Dark patterns guidelines 2023: how India's rules apply to sales and service calls

What India's 2023 dark patterns guidelines ban

A dark pattern is a design trick that pushes people into doing something they did not intend or want to do. Think of a countdown timer that never runs out, an insurance add-on ticked in advance, a fee that appears only at the last step. The CCPA defines it as a deceptive practice using user interface or user experience interactions on any platform. To count, it must amount to a misleading advertisement, an unfair trade practice or a breach of consumer rights (clause 2(1)(e)).

The CCPA notified the Guidelines for Prevention and Regulation of Dark Patterns, 2023 on 30 November 2023, and they took effect that day (CCPA dark patterns guidelines). It issued them under section 18 of the Consumer Protection Act, 2019, which lets it issue guidelines to prevent unfair trade practices (section 18(2)(l)). The list builds on earlier industry work: Khaitan & Co notes that the patterns are similar to those in a December 2022 report by the Advertising Standards Council of India (Khaitan & Co summary).

The guidelines apply to platforms that systematically offer goods or services in India, and to advertisers and sellers (clause 3). The core rule is short: no one may engage in any dark pattern (clause 4), and doing anything listed in Annexure 1 counts as one (clause 5). Annexure 1 lists 13 specified patterns, and the CCPA can add more. The Annexure adds that its illustrations are guidance only, so a trick need not match an example to be caught.

Do the dark patterns guidelines apply to phone calls?

Not clearly. The guidelines borrow the meaning of "platform" from the Consumer Protection (E-Commerce) Rules, 2020, and talk about user interfaces and user experience. None of the illustrations in Annexure 1 is a phone call, and no text we found applies the guidelines to calls by name. Whether an AI voice agent run by an online business counts as a user interface on a platform has not been decided by the CCPA or a court.

The law underneath the guidelines does reach calls, though. The Consumer Protection Act, 2019 treats a deceptive practice used to promote a sale as an unfair trade practice. Its list of examples covers statements made "whether orally or in writing" (Consumer Protection Act, 2019, section 2(47)). The CCPA's definition of confirm shaming also covers fear or guilt applied through "a phrase, video, audio or any other means", which suggests the authority was not thinking only of screens.

So a sales pitch that hides a fee or invents a deadline is likely unfair under the Act whether or not the 2023 guidelines formally apply. That is the reasoning behind treating a trick in a voice the same as a trick on a screen. For banks and NBFCs (non-banking financial companies) the question is settled another way: from 1 January 2027, RBI's sales directions bar dark patterns and set a code of conduct for sales calls, covered below.

The 13 dark patterns, and how they sound on a call

Most of the 13 patterns were described with screens in mind, but each has an obvious spoken version. Hearing them as a caller would is the quickest way to find them in a script.

The first column of the table follows Annexure 1 of the CCPA guidelines. The call examples and fairer lines are our own illustrations of how each pattern could sound in a sales or service call; they are not taken from the guidelines.

Drip pricing and add-ons, the patterns calls fall into most easily

Two patterns deserve particular attention on calls, because speech works against the listener. Drip pricing means revealing parts of the price late, or charging more than the amount stated at checkout. The guidelines also cover calling something free without saying that continued use costs money, and blocking a paid service until something extra is bought (Annexure 1, item 8).

On a screen, a customer can scroll back to the price. On a call they hear it in pieces and cannot, so the fix is to give the full cost before asking for a yes. RBI's directions for banks require the same: fees, charges, interest rate, risks and exit terms must be disclosed prominently when consent is taken (para 85H). Where a financial regulator prescribes a format, such as the Key Facts Statement (KFS) or Most Important Terms and Conditions (MITC), that format must be used.

A pre-selected add-on is usually basket sneaking: adding an item or charge without the customer's consent, unless it is a free sample or a necessary fee disclosed at purchase. RBI gives adding loan protection insurance by default as a banking example. On a call, that means naming each optional add-on separately and asking about each one. If a trial becomes paid, the agent should say the date and amount of the first charge, and the same figures should follow in writing after the call.

The same discipline works for a whole script. Read it line by line and ask the five questions in the chart. A "no" to any of them points to a specific pattern from the table. Check voice-agent prompts the same way: an AI agent follows its prompt on every call, so one bad line repeats at scale.

RBI's dark-pattern ban for banks and NBFCs

Financial firms face the most specific rules. On 15 June 2026, RBI issued amendment directions on advertising, marketing and sale of financial products, which take effect on 1 January 2027 (RBI press release, 15 June 2026). They cover commercial banks, small finance banks, payments banks, regional rural banks, co-operative banks, NBFCs, housing finance companies and others.

A bank and its direct selling or marketing agents must not use any dark pattern in their user interfaces. They must test and periodically audit those interfaces and follow the CCPA's 2023 guidelines (Commercial Banks RBC Second Amendment Directions, 2026, para 85X, RBI/2026-27/115). RBI's Annex IIA gives banking examples, such as adding loan protection insurance by default, or advertising a low rate and charging a higher one. The NBFC directions carry the same rules, numbered from para 101 (RBI/2026-27/123; for example paras 101N and 101X).

Self-audits, fines and penalties

Outside finance, the pressure comes from audits and enforcement. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026, notified on 9 September 2026, require every e-commerce entity to follow the 2023 guidelines from 1 January 2027. Each must also do a self-audit every year and display a certificate of compliance prominently (G.S.R. 789(E), new rule 4(15)).

The rule formalises something the CCPA had already asked for. In an advisory of 5 June 2025, it told e-commerce platforms and online service providers to audit themselves within three months and remove any dark patterns. By 20 November 2025, 26 platforms had sent self-declarations saying they were free of dark patterns, according to the Ministry of Consumer Affairs.

The CCPA is also penalising breaches. In orders announced on 3 June 2026, it fined an ed-tech company ₹5 lakh for basket sneaking, confirm shaming and forced action (PIB, 3 June 2026). It fined a software company ₹1 lakh for a subscription-renewal screen that used confirm shaming, interface interference, trick questions and forced action, treating both as unfair trade practices.

The Act gives the CCPA wider powers than those fines suggest. It can order an unfair practice discontinued (section 20). It can also fine a manufacturer or endorser up to ₹10 lakh for a false or misleading advertisement, or up to ₹50 lakh for later contraventions (section 21). A false or misleading advertisement can also be a criminal offence, with up to two years' imprisonment and a fine of up to ₹10 lakh for a first offence (section 89).

The unsolicited business communication draft

One rule that would speak to calls directly is still not in force. As of 24 October 2026, the Guidelines for Prevention and Regulation of Unsolicited and Unwarranted Business Communication, 2024 are still a draft as far as we can find. The Department of Consumer Affairs published the draft on 20 June 2024 (PIB, 20 June 2024). Comments were due by 21 July 2024, and the deadline was later extended to 5 August 2024.

The draft treats a business call or message as unsolicited if it follows neither the customer's consent nor their registered preferences. It would apply not only to whoever makes the call but also to the business that hires them or benefits from it. Reports say it covered voice calls, SMS and messaging apps.

We found no final version in our searches, and the Department of Consumer Affairs website would not load when we checked on 24 October 2026. Until one appears, telemarketing calls fall under the commercial communication rules of TRAI, the telecom regulator, which TRAI's 2026 rules for AI and automated calls explain. Promotional calls come from the 140 series, and service calls from 1600, 1601 or regular numbers depending on the sector, as the guide to the 140, 1600 and 1601 number series sets out.

Key dates