services fall within “service”; standardized modules fall within “goods”; forum access is preserved against arbitration boilerplate. Suggestions
1. Notify by rule or guidance that standardized AI modules bundled with devices or apps
are “products” for Chapter VI, while bespoke, continuously maintained deployments sit under “service,” to reduce threshold litigation and enable swift pleading.
2. Create audit-linked safe harbours tied to documented duties such as risk logs, red-team
tests, prompt-injection tests, and rapid warning pushes, with loss of protection for concealment or misrepresentation that causes consumer harm, and link the safe harbour explicitly to sections 82–87 to clarify interaction with product-liability heads.
3. Issue a practice note synthesising the Dark Patterns Guidelines with examples from
self-audit reports, including templates for warnings and instructions for AI features that affect safety or price, and publish anonymised corrective-action reports after CCPA matters to build deterrence.
4. Establish structured data-sharing between the DPDP Board and the CCPA so that
access, correction, and breach notifications relevant to consumer harm can be relied upon in consumer fora without duplicative notices or inconsistent timelines.
5. Build capacity in commissions and the CCPA for algorithmic evidence through
standardised discovery schedules, sealed-filing protocols for sensitive logs and model cards, and short-form technical primers annexed to orders.
6. Mandate layered, pre-purchase disclosures for algorithmic ranking and personalisation
on marketplaces, including paid boosts, material parameters, and meaningful criteria
32 Tata Consultancy Services v State of Andhra Pradesh (2005) 1 SCC 308 (n 13).
33 Emaar MGF Land Ltd v Aftab Singh (2019) 12 SCC 751 (n 256).
available in one click, and require a persistent “why this ranking” explainer at the point of choice.
7. Provide a standard interim-order toolkit for AI incidents, covering warning banners,
toggle-off mandates, forced updates, and public recall notices pushed in-app to all affected users within defined timeframes. Conclusion This study answers who bears responsibility, which CPA, 2019 provisions apply, and how possibilities play out on facts by grounding AI disputes in Chapter VI product liability and service-deficiency heads, backed by unfair trade practice, CCPA advertising powers, E- Commerce ranking and grievance rules, Intermediary due diligence, and DPDP data rights. Standardized AI modules are “goods,” bespoke deployments are “services,” and marketplaces carry interface duties; relief should combine compensation with corrective advertising, warning banners, and feature toggles, with recall by patch when appropriate.
The four landmark cases provide the doctrinal backbone on remedies, the scope of “service,” software as “goods,” and forum competence, ensuring accessibility and effective redress. The consolidated enforcement pathway and the role–head–remedy matrix, discovery checklist, and model prayers are designed for fast, accurate adjudication and market-wide fixes; the Suggestions identify implementable steps that stabilise expectations for firms while improving safety and transparency for consumers. The immediate agenda is to codify characterisation guidance, operationalise audit-linked safe harbours connected to sections 82–87, and institutionalise DPDP–CCPA cooperation so that evidence and relief can move in tandem from the next incident onward.