The Indian debate on dark patterns has, until now, been organised around a single question: is any existing or proposed statute doctrinally capable of reaching manipulative interface design? Consumer protection scholarship has generally answered yes, pointing to the Central Consumer Protection Authority’s 2023 Guidelines for Prevention and Regulation of Dark Patterns.1 Competition scholarship has more recently begun to answer yes as well, pointing to the ex-ante obligations proposed under the Draft Digital Competition Bill, 2024, which would prohibit self-preferencing and mandate interoperability for enterprises designated as Systemically Significant Digital Enterprises.2 Data protection scholarship has pointed to the consent and purpose-limitation obligations under the Digital Personal Data Protection Act, 2023.
Each of these answers is, on its own terms, largely correct. What has received far less attention is the question that arises once all three answers are true at once: a single interface practice, a subscription flow, a consent bundle, a checkout default, routinely falls within the independent jurisdiction of the Competition Commission of India (“CCI”), the Central Consumer Protection Authority (“CCPA”), and the Data Protection Board of India (“DPB”) simultaneously, and India has no mechanism to determine which of these bodies decides first, whose factual findings bind or inform the others, or how a consumer, a platform, or a competitor is meant to navigate three independent proceedings arising from one design choice. This article argues that this coordination gap, rather than any remaining doctrinal inadequacy in a single statute, is now the more urgent unresolved problem in India’s regulatory response to dark patterns.
The argument proceeds in four parts. Part II sets out the multiplicity problem in structural terms, showing how one practice can trigger three distinct legal tests under three different statutes. Part III grounds this in two live examples from Indian enforcement practice, the Competition Commission’s Google proceedings and the Consumer Protection Authority’s 2023 Guidelines and subsequent orders, to show that fragmentation is already observable rather than merely foreseeable. Part IV compares two international responses to the same underlying problem, the United Kingdom’s fused single-regulator model and the European Union’s managed-separation model, and shows that even the latter’s explicit statutory relationship clause has recently failed to prevent forum-shopping in practice. Part V proposes a coordination framework for India calibrated to avoid that specific failure, and Part VI concludes.
Consider a single, common design choice: a platform bundles a data-sharing consent requirement into the flow for accessing a service advertised as free, and separately structures its cancellation flow to be materially harder to complete than its sign-up flow. This single practice is capable of triggering, independently, three separate statutory tests.
First, under the CCPA’s 2023 Guidelines, such conduct falls within at least two of the thirteen specified categories of dark pattern, “Forced Action”, requiring a consumer to take an action they did not intend to take as a condition of accessing a good or service, and “Subscription Trap”, making cancellation deliberately difficult, both of which the Guidelines treat as a misleading advertisement, an unfair trade practice, or a violation of consumer rights under the Consumer Protection Act, 2019.3 Second, if the bundled data-sharing requirement is not genuinely necessary for the service in question, the same conduct raises a live question under Section 6 of the Digital Personal Data Protection Act, 2023, which will require consent to be free, specific, informed, unconditional and unambiguous, and withdrawable with the same ease with which it was given, a standard the Data Protection Board is empowered to enforce independently of any consumer protection finding.4 Third, if the platform in question is dominant within the meaning of Section 4 of the Competition Act, 2002, or, once the Draft Digital Competition Bill is enacted, designated as a Systemically Significant Digital Enterprise, the same bundling and retention design may separately constitute an abuse of dominance or a prohibited act of leveraging non-public user data to entrench market position.5
The CCPA’s own Guidelines expressly anticipate this overlap, but resolve it only in the thinnest possible sense. They provide that where a dark pattern practice is “regulated under any other law” for the time being in force, the Guidelines are to be read as “in addition to” and “not in derogation of” that other law.6 This is a savings clause, not a coordination mechanism. It confirms that Parliament and the CCPA anticipated concurrent applicability, but it says nothing about sequencing, about which regulator’s factual findings, if any, bind or inform the others, about whether a consumer or platform must litigate the same underlying facts three times, or about what happens when two regulators reach inconsistent characterisations of the identical practice. The structural problem is not that any one of the three statutory tests is wrong or poorly designed; each targets a genuinely distinct legal interest, deception of the individual consumer, integrity of consent over personal data, and distortion of competitive market structure. The problem is that nothing connects the three when, as is now routine, a single interface design implicates all of them at once.
