Recommended Free Tools
India uses two connected compliance layers for online shopping. The Digital Personal Data Protection (DPDP) Act, 2023, together with the Digital Personal Data Protection Rules, 2025, governs personal-data handling. The Consumer Protection Act, 2019, the Consumer Protection (E-Commerce) Rules, 2020, and the Central Consumer Protection Authority (CCPA) Guidelines for Prevention and Regulation of Dark Patterns, 2023 govern misleading interfaces, unfair selling practices and consumer remedies. A lawful checkout therefore needs both a defensible data-consent flow and an honest, non-coercive buying experience.
Exact commencement dates, transition provisions, exemptions and penalty calculations under the 2025 Rules must be checked in the operative notifications and rule text. The guidance below explains the framework and the enforcement signals currently available, including CCPA orders announced on 3 June 2026.
As an Amazon Associate I earn from qualifying purchases.
What Indian e-commerce law applies?
No single statute answers every online-shopping question. The applicable obligations depend on whether the issue is personal data, the sale itself, or the way choices are presented.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Digital Personal Data Protection Act, 2023
The DPDP Act, 2023 is India’s principal statutory framework for processing digital personal data. It addresses how an organisation obtains and uses personal data, the responsibilities attached to that processing and the rights and duties connected with consent. For an online store, this layer covers activities such as creating an account, taking an email address or phone number, personalising offers and sending marketing communications.
Digital Personal Data Protection Rules, 2025
MeitY’s Digital Personal Data Protection Rules, 2025 provide the subordinate-rules layer. They are intended to supply operational detail for the Act, but the exact commencement schedule and transitional treatment must be read from the notified text in force for the relevant date. A product team should not assume that every provision became operative on the day the Rules were published.
Consumer Protection Act and E-Commerce Rules
The Consumer Protection (E-Commerce) Rules, 2020 operate under the Consumer Protection Act, 2019. They set responsibilities and liabilities for both marketplace and inventory e-commerce models and include customer-grievance redressal expectations. These rules concern how an entity represents products, prices, sellers and complaint channels, rather than replacing the DPDP data-protection analysis.
Dark Patterns Guidelines, 2023
On 30 November 2023, the CCPA issued the Guidelines for Prevention and Regulation of Dark Patterns, 2023 under section 18 of the Consumer Protection Act, 2019. The guidelines address design and choice architecture that deceives, coerces or influences consumers into choices that are not in their best interest. The official release identifies 13 specified dark patterns.
| Instrument | Date | Primary role | Who it addresses |
|---|---|---|---|
| Digital Personal Data Protection Act | 2023 | Statutory digital-personal-data framework | Organisations processing digital personal data and the people whose data is processed |
| Digital Personal Data Protection Rules | 2025 | Operational detail beneath the Act | Entities and processes covered by the notified Rules |
| Consumer Protection (E-Commerce) Rules | 2020 | E-commerce responsibilities, liabilities and grievance redressal | Marketplace and inventory e-commerce entities |
| Dark Patterns Guidelines | 30 November 2023 | Prevention and regulation of deceptive or coercive interface practices | Businesses designing or operating consumer-facing digital interfaces |
What is a dark pattern in online shopping?
A dark pattern is a design or choice-architecture technique that steers a person through deception, pressure or obstruction rather than allowing an informed, freely chosen transaction. The same visual element can be lawful or unlawful depending on its wording, timing, prominence and effect. A countdown that reflects a genuine, disclosed offer period is different from a fabricated deadline; an optional newsletter is different from a preselected subscription that is difficult to decline.
The CCPA release describes examples including the following:
- Drip pricing: showing an attractive initial price and revealing mandatory charges only later.
- Disguised advertisements: presenting paid promotion so it looks like neutral content or a normal product recommendation.
- Bait and switch: attracting a consumer with one offer and substituting a different product, price or condition when the consumer acts.
- False urgency: using an untrue countdown, scarcity claim or deadline to rush a decision.
- Basket sneaking: placing an additional product, service, donation or fee in the cart without an affirmative selection.
- Confirm shaming: framing a refusal as irresponsible, selfish or otherwise embarrassing.
- Forced action: requiring an unrelated step, such as sharing data or subscribing, before the person can obtain the promised service.
- Interface interference: making the preferred commercial choice prominent while obscuring or weakening the alternative.
