Loopholes in the law
Ek chhoti si tick, do bade jhatke
- Is a pre ticked consent box valid under DPDP?
- No. Consent must be free, specific, informed and unambiguous, given by a clear affirmative action. A box already ticked, with the reject option buried in tiny faded text, is a dark pattern rather than consent.
- Who this affects
- Any business running a checkout, a signup or a consent banner.
- What to do about it
- Make refusing as easy as agreeing. If yes takes no effort and no feels like a treasure hunt, something is wrong.
Surya was checking out on an app. There was a small checkbox already ticked: "Yes, I agree to share my data with partner brands for better offers." The text was so small he did not even notice it. He just hit "Pay Now" and completed the order.
Two weeks later, calls and texts started coming in from brands he had never heard of. When he opened the app to check, that same checkbox was still ticked, and the "reject" option was hidden in tiny, faded text that took real effort to find.
That was not an accident
It is called a dark pattern: a design deliberately built so the user ends up agreeing to something they did not mean to, while the right choice sits buried and hard to reach.
The simple way to think about it: if saying yes takes no effort at all, but saying no feels like a treasure hunt, something is off.
One bad design choice, caught from two directions
Here is where it actually matters. In India, this kind of trick is not just bad design, it is against the law, and it can get a company caught from two different directions.
First, the Central Consumer Protection Authority has had guidelines since 2023 listing 13 kinds of dark patterns: things like pre-ticked boxes, fake urgency, and making cancellation deliberately hard. Those guidelines are already active today, and companies have already faced action for exactly this kind of checkout trick.
Second, once the DPDP Act is fully in force, that same tick mark becomes a second problem. Consent is only legally valid when it is freely given, clearly given, and given through a deliberate action. If the box was already ticked, and opting out was made deliberately hard, that is not valid consent at all. Which means the company used the data without proper consent, a separate violation in its own right.
Two laws, two timelines
So one bad design choice, two different laws, two different places it can get flagged. The consumer side hit can land today. The data side hit only starts landing from 2027, once the DPDP provisions are fully operational.
Surya now pauses for a second before checkout on any app, checking which box is already ticked. A small habit, but one small tick can turn into two big problems for a company.
Next time you open a form or a checkout screen, it is worth checking: did you tick that box yourself, or did someone tick it for you?
