The “Soft Law” Problem In India’s Dark Patterns Regime - Binding Instruments Or Mere Persuasion

Author: LawSphereX

Category: General Law

Published: 2026-08-23T21:33:54.997101+00:00

Updated: 2026-08-30T07:05:10.126Z

THE “SOFT LAW” PROBLEM IN INDIA’S DARK PATTERNS

REGIME: BINDING INSTRUMENTS OR MERE PERSUASION?

KM Priyanshi, Law College Dehradun, Uttaranchal University Ashok Dobhal, Assistant Professor, Law College Dehradun, Uttaranchal University

ABSTRACT

India has confronted manipulative interface design through two instruments: the Guidelines for Prevention and Regulation of Dark Patterns, 2023, and the Central Consumer Protection Authority’s Advisory of 5 June 2025. Both target the same harm, yet neither states plainly whether it commands compliance or merely counsels it. This article maps that “soft law” ambiguity, weighs the competing readings of binding force and persuasion, and assesses what the resulting uncertainty does to corporate compliance behaviour. The article further explores the broader implications of this uncertainty for regulatory legitimacy, corporate accountability, and consumer trust within India’s rapidly expanding digital marketplace.

It argues that when the legal status of regulatory instruments remains unclear, businesses may adopt inconsistent or merely symbolic compliance practices, thereby weakening the effectiveness of consumer protection mechanisms aimed at curbing deceptive online interface design. Keywords: dark patterns; soft law; Central Consumer Protection Authority; Consumer Protection Act, 2019; e-commerce regulation; regulatory compliance.

I. Introduction

The phrase “dark patterns” was coined in 2010 by the user-experience specialist Harry Brignull to describe interface choices engineered to push users toward decisions they would not otherwise make. 1 A countdown timer that never truly expires, a charitable donation quietly added at checkout, a cancellation option buried several menus deep each exploits a predictable cognitive bias for commercial advantage. As Indian digital commerce has expanded, so has the prevalence of such designs, and with it the pressure for a regulatory answer. That answer has arrived in two parts. On 30 November 2023 the Central Consumer Protection Authority (CCPA) notified the Guidelines for Prevention and Regulation of Dark Patterns, 2023. 2 Roughly eighteen months later, on 5 June 2025, the same authority issued an Advisory directing e-commerce platforms to audit themselves for dark patterns.

3 Both instruments aim at an identical mischief. Yet a foundational question shadows them both: are they binding law that a business must obey, or persuasive guidance it remains free to weigh? This article examines that “soft law” problem the genuine uncertainty surrounding the instruments’ legal status and asks what the persistence of that uncertainty does to compliance. Additionally, the uncertainty surrounding the legal status of these instruments reflects a broader trend in modern technology regulation, where governments increasingly rely upon guidelines, advisories, and policy documents instead of formally enacted legislation. Such an approach allows regulators to respond quickly to rapidly evolving digital practices, particularly in sectors like e-commerce where manipulative techniques continuously adapt to user behaviour and technological innovation.

However, the absence of clear legislative backing may weaken regulatory certainty and create confusion regarding the precise obligations imposed upon online platforms. Businesses may argue that compliance with advisories is voluntary rather than mandatory, while consumers may struggle to understand the remedies available when deceptive practices occur. This tension between regulatory flexibility and enforceability lies at the heart of India’s developing dark patterns regime and raises an important question 1The term “dark patterns” was coined by user-experience designer Harry Brignull in 2010; see Harry Brignull, Deceptive Patterns: Exposing the Tricks Tech Companies Use to Control You (Testimonium Ltd 2023).

2Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified by the Central Consumer Protection Authority, Ministry of Consumer Affairs, Food and Public Distribution, Government of India, 30 November 2023. 3Central Consumer Protection Authority, “Advisory in terms of the Consumer Protection Act, 2019 on Self-Audit by E-Commerce Platforms for detecting the Dark Patterns on their platforms,” dated 5 June 2025.