- Trick questions: using confusing wording or a misleading control so the consumer’s click means the opposite of what a reasonable person would expect.
The release lists 13 patterns in total; the examples above are the categories specifically described in the cited CCPA material. A compliance review should test the complete guideline list rather than assuming that these examples are exhaustive.
Are pre-ticked consent boxes legal in India?
A pre-selected checkbox is not a reliable way to obtain consent. In its 2026 enforcement communication, the CCPA stated: “Consumer consent cannot be assumed through pre-selected options and must always be obtained through a clear and affirmative action.” A compliant flow should leave optional consent controls blank, explain what will happen, identify the relevant purpose and provide a visible way to decline.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Make consent affirmative and informed
Separate consent for materially different purposes. A customer should be able to buy an item without also agreeing to promotional email, behavioural advertising or an unrelated partner offer unless a lawful and clearly disclosed basis makes that processing necessary. Use plain language near the control, not a buried explanation that appears only after several screens.
Keep refusal neutral
The decline route should be comparable in visibility and effort to the accept route. Do not label an opt-out with insults, guilt or fear. A button such as “No, I’ll continue without the add-on” can be clear; wording such as “I don’t care about safety” is confirm shaming.
Make consent revocable
A person who opted in should be able to withdraw through an accessible account setting or communication preference, without having to repeat an unnecessarily burdensome process. Keep records showing when consent was collected, the notice shown, the purpose selected and any later withdrawal.
Can an online store add donations, insurance or other extras automatically?
Not when the customer has not affirmatively selected the extra. Automatically adding a donation, insurance product, warranty, membership or service to the basket is the classic basket-sneaking risk. The checkout should display the item, price, provider and material terms before payment, leave the choice unselected and require a deliberate action to add it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Emotional language can compound the problem. A removal link that implies a customer is careless for declining a donation may be confirm shaming even if the donation itself is optional. The safest pattern is a neutral description, an unchecked control and a plainly labelled removal or decline option.
What does “free” require when data is the payment?
A service advertised as free can still involve data processing, but the data condition must be disclosed clearly and the collection must be necessary and proportionate to the service offered. In its 2026 action, the CCPA found it misleading to advertise courses as free while requiring mobile-number and email sharing without clearly disclosing those conditions, where the data was not necessary to provide the content.
Before publishing a free-offer claim, document:
- what the user receives without payment;
- which data fields are essential to deliver or secure that service;
- which fields are optional and the separate purpose for each;
- whether marketing or profiling is bundled into the sign-up;
- how a person can refuse optional processing without losing the advertised core benefit.
What happened in the CCPA’s June 2026 enforcement action?
On 3 June 2026, the Central Consumer Protection Authority announced two penalties that illustrate how data collection and interface design can be assessed together.
| Entity | Penalty announced | Conduct described by CCPA | Patterns or concerns identified |
|---|---|---|---|
| PhysicsWallah | ₹5 lakh | A preselected ₹10 donation, emotional messaging discouraging its removal, and mandatory personal-data sharing for courses advertised as free | Basket sneaking, confirm shaming and misleading free-course/data conditions |
| McAfee | ₹1 lakh | A renewal interface placed “Renew Now” against “Accept Risk” | Confirm shaming, interface interference, trick question and forced action |
The amounts are the penalties announced in that release, not a universal tariff for every dark-pattern case. The order demonstrates that an interface can be problematic even when the underlying product or renewal is legitimate: the presentation of the choices matters.
How should an e-commerce team build a compliant checkout?
- Map every decision point. Capture product pages, cart, checkout, account creation, payment, renewal, cancellation, returns and support screens on desktop and mobile.
- Inventory every data field. For each field, record the purpose, whether it is necessary, the retention rationale, who receives it and whether the user can proceed without it.
- Separate required and optional choices. Keep purchase completion independent from marketing, profiling, donations and partner offers unless a documented legal and operational reason supports a different design.
- Reset optional controls. Remove preselected checkboxes, toggles and add-ons. Require a clear affirmative action for each optional purpose.
- Rewrite the notice. State price, recurring charges, renewal terms, data use and seller identity before the commitment point, using language a normal shopper can understand.
- Run a neutrality test. Compare the size, colour, placement, labels and number of clicks for accept, decline, skip, cancel and withdraw. A decline path should not be hidden behind a secondary link or a guilt-laden message.
