Data rules to tighten screws on e-comm dark pattern, food apps

The Digital Personal Data Protection Rules, 2025, may force e-commerce, ride-hailing and food delivery apps to rethink the way they design their interfaces.

- Sakshi Sadashiv & Sowmya Ramasubramanian

For years, platformshave engaged in forced opt-ins, buried opt-outs, and misleading prompts to trick users into sharing more data than they intended.

Under the new DPDP Rules, notified on 14 November, the tactics, known as dark patterns may face heightened scrutiny. The new rules put consent at the centre of data processing, sharpening choice and control for users.

Withdrawal of consent for usersmust be aseasy as giving it—translating into cleaner interfaces, fewer buried settings and tighter limits on what platforms can collect by default, Karan Taurani, executive vice president, ElaraSecurities, said. Notably, DPDP Act will have a bearing on e-commerce platforms pertaining to harvesting of customer data, and may not directly influence dark patternsas defined by the government in 2023.

The rules require e-commerce platforms to delete inactive-user data after three years, trimming the long tail of stored information that often enables dark patterns and introduce government-registered consent managers—intermediaries allowing users give, review or withdraw consent via a unified dashboard.

Dark patterns