Consent by Design: Rapido, Dark Patterns and India’s New Audit Rule
Suppose the rider has just booked a ride for ₹60. The app then flashes: “Captains aren’t accepting at ₹60. Try adding +10, +20, +30”. The Central Consumer Protection Authority (CCPA) on 15 September 2026 announced a ₹10 lakh penalty on Rapido’s operator, holding such prompts to be “confirm shaming”. The rider had already booked at the quoted fare and the prompt created urgency and the fear of losing the ride.
The reasoning is more important than the amount. The CCPA also determined that the Rapido’s “Set your price” slider, which correlated higher fares with a green “higher chance of getting a ride” message and lower fares with red or orange warnings, was “interface interference”. Rapido said that the tipping was voluntary and that there was no requirement to match based on payment. This was rejected by the CCPA, which said the timing and design of the prompts was not conducive to getting a ride and that no data had been placed on record by Rapido indicating that paying more would increase the likelihood of getting a ride. The claim was not substantiated and was misleading. The CCPA also referenced the Motor Vehicle Aggregator Guidelines, 2025, which mandate that tipping features be only displayed after the ride. The regulator looked at the sequence, colour and evidence, not just the words on the screen.
The announcement came barely a week after the Centre notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 on 9 September. From 1 January 2027, new Rule 4(15) requires every e-commerce entity to comply with the 2023 Dark Patterns Guidelines (issued under Section 18 of the Consumer Protection Act, 2019, and listing 13 specific patterns), conduct a yearly self-audit and prominently display a certificate of compliance. This hardens the CCPA’s June 2025 advisory, which only advised platforms to self-audit within three months and encouraged self-declarations. Compliance becomes a recurring task, not a one-time redesign.
Will certification change behaviour? Early evidence is sobering. A LocalCircles audit between June and September 2025 found dark patterns, reported by consumers and validated by the pollster, on 97% of 290 major platforms. Its November 2025 follow-up found that 21 of the 26 platforms that had filed “dark pattern free” self-declarations with the CCPA still showed at least one. The government has imposed mild punishments so far: in August 2026, the government told the Rajya Sabha that nine platforms had been acted against, with about ₹20 lakh collected. The largest, ₹7 lakh on Zepto, was for drip pricing and basket sneaking. On the PIB’s summary, the new Rule requires a self-audit and a displayed certificate, but no independent verification.
For platforms, a displayed certificate is a public claim about the interface. The CCPA can act on its own motion, as it did against PhysicsWallah’s pre-selected ₹10 donation, and it got IndiGo to replace the opt-out line “No I will take risk” with neutral wording. Design reviews should therefore cover defaults, timing, colour and refusal wording, with an auditable record behind each certificate. Consumers can complain to the National Consumer Helpline on 1915. The legal issue is moving from whether the consumer agreed to the way the choice was constructed.
Dark-pattern regulation is no longer guidance but regular compliance and platforms will need to take interfaces into account as part of their legal risk regime. The question isn’t if the consumer said “yes” or not, but if the design offered the consumer any choice at all. If the interface chooses for the user, the law will consider it to be the platform’s choice, and the platform’s liability, as the CCPA’s recent orders demonstrate.