In Umar Javeed v. Google LLC, the CCI found Google’s Android licensing and pre-installation practices to constitute an abuse of dominance across multiple markets, imposing a penalty of approximately Rs 1,337.76 crore and issuing a series of forward-looking behavioural directions.7 In a related proceeding concerning Google’s Play Store billing policies, the CCI imposed a further penalty of Rs 936.44 crore, finding that Google’s mandatory use of its own billing system, while exempting its own applications such as YouTube, constituted an unfair and discriminatory condition on app developers.8 On appeal, the National Company Law Appellate Tribunal (“NCLAT”) upheld the core dominance findings but set aside several of the CCI’s more forward-looking directions, including, in the Android appeal, those governing access to Google’s Play Services application programming interfaces, the uninstallation of pre-installed applications, the distribution of rival app stores through the Play Store and sideloading, on the basis that the CCI had not found the specific conduct underlying those directions to be independently anti-competitive; and, in the Play Store appeal, reduced the penalty from Rs 936.44 crore to Rs 216.69 crore by narrowing the turnover base used for calculation, setting aside four remedial directions, two of which, bearing on Google’s data policy and on its leveraging of billing data, it restored by a corrective order shortly afterwards.9
The significance of the NCLAT’s intervention for this article’s argument is structural rather than substantive. It shows that even where the CCI correctly identifies design-based exclusionary conduct, an appellate body applying the existing, ex-post Competition Act will not sustain remedies that function as prospective design mandates unless those specific design elements were themselves found to be anti-competitive. This is precisely the gap the Draft Digital Competition Bill is meant to close for the CCI’s own jurisdiction, by authorising true ex-ante conduct rules for designated enterprises.10 But closing that gap does nothing to connect the CCI’s jurisdiction to the CCPA’s or the DPB’s. Google’s self-preferencing of YouTube within its own billing system, and its integration of Google Pay into the Play Store checkout flow in a manner not available to rival payment applications, plausibly also implicate the CCPA’s post-2023 “Interface Interference” and “Basket Sneaking” categories, and the directions bearing on Google’s data policy, whose competition-law basis the NCLAT proceedings put squarely in issue, touch questions within the DPB’s consent and purpose-limitation mandate.11 No parallel CCPA or DPB proceeding arising from the same conduct appears in the public record. The gap the NCLAT exposed in the CCI’s own remedial toolkit is real, but it is only half of the fragmentation problem; the other half is that no other regulator with a potentially available and different legal basis for reaching the same conduct was drawn into the proceeding at all.
The CCPA’s own enforcement practice under the 2023 Guidelines illustrates the same gap from the consumer protection side. In one recent action, the CCPA penalised an education technology platform for requiring users to share personal information as a condition of accessing courses that had been advertised as free, characterising this as the “Forced Action” dark pattern and imposing a monetary penalty together with a direction to discontinue the practice.12 On the facts as reported, this is at the same time a textbook question under Section 6 of the DPDP Act, once that provision is in operation: personal data was collected as a precondition for a service that, on the CCPA’s own finding, did not actually require it, which is difficult to reconcile with a requirement that consent be free and specific to a genuine, necessary purpose. The order proceeded, on the public record, entirely as a Consumer Protection Act matter, with no indication that the Data Protection Board was notified, consulted, or itself opened a parallel inquiry into the same data collection practice.
Neither example suggests that either the CCI or the CCPA acted wrongly within its own statutory frame. Both suggest that India’s most significant digital-market enforcement actions to date have proceeded on a single-regulator, single-statute basis even where the underlying facts plainly implicated at least one other regulator’s independent jurisdiction. The fragmentation problem identified in Part II is not, on this evidence, a speculative risk to be guarded against; it is already the observed pattern of enforcement.
The United Kingdom’s Digital Markets, Competition and Consumers Act, 2024 (“DMCCA”) answers the coordination question by declining to create a coordination question in the first place. The Competition and Markets Authority (“CMA”), acting through its Digital Markets Unit, is given the power to designate firms as having “strategic market status” and to impose tailored conduct requirements on them, while the same CMA continues to exercise its pre-existing powers under the Competition Act 1998 and its consumer protection powers, now themselves strengthened by the same 2024 Act.13 The Act’s very title, coupling “competition” and “consumers” in a single instrument administered by a single regulator, reflects a deliberate institutional choice: rather than asking how three separately constituted bodies should coordinate, the UK gave one body all three mandates. The CMA’s first conduct requirements, proposed in January 2026 against Google’s general search services, were accordingly assessed by a single institution applying a single, internally consistent framework of “fair dealing, open choices, and trust and transparency”, without any need to reconcile competing characterisations from separate consumer or data protection regulators.14
The European Union took a different path. The Digital Markets Act (“DMA”) operates alongside, rather than in place of, Article 102 of the Treaty on the Functioning of the European Union and national consumer and data protection law. Article 1(6) DMA expressly preserves the application of national competition law equivalents to Articles 101 and 102 TFEU, while Article 1(5) prohibits Member States from imposing additional obligations on gatekeepers specifically to ensure contestable and fair markets, the precise objective the DMA itself pursues, and the European Commission is designated the DMA’s sole enforcer under Article 38(7).15 This is, in principle, a considered compromise: preserve the distinct legal interests protected by competition, consumer, and data protection law, while pre-empting Member States from re-legislating the DMA’s own specific subject matter under a different label.
