CCPA Fines PhysicsWallah and McAfee for Dark Patterns: What Online Consumers Should Know

The Central Consumer Protection Authority (CCPA) has penalised edtech company PhysicsWallah and software firm McAfee for deploying dark patterns, the manipulative interface designs that nudge users into choices they did not intend to make. The orders, passed in mid 2026, are among the clearest enforcement signals yet that misleading digital design can attract regulatory penalties in India.

The action builds on India's existing framework against deceptive online practices and is a reminder that consumer rights apply online just as they do offline. Consumers who feel misled retain the right to seek redress, including by filing a consumer complaint through e-Daakhil and other forums.

What the CCPA Found

The CCPA imposed a penalty of Rs 5,00,000 on PhysicsWallah and Rs 1,00,000 on McAfee. According to the regulator, the McAfee renewal prompt offered users only options framed as accepting risk or renewing immediately, with no neutral choice to skip or cancel, and used colour and emphasis to steer users toward renewal.

In the case of PhysicsWallah, the authority noted that a significant part of its user base comprises students and young learners, which made manipulative checkout design particularly sensitive. The regulator concluded that the design choices triggered prohibited dark patterns.

The action is part of a wider tightening of standards for the digital economy. Regulators have signalled that the convenience of online services cannot come at the cost of honest dealing, and that consent, pricing and cancellation must be presented plainly. For a generation of consumers who transact almost entirely online, this clarity about what the law expects is increasingly important, and it places the onus on companies to design for fairness rather than for pressure. The orders make clear that this expectation now carries real financial consequences, not merely reputational ones.

What Are Dark Patterns

Dark patterns are user interface or design choices that deceive or manipulate consumers into doing something they would not otherwise do, such as buying a product, sharing data, or renewing a subscription. The Central Consumer Protection Authority issued the Guidelines for Prevention and Regulation of Dark Patterns in 2023, which identify and prohibit a list of specified patterns.

Recognised examples include false urgency, basket sneaking, confirm shaming, forced action, subscription traps, and interface interference. These practices can amount to unfair trade practices and misleading advertisements within the meaning of the Consumer Protection Act, 2019.

The Legal Basis for Penalties

The CCPA is a statutory regulator established under the Consumer Protection Act, 2019 to protect consumers as a class. Under Section 21 of the Act, it can order the discontinuance of false or misleading advertisements and impose civil penalties of up to Rs 10 lakh, rising to up to Rs 50 lakh for subsequent contraventions.

Alongside these powers, the E-Commerce Rules, 2020 require online platforms to avoid unfair trade practices and to provide clear, accurate information to consumers. The dark patterns orders sit within this broader regime of digital consumer protection, which has also seen action such as the CCPA advisory against hidden surcharges.

Why This Matters for Consumers

For everyday users, the orders confirm that the way a checkout, subscription or consent screen is designed can itself be unlawful if it manipulates choice. Consent obtained through trickery is not genuine consent.

The action also signals that regulators are scrutinising the digital economy more closely, a pattern visible across sectors, from advertising to the recent restrictions in the Online Gaming Act and the ban on real money gaming.

What Businesses Should Do

For companies operating online, the clearest lesson is to audit every consumer facing interface against the list of prohibited dark patterns. Checkout flows, subscription screens, consent banners and cancellation journeys all deserve particular attention.

Design choices that rely on confusion, pressure or default settings to extract a decision are now squarely within the regulator's view. A neutral and clearly labelled option to decline, skip or cancel should always be available and should not be hidden or visually understated.

Businesses should also keep records that show how consent was obtained and how pricing and renewal terms were disclosed. If a complaint is made, the ability to demonstrate a fair and transparent process is the best defence.

Boards and product teams may wish to treat dark pattern compliance as a standing item rather than a one time fix, since interfaces change frequently and a compliant design can drift into a non compliant one through small updates.

Key Takeaways

Businesses that operate online should audit their interfaces for the dark patterns listed in the 2023 guidelines and ensure that users can make free and informed choices, with clear options to decline or cancel.

Consumers who encounter manipulative design can report it to the CCPA or the National Consumer Helpline and may pursue compensation through the consumer commissions. The penalties on PhysicsWallah and McAfee show that the regulator is prepared to act, regardless of the size of the company.