II. Two Instruments, Two Registers

The CCPA is a creature of statute. Section 10 of the Consumer Protection Act, 2019 (CPA) established it to regulate matters relating to the violation of consumer rights, unfair trade practices and misleading advertisements that prejudice consumers as a class. 4 Section 18 enumerates its functions, and Section 18(2)(l) specifically empowers it to “issue necessary guidelines to prevent unfair trade practices and protect consumers’ interest. ”5 It was under this provision that the 2023 Guidelines were framed. The 2023 Guidelines are drafted in a mandatory register. They define a dark pattern as any deceptive design using UI/UX interactions “designed to mislead or trick users ... by subverting or impairing the consumer autonomy, decision making or choice.

”6 Guideline 4 prohibits every person including platforms, sellers and advertisers from engaging in any dark pattern, and Annexure I enumerates thirteen specified practices: false urgency, basket sneaking, confirm shaming, forced action, subscription traps, interface interference, bait and switch, drip pricing, disguised advertising, nagging, trick questions, SaaS billing and rogue malware. 7 The operative verb throughout is “shall. ” By mid-2025 it had become clear that the Guidelines were being widely disregarded; preticked consent boxes, contrary to Rule 4(9) of the Consumer Protection (E-Commerce) Rules, 2020, were a recurring grievance. 8 The CCPA’s response was the 2025 Advisory.

Its operative paragraph issues three directions: platforms are “advised” not to deploy dark patterns; “advised” to conduct a self-audit within three months; and “encouraged” to file a selfdeclaration of compliance. 9 Two things shift between the instruments the register, from “shall” to “advised” and “encouraged,” and the label, from “Guidelines” to “Advisory. ” Those shifts are the seed of the problem. The distinction between the two instruments is not merely linguistic but carries significant implications for their enforceability and legal effect. In administrative law, the language employed by a regulatory authority often indicates whether an instrument is intended to create binding obligations or merely recommend desirable conduct. The repeated use of mandatory expressions such as “shall” within the 2023 Guidelines suggests 4The Consumer Protection Act, 2019 (Act No.

35 of 2019), s 10. 5ibid, s 18(2)(l).

62023 Guidelines (n 2), Guideline 2(1)(e).

7ibid, Guideline 4 read with Annexure I. 8The Consumer Protection (E-Commerce) Rules, 2020, r 4(9); see also 2025 Advisory (n 3).

92025 Advisory (n 3), para 5.

an intention to impose enforceable duties upon regulated entities. In contrast, the 2025 Advisory adopts softer terminology “advised,” “encouraged,” and “self-audit” which traditionally reflects persuasive rather than compulsory regulation. This duality creates interpretative uncertainty for businesses attempting to assess the legal consequences of noncompliance. If both instruments pursue the same objective but employ different normative registers, the regulated community may reasonably question whether the authority itself views dark-pattern compliance as mandatory law or voluntary best practice. The problem is further complicated by the fact that neither instrument clearly specifies penalties for breach, nor clarifies whether failure to comply automatically constitutes an unfair trade practice under the Consumer Protection Act, 2019.

Consequently, the coexistence of a mandatory-sounding Guideline and a recommendatory Advisory blurs the boundary between hard and soft law, leaving enforcement dependent largely upon regulatory interpretation rather than clear statutory command. III. What “Soft Law” Means, and Why the Label Matters In regulatory theory, “soft law” describes norms that shape behaviour without being formally enforceable declarations, codes of conduct, model rules and advisories. It is conventionally contrasted with “hard law,” which binds and is backed by adjudication and sanction. 10 The two are better understood as ends of a spectrum than as rivals, and real instruments frequently sit somewhere between them.

Soft law’s appeal lies in speed, flexibility and the capacity to evolve alongside a moving target; its weakness is that compliance depends on goodwill, reputation and the credible prospect that harder law stands behind it. The difficulty in India’s dark-patterns regime is not that the CCPA chose soft law over hard law. It is that neither instrument announces, on its face, which side of the line it occupies. The 2023 Guidelines read as hard law, yet expressly caution that their illustrations are not “a binding decision” and that classification turns on the facts of each case. The 2025 Advisory is labelled as advice, yet is issued by a statutory regulator, expressly “in terms of” the CPA, and in furtherance of Guidelines that may themselves bind.