In practice, this compromise has already been tested and found wanting. In 2025, the Italian Autorità Garante della Concorrenza e del Mercato took the view that Google’s request for consent to the combination and cross-use of personal data across its services was misleading and aggressive, and closed the proceeding by accepting binding commitments from Google, a course it took not under the DMA, which squarely covers gatekeeper data-combination practices under Article 5(2), but under Italian consumer protection legislation.16 Commentators have described this as enforcement “through the backdoor”, a national authority reaching DMA-scoped conduct by relying on a different legal basis over which the Commission has no exclusive claim, precisely the regulatory fragmentation Article 1(5) was designed to prevent.17 The lesson for India is not that managed separation is the wrong model; it is that an explicit statutory relationship clause, without more, does not by itself stop a determined regulator from reaching the same conduct through whichever legal basis it happens to hold. Something more operational, a positive mechanism for notification and engagement rather than a purely negative pre-emption rule, is needed to make managed separation work as intended.
Full fusion on the UK model is unlikely to be a realistic near-term option for India. The CCPA and the DPB are freshly and separately constituted bodies, each with mandates that extend well beyond digital platforms, the CCPA over all consumer goods and services and the DPB over all personal data processing, and each was built into its own statute after extensive, statute-specific legislative processes. Folding all three mandates into the CCI, or creating an entirely new super-regulator, would be a far larger institutional undertaking than India’s sectoral regulatory tradition has generally attempted, and risks losing the sector-specific expertise each body has begun to develop, the CCPA’s granular thirteen-category taxonomy of dark patterns being a clear example of expertise worth preserving rather than displacing.
A more realistic path, calibrated specifically to avoid the backdoor-enforcement failure the EU has already experienced, has three elements.
First, a statutory cross-notification duty. Where the CCI opens an investigation into a designated Systemically Significant Digital Enterprise’s conduct under the Draft Digital Competition Bill, or the CCPA opens an inquiry under the 2023 Guidelines against a platform that is, or is reasonably likely to be, so designated, or the DPB opens a significant data-fiduciary inquiry touching a common interface practice, each should be statutorily required to notify the other two within a short, fixed period, for instance fifteen days, through a shared inter-regulator digital markets registry. This need not, and should not, require any regulator to obtain the others’ consent to proceed; it simply ensures that no regulator investigates a practice in ignorance of a parallel proceeding, the precondition for any of the coordination that follows.
Second, a primary-characterisation rule with persuasive, not binding, effect. Rather than adopting the DMA’s hard pre-emption model, which the AGCM episode shows can be circumvented by a sufficiently motivated regulator relying on a different statute, India’s framework should require that where a second regulator investigates conduct already the subject of a completed finding by a first regulator, it must expressly engage with, and give reasoned consideration to, that earlier finding, rather than silently duplicating or implicitly contradicting it. This preserves each body’s independent statutory jurisdiction and distinct legal test, respecting the genuine differences between competition, consumer, and data protection harms, while making the AGCM’s kind of unacknowledged backdoor characterisation considerably harder to sustain without express justification on the record.
Third, a shared evidentiary registry. The CCPA’s thirteen specified categories of dark pattern already provide a workable, if consumer-protection-specific, taxonomy.18 A joint registry, maintained across the three bodies, recording confirmed instances of each category by platform and by conduct, would let a finding by one regulator function as a rebuttable evidentiary presumption available to the others, reducing the cost of triplicated fact-finding on the same underlying interface design and encouraging consistent characterisation of recurring practices across sectors, without requiring any single body to cede its ultimate decision-making authority.
