The CCPA Just Fined Zepto and 8 Others for Dark Patterns: A Checkout Compliance Checklist for D2C

That countdown timer on your product page, the pre-ticked "add gift wrap for ₹49," the shipping fee that only appears at the last step, the cancel button buried three menus deep — if you run a D2C store in India, you probably use at least one of these, and a regulator just started fining brands for them by name. The clever conversion tactic and the legal liability turn out to be the same thing.

On 6 August 2026, India's Central Consumer Protection Authority (CCPA) disclosed fines against nine companies — Zepto, Physics Wallah, FirstCry, PharmaEasy, McAfee, SpiceJet, BookMyShow and IndiGo among them — for using dark patterns. The amounts are small, but the shift is not: this is enforcement, not advice, and the tactics being penalised are ordinary e-commerce CRO. This post covers what the CCPA actually did, which of the 13 banned patterns D2C brands most often run, and a checkout audit checklist to get clean before the pattern finds you.

What just happened

The CCPA moved from warning to penalty. It had earlier issued a three-month self-audit advisory asking e-commerce platforms to check themselves against the rules. The August action is the follow-through: actual fines, on named brands, for specific tactics.

The specifics matter because they show the regulator reading interfaces closely. Zepto was fined ₹7 lakh for drip pricing and basket sneaking — fees appearing late and items slipping into the cart. Physics Wallah drew ₹5 lakh for a pre-selected donation nudged with emotional persuasion. A coaching platform was penalised ₹3 lakh for fake countdown timers. FirstCry was fined ₹2 lakh, and PharmaEasy, McAfee and SpiceJet ₹1 lakh each, with BookMyShow and IndiGo also cited for basket sneaking and confirm shaming. The total came to roughly ₹20 lakh.

Small fines, loud signal

No D2C brand is going under for ₹7 lakh. That's not the threat. The threat is that regulators have now publicly demonstrated they'll inspect a checkout, identify the exact deceptive design, attach a brand name to it, and issue a penalty. Once that precedent exists, every brand running the same tactic is exposed to the same treatment — and to the customer trust damage of being named.

The 13 dark patterns — and the ones D2C actually uses

The fines enforce the Prevention and Regulation of Dark Patterns Guidelines, 2023, which specify 13 deceptive interface designs, including false urgency, basket sneaking, drip pricing, subscription traps, confirm shaming and trick questions. You don't need to memorise all 13. You need to recognise the handful that show up in almost every D2C funnel.

False urgency

The fake countdown timer that resets on refresh, the "only 2 left" that's always 2, the sale that "ends tonight" every night. Real scarcity is fine; invented scarcity is the violation.

Drip pricing and basket sneaking

Showing a low price, then revealing handling, packaging or convenience fees at the final step — that's drip pricing, the tactic that cost Zepto. Basket sneaking is the cousin: an add-on, warranty or donation that lands in the cart without a clear, deliberate yes from the customer.

Subscription traps and confirm shaming

Making sign-up one tap and cancellation an obstacle course is a subscription trap. Confirm shaming is the guilt-trip opt-out — "No thanks, I don't want to save money" — designed to make declining feel bad. IndiGo was cited for confirm shaming; the copywriting trick has a legal name now.

The tactic, the risk, the fix

Where growth and compliance collide

For a growth team, this feels like losing tools. It isn't, quite. The honest versions of urgency, scarcity, upsells and bundling are all still legal and still work — a sale that genuinely ends, a low-stock badge that's actually true, an add-on the customer clearly chose. What's now off the table is the deceptive version of each, and deception was always a short-term trade: it lifts one order and costs you the trust, the return, and the review.

Transparent checkouts tend to hold up better on the metrics founders actually care about — fewer disputes, fewer RTOs from buyers who felt tricked, better repeat rates from customers who trust the brand. Aligning your funnel to these rules is less a tax on conversion than a nudge toward the durable version of it. Making that trade-off well — keeping the persuasion, cutting the deception — is exactly the kind of CRO work our growth marketing team does when auditing a D2C store's funnel.

Keeping the persuasion, dropping the deception

The fear this triggers in a growth team is that the whole urgency-and-scarcity toolkit just got confiscated. It didn't. Every one of these tactics has an honest version that's fully legal and, over time, more effective because it doesn't corrode trust. The rule is simple: the claim has to be true and the choice has to be free.

Honest urgency

Run a sale that genuinely ends when you say it does, and let the timer reflect the real deadline. If your Diwali offer closes Sunday night, a countdown to Sunday night is fine — the violation is a timer that resets every time the page reloads. Real deadlines still drive action; you just have to mean them.

Honest scarcity

"Only 5 left" is a powerful line when there really are five left. Wire your low-stock badge to actual inventory so it tells the truth and updates as stock moves. A scarcity signal that's real both converts and protects you; one you invented is exactly what got a coaching platform fined.

Honest upsells

Offering a bundle, a warranty or gift wrap at checkout is good merchandising. Pre-ticking it so the customer pays unless they notice and untick is basket sneaking. Present the add-on, make the value clear, and let the customer choose it with a deliberate tap. You'll sell slightly fewer add-ons and generate far fewer angry refunds and chargebacks — a trade most founders take happily once they've seen the dispute numbers.

Your checkout audit checklist

Set aside an hour and walk your own store as a first-time buyer on a phone. Look for each of these, and fix what you find:

• Hidden fees: does any charge — shipping, handling, packaging, convenience — appear only at the last step? Surface it early.
• Pre-ticked boxes: is any add-on, insurance, membership or donation selected by default? Untick it and make it an active choice.
• Fake scarcity: do your timers or stock counters survive a page refresh and tell the truth? If not, fix or remove them.
• Cancellation friction: can a customer cancel a subscription as easily as they started it? If not, level them.
• Confirm shaming: does any opt-out use guilt or manipulation? Rewrite it neutrally.
• Sneaky opt-ins: are you enrolling people in emails, subscriptions or auto-renewals without a clear, separate consent? Separate them.

Do this now, before a complaint or a regulator does it for you, and document that you reviewed it. The single directive worth acting on today: treat your checkout as a compliance surface, not just a conversion surface — walk it, clean it, and keep only the persuasion that's true.

Sources: Business Standard, "CCPA fines IndiGo, Zepto, BookMyShow and others over dark patterns," 6 August 2026 — nine companies penalised, including Zepto (₹7 lakh, drip pricing and basket sneaking), Physics Wallah (₹5 lakh, pre-selected donation), a coaching platform (₹3 lakh, fake countdown timers), FirstCry (₹2 lakh), and PharmaEasy, McAfee and SpiceJet (₹1 lakh each), with BookMyShow and IndiGo cited; around ₹20 lakh total; disclosed to the Rajya Sabha. Enforcement under the Prevention and Regulation of Dark Patterns Guidelines, 2023, which specify 13 deceptive interface designs; follows an earlier three-month self-audit advisory to e-commerce platforms.