Classification is therefore no academic exercise: it determines whether non-compliance is an enforceable wrong or merely a declined 10On the soft law / hard law distinction generally, see Kenneth W. Abbott and Duncan Snidal, “Hard and Soft Law in International Governance” (2000) 54 International Organization 421. suggestion. The importance of this classification becomes even more significant in the context of digital markets, where regulatory certainty directly affects business conduct and enforcement strategy. Large e-commerce platforms and technology companies typically design their compliance systems around clearly identifiable legal obligations, especially where penalties, investigations, or reputational consequences may follow.

When a regulatory instrument occupies an uncertain position between binding law and persuasive guidance, businesses may adopt only partial or symbolic compliance measures rather than undertaking substantial structural reforms to their interface designs. This creates the risk of “performative compliance,” where companies publicly acknowledge regulatory concerns while continuing practices that technically evade clear prohibition. At the same time, regulators may hesitate to initiate aggressive enforcement actions if the legal foundation of the instrument itself remains contestable before courts. The ambiguity therefore weakens both sides of the regulatory relationship: consumers are left without clear protection, while businesses operate without predictable standards.

In sectors driven by rapid technological innovation and algorithmic behavioural targeting, such uncertainty can significantly undermine the effectiveness of consumer protection law, particularly when deceptive practices evolve faster than formal legislation. IV. The Case for Binding Force The strongest argument that both instruments bind comes from the Delhi High Court’s

2025 decision in National Restaurant Association of India v. Union of India.11 There, restaurant

associations challenged CCPA guidelines restraining mandatory service charges, contending that a mere “guideline” could not bind. The Court disagreed. It held that the CCPA is “not merely a recommendatory or advisory body”; that its power under Section 18(2)(l) is an enforcement power rather than a soft one; that guidelines issued under that provision carry statutory force and qualify as “law” within the meaning of Article 13 of the Constitution; and that the nomenclature “guidelines” cannot dilute their binding character. 12 On this reasoning, the 2023 Guidelines plainly bind. A dark pattern is, by definition, an unfair trade practice, and a violation can be carried down the CPA’s enforcement chain a preliminary inquiry and investigation under Section 19, cease-and-desist directions under 11National Restaurant Association of India v. Union of India, Delhi High Court, decided 2025.

12ibid, see paras 55–75.

Section 20, and penal consequences under Section 88 for disobeying those directions, with Section 89 separately punishing misleading advertisements by imprisonment of up to two years and a fine of up to ten lakh rupees, rising on repetition. 13 The 2025 Advisory, expressly issued in furtherance of the Guidelines, arguably inherits this force: it creates no fresh obligation but operationalises an existing, binding prohibition. The CCPA’s earlier suo motu actions against IndiGo and BookMyShow for confirm shaming and basket sneaking respectively confirm that this enforcement chain is real rather than theoretical. 14 Further, recognising binding force in these instruments arguably advances the broader objective of consumer protection within an increasingly complex digital marketplace.

If dark patterns are treated merely as undesirable practices rather than enforceable violations, platforms may continue to exploit ambiguities in interface design while avoiding meaningful accountability. The reasoning adopted by the Delhi High Court strengthens the proposition that statutory regulators must possess effective tools to respond to emerging commercial harms, especially where traditional legislation may lag behind technological change. In this sense, the 2023 Guidelines may be viewed not as independent legislation but as a statutory mechanism through which the broad prohibitions against unfair trade practices under the Consumer Protection Act, 2019 are concretised and made administratively workable. The 2025 Advisory, similarly, can be interpreted as an implementation tool intended to improve compliance rather than create new legal duties.

Requiring self-audits and encouraging declarations of compliance may therefore function as preventive governance mechanisms aimed at reducing consumer harm before formal adjudicatory intervention becomes necessary. Such an interpretation aligns with modern regulatory theory, which increasingly favours proactive compliance frameworks over purely punitive enforcement after violations have already occurred. Moreover, the recognition of statutory force in CCPA guidelines may also be justified on constitutional and administrative grounds. Modern regulatory agencies are frequently entrusted with broad supervisory powers because legislatures cannot anticipate every evolving commercial practice in highly dynamic sectors such as digital commerce and online advertising.

