7 Consent Dark Patterns That Could Void Your Consent Under DPDP

Who this is for: product designers, growth and marketing teams, and legal reviewers who sign off on consent flows, banners and sign-up journeys.

Consent rates are an easy metric to optimise, and easy to optimise badly. A brighter "Accept" button, a hidden "Reject" link or a pre-ticked box will all raise the numbers. Under the DPDP Act, they also raise the question of whether the consent you collected is valid at all.

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. And since 2023, the Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns have treated specified deceptive designs as unfair trade practices. Consent flows sit squarely where the two regimes meet.

For the legal standard in full, see Valid Consent Under DPDP.

1. Pre-selected consent

The pattern: checkboxes already ticked, toggles already on, "opt out" instead of "opt in".

Why it fails: a pre-ticked box is not a clear affirmative action by the individual. The user's inaction is being treated as agreement.

Do instead: all non-essential consent options start off. The user must actively select them.

2. Asymmetric choices

The pattern: a large, coloured "Accept all" button next to a small grey "Manage settings" link; no "Reject all" on the first screen.

Why it fails: when refusing takes more effort than agreeing, consent is not freely given. The 2023 guidelines list interface interference, where design highlights some information and obscures other information to steer users, as a dark pattern.

Do instead: present "Accept" and "Reject" with equal prominence on the same layer, with "Customise" alongside.

3. Bundling and forced action

The pattern: one checkbox covering terms of service, privacy policy and marketing; a service that cannot be used unless the user agrees to unrelated processing.

Why it fails: consent must be specific and unconditional. Making a service conditional on agreeing to unrelated processing also fits the guidelines' description of forced action.

Do instead: one choice per purpose. Keep consent to marketing and partner sharing separate from accepting the terms of service.

4. Confirmshaming

The pattern: refusal labels designed to make users feel bad: "No thanks, I don't like saving money" or "I'll stay uninformed".

Why it fails: the guidelines list confirm shaming as a dark pattern. Guilt-driven consent is hard to call free.

Do instead: neutral labels: "Yes, send me offers" and "No, thanks".

5. Nagging

The pattern: a consent prompt that reappears on every page or every session after the user has refused.

Why it fails: nagging is a listed dark pattern, and consent eventually given just to make the prompt stop is not freely given.

Do instead: record the refusal and respect it. Offer a persistent settings link so users can change their mind on their own terms.

6. Trick questions and vague wording

The pattern: double negatives ("Uncheck this box if you prefer not to not receive updates"), vague purposes ("to improve your experience"), or notices buried in long legal text.

Why it fails: consent must be informed and specific, and Rule 3 requires notices in clear and plain language that can be understood on their own. The guidelines also list trick questions as a dark pattern.

Do instead: one plain sentence per purpose, stating the data, the use and the benefit.

7. Obstructed withdrawal

The pattern: consent given in one tap, but withdrawal requires an email to support, a phone call or a hunt through account settings.

Why it fails: Section 6(4) requires withdrawal to be as easy as giving consent. Subscription traps that make cancellation difficult are also a listed dark pattern.

Do instead: withdrawal in the same channel and with the same effort as consent: a toggle in settings, "STOP" by message, or a persistent cookie settings link.

Children: a higher bar

For children, Section 9(2) separately prohibits processing likely to have a detrimental effect on their well-being. Pressure tactics in products used by under-18s, such as streaks, countdowns and manipulative rewards, carry extra risk. See verifiable parental consent.

A quick review checklist

How ConsentifyAI helps

ConsentifyAI's banners and consent components are designed to pass these tests by default: options start off, Accept and Reject are equally prominent, each purpose has its own choice, refusals are remembered, and withdrawal is always one step away. Every version of every flow is logged, so you can show exactly what users saw when they made their choice.