Digital Deception: Navigating India’s regulatory maze to tackle ‘dark patterns’

Need effective enforcement against dark patterns and privacy deception.

By Shivanghi Sukumar and Aarathi Menon 

Imagine you’re signing up for a free music streaming service. During the registration process, there’s a pre-checked box that says “I consent to receiving recommendations”. You might click through, assuming that it is a standard feature that enables the display of suggestions based on your listening history. You later discover that data relating to your listening habits is being sold to advertisers, and you’re receiving ads based on your musical tastes. You realise that the option to share your data was not presented in a way that was clear to you, and that you have given permission for something you did not agree to or expect. You might also feel hesitant to subscribe to another streaming service, given the extensive listening history you've built with your current one.

This is an example of privacy deception, a type of “dark pattern”, a deceptive online tactic used to manipulate user choice.  While the Indian government is taking steps to regulate dark patterns, difficulties in drawing clear boundaries between the mandates of different regulatory agencies could affect the effectiveness of any regulations and enforcement efforts in regulating dark patterns more generally, and privacy deception in particular.

Take the music streaming example above: at least three distinct sets of regulations come into play.

First, there are concerns of consumer welfare. The Central Consumer Protection Authority, which has introduced guidelines to regulate the use of dark patterns in the e-marketplace, could examine whether the music streaming service’s conduct amounts to interface interference, which hides relevant information from consumers.

Second, the example raises issues of consent under the Digital Personal Data Protection Act, India’s data protection law, which requires digital service providers to seek user consent for collecting and processing personal data. The (yet-to-be-constituted) Data Protection Board could examine whether the streaming service obtained explicit, informed, and freely given consent.

Third, the Competition Commission of India could also examine the impact of the streaming service’s conduct on the market, and assess whether the conduct made it more difficult for other streaming services to compete, or made it more difficult for consumers to switch to other streaming services, for example.

As a result, the same conduct could potentially attract the scrutiny of multiple regulators, and result in potential conflicts in enforcement approaches. To avoid conflicts, a well-structured referral or sequencing mechanism is necessary.

In the example above, to ensure a streamlined regulatory process, the Competition Commission of India may choose to refer cases involving consent issues to the Data Protection Board. This move would allow the Data Protection Board to ascertain whether free and informed consent was truly given. Armed with this information, the Competition Commission can then make a decisive judgment on whether intervention is necessary.

This approach would ensure a cohesive regulatory landscape where businesses can't exploit loopholes by pitting one regulator against another. It would also prevent protracted legal battles and expedite the resolution of complex cases that fall under the purview of multiple regulatory bodies.

As India's online population surges, the risk of individuals falling prey to deceptive "dark patterns" is escalating. Strengthening the enforcement of existing laws by establishing a referral system between regulatory bodies would ensure effective regulation and shield consumers from exploitative design tactics.

(Authors, Shivanghi Sukumar is a Partner, and Aarathi Menon is a Trainee Associate at Axiom5 Law Chambers.)

Views are personal and do not represent the stand of this publication.