If Section 18(2)(l) of the Consumer Protection Act, 2019 is interpreted narrowly as permitting only non-binding recommendations, the effectiveness of the CCPA in addressing emerging forms of consumer harm would be 13The Consumer Protection Act, 2019, ss 19, 20, 88 and 89. Section 89 prescribes imprisonment of up to two years and a fine of up to ten lakh rupees for a false or misleading advertisement, rising to five years and fifty lakh rupees for a subsequent contravention. 14See Central Consumer Protection Authority, order against InterGlobe Aviation Ltd. (IndiGo) dated 19 June 2024, and the notice issued to Bigtree Entertainment Pvt. Ltd. (BookMyShow) concerning “basket sneaking”; Press Information Bureau, Government of India. significantly weakened.

The Delhi High Court’s interpretation therefore reflects a purposive approach to statutory construction, under which delegated regulatory instruments are treated as essential extensions of legislative intent rather than optional policy suggestions. This approach is particularly relevant in the context of dark patterns, where deceptive techniques are often subtle, technologically sophisticated, and capable of changing faster than formal legislative amendment processes. By recognising guidelines as enforceable norms, the Court effectively ensures that consumer protection law remains adaptive and capable of responding to new forms of manipulation in digital markets.

Such reasoning also reinforces the principle that regulatory authorities must possess sufficient practical authority to fulfil the statutory objectives for which they were created, especially when consumer welfare and market fairness are directly implicated. V. The Case for Persuasion The contrary reading, however, is not frivolous. Three features of the 2025 Advisory pull toward a soft classification. First, its title: the CCPA deliberately called it an “Advisory,” not a “Guideline. ” While NRAI holds that nomenclature cannot override a clear binding intent, it does not hold that nomenclature is irrelevant where the language is otherwise ambiguous, the label can tilt the balance. Second, its verbs: against the insistent “shall” of the 2023 Guidelines, the Advisory uses “advised” and “encouraged. ” The Supreme Court in Shivam Chaudhary v.

AICTE held that even a body competent to issue binding norms may, through recommendatory language in a particular instrument, choose not to exercise that power fully; the language of the specific document governs. 15 The Karnataka High Court has likewise observed that statutory backing does not, by itself, render guidelines mandatory. 16 Third, the Advisory cites no penal provision and prescribes no consequence for non-compliance. A defensible middle reading therefore emerges. The first two directions restating the prohibition and setting a concrete three-month audit deadline arguably bind, because they reiterate existing obligations and bear the hallmarks of a command. The third, the selfdeclaration, carrying neither deadline nor sanction nor prescribed form, is more naturally read as genuinely voluntary.

But the very fact that the instrument must be parsed sentence by sentence to reach even that conclusion is itself the point: reasonable lawyers can, and do, 15Shivam Chaudhary v. All India Council for Technical Education, Supreme Court of India, 2023. 16S. A. Ram Prakash v. State of Karnataka, Karnataka High Court, 2015. disagree. This uncertainty also raises deeper rule-of-law concerns regarding predictability and fairness in administrative governance. A foundational principle of legal regulation is that individuals and businesses must be able to identify, with reasonable clarity, what conduct is legally prohibited and what consequences may follow from non-compliance. Where regulatory instruments employ mixed language some provisions appearing mandatory while others appear merely persuasive the boundary between obligation and recommendation becomes blurred.

Such ambiguity may create inconsistent enforcement patterns, allowing regulators broad discretionary power while leaving regulated entities uncertain about the extent of their duties. In the context of digital commerce, where companies routinely make rapid interface and design decisions, unclear compliance standards may either encourage over-cautious self-censorship or, conversely, strategic under-compliance based on the assumption that enforcement remains legally contestable. The resulting uncertainty can weaken both deterrence and legitimacy. From this perspective, the debate over whether the CCPA’s dark-pattern instruments constitute hard or soft law is not merely semantic; it directly affects procedural fairness, regulatory accountability, and the credibility of India’s consumer protection framework in the digital age. VI.

