THE CONVERGENCE OF DECEPTIVE DESIGN AND VITIATED CONSENT: A DOCTRINAL CONFLICT BETWEEN THE CCPA DARK PATTERNS GUIDELINES AND THE DPDP ACT, 2023

The central thesis of this paper has been that the convergence of deceptive design and vitiated consent is not an incidental overlap between two regulatory regimes but a structural feature of the platform-mediated economy. The CCPA Guidelines, 2023, and Section 6 of the DPDP Act, 2023, address the same transactional moment through different conceptual frames and with sharply asymmetric remedial inventories. The result, in the absence of doctrinal harmonisation and institutional coordination, is a regulatory blind spot through which the most sophisticated tech conglomerates can navigate by exploiting the seams between the two regimes. The doctrinal correction is not, however, beyond the reach of the existing statutory architecture. The rule-making powers vested in the Central Government and the two regulators are amply sufficient to co-notify a Fairness-by-Design audit standard, to constitute a Joint Task Force, to require transparency reporting, and to issue interpretive guidance recognising algorithmic coercion as a vitiating factor. The intervention required is administrative imagination rather than legislative renovation. The stakes of this intervention are not modest. India's Next Billion Users will encounter the digital economy not as sophisticated negotiators of terms of service but as users of interfaces designed by parties whose interests are asymmetric to their own. The protective ambition of the Consumer Protection Act, 2019, and the DPDP Act, 2023, can be realised in the practical experience of these users only if the legal system regulates the code of the interface and not merely the text of the policy. Doctrine has, in the years since Puttaswamy, supplied the language of dignitary autonomy; statute has, in 2019 and 2023, supplied the architecture of enforcement. What remains is the harder, quieter work of harmonisation—the work of ensuring that two regulators speaking the same descriptive language do so from a coordinated doctrinal vocabulary and a shared institutional discipline. The interface is the contract. The interface must, in consequence, be the object of law.

Article 29 Data Protection Working Party. (2018). Guidelines on Consent under Regulation 2016/679 (WP259 rev.01). Brussels: European Commission. Bamberger, K. A., and Mulligan, D. K. (2015). Privacy on the Ground: Driving Corporate Behavior in the United States and Europe. Cambridge, MA: MIT Press. Bhandari, V., and Sane, R. (2023). A Critique of the DPDP Act, 2023 (NIPFP Working Paper). New Delhi: National Institute of Public Finance and Policy. Brignull, H. (2010). Dark Patterns: User Interfaces Designed to Trick People. darkpatterns.org. Cavoukian, A. (2010). Privacy by Design: The 7 Foundational Principles. Toronto: Information and Privacy Commissioner of Ontario. Central Consumer Protection Authority. (2023). Guidelines for Prevention and Regulation of Dark Patterns. Notification No. CCPA/Dark Patterns/2023, dated 30 November 2023. New Delhi: Department of Consumer Affairs. Cialdini, R. B. (2007). Influence: The Psychology of Persuasion. New York: HarperBusiness. Cohen, J. E. (2019). Between Truth and Power: The Legal Constructions of Informational Capitalism. Oxford: Oxford University Press. Consumer Protection Act, 2019 (Act No. 35 of 2019). New Delhi: Government of India. Department of Consumer Affairs. (2024). Annual Report 2023-24. New Delhi: Ministry of Consumer Affairs, Food and Public Distribution, Government of India. Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). New Delhi: Government of India. European Commission. (2024). First Annual Report on the Application of the Digital Services Act. Brussels: European Commission. European Data Protection Board. (2022). Guidelines 03/2022 on Deceptive Design Patterns in Social Media Platform Interfaces. Brussels: EDPB.