Finally, and as an interim step while the Draft Digital Competition Bill remains unenacted, the CCI should draw the specific lesson of its own Google proceedings: rather than issuing final orders that import quasi-ex-ante design mandates unsupported by a specific anti-competitive finding, and risk the kind of partial reversal the NCLAT delivered, the CCI has under-used interim relief under Section 33 of the Competition Act to secure prompt behavioural relief while a fuller, and ideally cross-notified, investigation proceeds.19 Used in tandem with the notification duty proposed above, interim relief of this kind would allow the CCI to act quickly on the competition dimension of a dark pattern without foreclosing, or proceeding in ignorance of, the CCPA’s or the DPB’s independent assessment of the same underlying design.
The Draft Digital Competition Bill is a necessary reform, and the NCLAT’s partial reversal of the CCI’s Google orders shows precisely why: an ex-post competition statute cannot durably sustain remedies that function as forward-looking design mandates. But the Bill fixes only the CCI’s own remedial gap. It does nothing to connect the CCI’s jurisdiction to the CCPA’s or the DPB’s, even though, as the education technology enforcement action and the Google proceedings both show, a single interface design routinely implicates all three. India already has, in the CCPA’s own savings clause and in the European Union’s recent experience of backdoor enforcement under its own explicit relationship clause, clear warning that acknowledging overlap in a statute’s text is not the same as resolving it in practice. What remains is to build the specific, operational machinery, cross-notification, reasoned engagement with prior findings, and a shared evidentiary record, that would let India’s three regulators answer not only whether a given interface design is unlawful, but which of them decides, on what record, and with what consequence for the other two. Until that machinery exists, India’s dark patterns framework will remain doctrinally rich and institutionally silent on the one question that determines whether any of that doctrine is applied consistently at all.
*****
1. Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified by the Central Consumer Protection Authority under The Consumer Protection Act, No. 35 of 2019, India Code (2019), § 18, on Nov. 30, 2023. See Press Info. Bureau, Gov’t of India, Central Consumer Protection Authority Issues “Guidelines for Prevention and Regulation of Dark Patterns, 2023” for Prevention and Regulation of Dark Patterns Listing 13 Specified Dark Patterns (2023), https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=1983994.
2. Draft Digital Competition Bill, 2024, §§ 11, 13 (§ 11 prohibiting self-preferencing; § 13 governing restrictions on third-party applications), annexed to Comm. on Digital Competition Law, Ministry of Corp. Affairs, Gov’t of India, Report of the Committee on Digital Competition Law (Feb. 27, 2024), released for public consultation on Mar. 12, 2024. The Bill remains a draft: it has not been introduced in or passed by Parliament. See Press Info. Bureau, Gov’t of India, MCA Invites Public Comments on Report of Committee on Digital Competition Law and Draft Bill on Digital Competition Law (Mar. 12, 2024), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2013947.
3. Guidelines for Prevention and Regulation of Dark Patterns, 2023, supra note 1, cll. 2, 4-5 and Annexure 1 (cl. 2 defining a dark pattern as conduct “amounting to misleading advertisement or unfair trade practice or violation of consumer rights”; cl. 4 prohibiting dark pattern practices; cl. 5 providing that a person engages in a dark pattern practice by engaging in any practice specified in Annexure 1, which lists thirteen specified dark patterns, among them “Forced Action” and “Subscription Trap”).
4. The Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023), § 6(1), (4). Section 6 was not yet in operation when this article was written. The Act has been commenced in phases by notifications published on Nov. 14, 2025, alongside the Digital Personal Data Protection Rules, 2025, and § 6 falls within the group of provisions appointed to come into force eighteen months after that date. The Data Protection Board of India was constituted in November 2025.
5. The Competition Act, No. 12 of 2003, India Code (2003), § 4; Draft Digital Competition Bill, 2024, supra note 2, §§ 11-12 (§ 11 prohibiting self-preferencing; § 12 restricting the use and cross-use of personal data of end users across services without consent).
6. Guidelines for Prevention and Regulation of Dark Patterns, 2023, supra note 1, cl. 6 (“Guidelines not in derogation of other laws”: where a dark pattern practice “is regulated under any other law for the time being in force or the rules or regulations made thereunder, the provisions contained in these guidelines shall be in addition to and not in derogation of such other laws”).
7. Umar Javeed, Sukarma Thapar, Aaqib Javeed v. Google LLC, Case No. 39 of 2018 (CCI, Oct. 20, 2022) (imposing a penalty of Rs 1,337.76 crore), https://www.cci.gov.in/antitrust/orders/details/1070/0.