What the Ambiguity Does to Compliance Here the balanced view matters the most. Soft law is not a regulatory failure; it carries real virtues. It is quick to issue, inexpensive to revise, and well suited to a target as fast-moving as interface design, where a rigid rule risks obsolescence. A self-audit model can harness a platform’s superior knowledge of its own systems, and a published self-declaration can generate reputational pressure that formal adjudication cannot. There is a coherent case for the instrument the CCPA chose. But every one of those virtues depends on the regulated entity knowing where it stands. When a single instrument can be read as binding or not, three compliance pathologies follow. The first is divergent good-faith compliance.

The self-declarations the CCPA has itself published from e-commerce and quick-commerce platforms vary enormously some set out multi-stage audit frameworks, staff training and external validation, while others offer a bare assertion of compliance precisely because the Advisory prescribes no methodology, no reporting format and no independent verification. 17 The second is an incentive mismatch. A 17Press Information Bureau, “26 Leading E-Commerce Platforms Declare Compliance with Self-Audit to Eliminate Dark Patterns,” Government of India, 2025. firm that audits honestly and redesigns a profitable but deceptive interface incurs real cost; a firm that performs a nominal audit and files a similar-looking declaration appears equally compliant to a regulator with no sight of the underlying report.

Soft, unverified framing thus risks rewarding superficial compliance while quietly penalising diligence. The third is selective enforcement. If entities must guess whether an “advisory” carries force, enforcement becomes unpredictable and unpredictable enforcement is itself a rule-of-law cost, chilling cautious actors while emboldening the rest. In fairness, the ambiguity has not paralysed the regulator. The CCPA has continued to issue notices to platforms, and the Department of Consumer Affairs has constituted a Joint Working Group drawing in ministries, regulators, consumer organisations and law universities to monitor dark patterns on a continuing basis. 18 Whether the soft-law framing is a genuine defect or merely a transitional stage therefore depends, in part, on what the regulator does next.

Another significant consequence of this ambiguity is its impact on smaller businesses and emerging digital platforms that may lack sophisticated legal or compliance departments. Large technology companies often possess the institutional capacity to interpret uncertain regulatory instruments, seek specialised legal advice, and strategically calibrate their compliance responses. Smaller entities, however, may struggle to determine whether the costs of redesigning interfaces, conducting detailed audits, and implementing compliance systems are legally necessary or merely precautionary. This can produce uneven regulatory outcomes, where well-resourced corporations treat compliance as a manageable business risk while smaller platforms face disproportionate uncertainty and operational burdens.

Additionally, inconsistent interpretations of the CCPA’s instruments may fragment industry standards, resulting in different platforms adopting widely varying approaches to consent mechanisms, cancellation processes, advertising disclosures, and user-interface design. Such inconsistency undermines one of the central purposes of consumer regulation the creation of predictable and uniform standards of market behaviour. In the long term, a regulatory regime that depends heavily upon uncertain soft-law instruments may therefore struggle to establish stable expectations for both businesses and consumers, particularly in an ecosystem where digital practices evolve rapidly and competitive pressures often incentivise aggressive behavioural design strategies.

18Department of Consumer Affairs, Government of India, on the constitution of a Joint Working Group to identify and curb dark patterns on e-commerce platforms; Press Information Bureau, 5 June 2025.

VII. Conclusion

The honest answer to whether the 2023 Guidelines and the 2025 Advisory bind is a qualified one: probably yes for the Guidelines and the audit mandate, probably not for the selfdeclaration. But the need to qualify clause by clause is itself the problem. It is the ambiguity, not its eventual resolution, that businesses must presently navigate and they navigate it by guessing. That guesswork is largely avoidable. Modest drafting discipline would dissolve most of it: separating mandatory steps from recommended best practice under clearly marked heads; citing the enabling and penal provisions relied upon; stating in plain terms the consequence of non-compliance; and prescribing a format for audits and declarations so that compliance can be compared and verified. None of this requires the CCPA to abandon soft law, which remains a legitimate and often sensible tool against manipulative design.

It requires only that the regulator make clear, instrument by instrument, whether it is commanding or counselling. Until it does, the cost of the ambiguity will be borne twice over once by businesses uncertain of their obligations, and again by the very consumers the regime exists to protect.