- Test for dark-pattern outcomes. Ask an independent reviewer to attempt checkout while looking specifically for drip pricing, disguised advertising, bait and switch, false urgency, basket sneaking, confirm shaming, forced action, interface interference and trick questions.
- Preserve evidence. Keep dated screenshots or recordings, copy versions, consent logs, change approvals, seller disclosures, complaint records and remediation decisions.
- Provide grievance handling. Publish a reachable support and complaint route, identify who handles it and track response and resolution. Marketplace operators should distinguish their own responsibility from the seller’s while still presenting the information required by the E-Commerce Rules.
- Recheck after releases. A/B tests, pricing changes, payment-provider updates and renewal redesigns can reintroduce a dark pattern. Review the live experience, not only the design file.
What rights and practical steps do shoppers have?
Consumers should be able to see the complete price, identify optional extras, understand why personal data is requested and refuse non-essential processing without intimidation. Save screenshots of the page, cart and confirmation, including timestamps and the URL, before changing the order. Keep emails, invoices and support-ticket numbers.
Best Value
First ask the seller or platform to remove an unwanted add-on, correct a misleading charge, cancel an improperly renewed service or explain the data use. Use the published grievance channel and retain the response. If the issue concerns a marketplace seller, record both the seller details and the platform’s response. A pattern of hidden fees, coercive wording or forced data sharing can be reported to the relevant consumer-protection authority; the CCPA’s 2026 action shows that interface evidence can matter.
How do the compliance choices compare?
| Design decision | Defensible approach | Risky approach |
|---|---|---|
| Legal basis and purpose | Document the purpose and the applicable DPDP Act/Rules basis before collecting data. | Collect data first and decide its purpose later. |
| Consent | Separate, affirmative, informed and revocable consent for optional processing. | Pre-ticked boxes, bundled purposes or consent inferred from silence. |
| Price transparency | Show mandatory charges, recurring amounts and add-ons before commitment. | Reveal fees or a preselected extra only at the final step. |
| Accept and decline | Present neutral labels with comparable prominence and effort. | Use guilt, fear, confusing wording or a visually dominant accept control. |
| Data necessity | Collect only fields needed for the stated service and explain optional fields. | Make unrelated phone or email sharing a condition of a supposedly free service. |
| Accountability | Maintain interface, consent, seller-disclosure and grievance records. | Rely on undocumented design assumptions or an untracked vendor change. |
What is the status of online-review guidance?
The Bureau of Indian Standards notified Online Consumer Reviews — Principles and Requirements for their Collection, Moderation and Publication on 23 November 2022. The standard is voluntary and applies to online platforms that publish consumer reviews. Its stated principles are integrity, accuracy, privacy, security, transparency, accessibility and responsiveness. It does not replace the DPDP Act, the E-Commerce Rules or the Dark Patterns Guidelines, but it gives review platforms a useful benchmark for moderation and disclosure.
Questions teams should ask before launch
Can a required phone number be collected?
Only when the business can explain why it is needed for the stated service, security or fulfilment and presents that explanation clearly. A number requested solely for unrelated marketing should not be disguised as a necessary checkout field.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Is a countdown timer automatically unlawful?
No. The concern is false urgency. The timer should correspond to a real, disclosed end time or inventory condition and should not reset deceptively for each visitor.
Does a marketplace avoid responsibility because a third-party seller controls the listing?
No blanket assumption is safe. The E-Commerce Rules address responsibilities and liabilities for marketplace and inventory models, so the platform should maintain accurate seller information, disclosures and a functioning grievance route.
Are the 2026 penalties the maximum available?
The cited release announces ₹5 lakh against PhysicsWallah and ₹1 lakh against McAfee. It does not establish a universal maximum or a penalty formula for every scenario. Teams should consult the operative law, rules, notifications and the facts of any specific proceeding.
Bottom line for Indian online stores
Build the data and interface review together. Apply the DPDP Act, 2023 and the operative 2025 Rules to personal-data collection; apply the Consumer Protection Act, E-Commerce Rules and Dark Patterns Guidelines to pricing, disclosures, choice architecture and complaints. Remove preselected extras, emotional pressure, hidden charges and forced data sharing. Obtain clear affirmative consent, make refusal and withdrawal practical, and preserve evidence that the live checkout matches those decisions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