8. In re Alleged Anti-Competitive Conduct by Google in Relation to Its Play Store Policies, Case No. 7 of 2020 (CCI, Oct. 25, 2022) (imposing a penalty of Rs 936.44 crore, calculated at 7% of average relevant turnover). See Press Info. Bureau, Gov’t of India, CCI Imposes a Monetary Penalty of Rs. 936.44 Crore on Google for Anti-Competitive Practices in Relation to Its Play Store Policies (Oct. 25, 2022), https://www.pib.gov.in/PressReleasePage.aspx?PRID=1870819.
9. Google LLC v. Competition Commission of India, Competition Appeal (AT) No. 1 of 2023 (NCLAT, Mar. 29, 2023) (Android matter: upholding the Rs 1,337.76 crore penalty while setting aside the directions at paras. 617.3, 617.7, 617.9 and 617.10 of the CCI’s order, concerning Play Services API access, uninstallation of pre-installed applications, distribution of rival app stores through the Play Store, and sideloading); Alphabet Inc. v. Competition Commission of India, Competition Appeal (AT) No. 4 of 2023 (NCLAT, Mar. 28, 2025) (Play Store matter: reducing the penalty from Rs 936.44 crore to Rs 216.69 crore by confining the base to relevant turnover, and setting aside four remedial directions), as corrected by order dated May 1, 2025 (restoring two of those directions, on disclosure of Google’s data policy and on the leveraging of billing data for competitive advantage, their omission having been inadvertent).
10. Draft Digital Competition Bill, 2024, supra note 2, §§ 10-15 (obligations of Systemically Significant Digital Enterprises).
11. Cf. Guidelines for Prevention and Regulation of Dark Patterns, 2023, supra note 1, Annexure 1 (categories of “Interface Interference” and “Basket Sneaking”).
12. Press Info. Bureau, Gov’t of India, CCPA Acts Against Dark Patterns on Digital Platforms (Ministry of Consumer Affairs, Food & Pub. Distribution, 2026), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2268302 (recording penalties of Rs 5 lakh on an education technology platform, PhysicsWallah Ltd., and Rs 1 lakh on a software company, McAfee Software India Pvt. Ltd., under the Guidelines for Prevention and Regulation of Dark Patterns, 2023, the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020).
13. Digital Markets, Competition and Consumers Act 2024, c. 13, pt. 1 (strategic market status and conduct requirements), pts. 3-4 (enforcement of consumer protection law; consumer rights and disputes) (UK), https://www.legislation.gov.uk/ukpga/2024/13/contents.
14. Competition & Mkts. Auth., Final Decision: Strategic Market Status Investigation into Google’s General Search Services (Oct. 10, 2025), https://assets.publishing.service.gov.uk/media/68e8b643cf65bd04bad76724/Final_decision_-_strategic_market_status_investigation_into_Google_s_general_search_services.pdf; Competition & Mkts. Auth., Google’s General Search Services: Proposed Conduct Requirements (consultation opened Jan. 28, 2026), https://connect.cma.gov.uk/google-search-conduct-requirements.
15. Regulation 2022/1925, of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act), arts. 1(5), 1(6), 38(7), 2022 O.J. (L 265) 1, https://eur-lex.europa.eu/eli/reg/2022/1925/oj.
16. Autorità Garante della Concorrenza e del Mercato, Case PS12714, Google – Consent to the Linking of Services, decision of Nov. 4, 2025 (closing, by acceptance of binding commitments, proceedings opened in July 2024 in which the Authority took the view that the design and wording of Google’s consent request were misleading and aggressive under the Italian Consumer Code; the conduct falls within art. 5(2) of the Digital Markets Act), https://en.agcm.it/en/media/press-releases/2025/11/PS12714.
17. Bernd Meyring, Thomas Reyntjens, Sophia Foon & Will Leslie, Harmonised in Theory, Fragmented in Practice? The DMA Meets National Enforcement, Kluwer Competition Law Blog (Dec. 9, 2025), https://legalblogs.wolterskluwer.com/competition-blog/harmonised-in-theory-fragmented-in-practice-the-dma-meets-national-enforcement/ (“But the AGCM applied Article 5(2) DMA through the backdoor, via an application of its consumer protection legislation.”).
18. Guidelines for Prevention and Regulation of Dark Patterns, 2023, supra note 1, Annexure 1.
19. The Competition Act, supra note 5, § 33 (power to issue interim orders); see also Interim Measures in Indian Antitrust Cases: Past, Present and Future, SCC Online Blog (Apr. 19, 2023), https://www.scconline.com/blog/post/2023/04/19/interim-measures-in-indian-antitrust-cases-past-present-and-future/ (on the sparing use of the § 33 power as an alternative to final, forward-looking directions).