Dark Patterns And Data Protection: What PhysicsWallah Order Reveals About India's Digital Regulatory Gap
The Central Consumer Protection Authority's (CCPA) recent action against PhysicsWallah has become one of the most significant regulatory interventions in India's evolving digital governance landscape. While the order primarily addressed the deployment of "dark patterns" on the ed-tech platform, it has also exposed a deeper and potentially more consequential regulatory issue: whether certain data collection practices by digital platforms comply with India's Digital Personal Data Protection Act, 2023 (DPDPA).
On June 1, 2026, the CCPA imposed a penalty of ₹5 lakh on PhysicsWallah after finding that the company had employed multiple dark patterns on its website and mobile application. These included a pre-selected donation checkbox that automatically added ₹10 to users' bills, emotionally persuasive messages encouraging users not to opt out of donations, and mandatory collection of personal information before users could access courses advertised as "free." The Authority concluded that these practices amounted to basket sneaking, confirm shaming, and forced action under the Guidelines for Prevention and Regulation of Dark Patterns, 2023.
Although the order was issued under consumer protection laws, it raises a separate legal question regarding the legality of collecting and processing personal data from users, particularly children. Under Section 9 of the DPDPA, data fiduciaries are required to obtain verifiable parental consent before processing personal data belonging to individuals under eighteen years of age. The law also restricts behavioural monitoring and targeted advertising directed at children.
The DPDPA and the Digital Personal Data Protection Rules, 2025 provide limited exemptions for educational institutions. However, these exemptions are narrowly tailored and apply only when data processing is directly linked to educational activities or child safety. Whether commercial ed-tech platforms can rely on these exemptions for practices such as mandatory registration, anti-piracy measures, or account management remains an open legal question.
Another significant issue concerns data minimisation. The DPDPA requires organisations to collect only such personal data as is necessary for the specific purpose for which it is obtained. During its investigation, the CCPA reportedly found that users were required to provide their phone numbers and email addresses before accessing free courses, even though the platform failed to demonstrate why such information was indispensable for delivering the content. This finding may have implications under the DPDPA's purpose limitation and necessity requirements.
The case also highlights concerns surrounding children's welfare in digital environments. Section 9(2) of the DPDPA prohibits processing that is likely to have a detrimental effect on a child's well-being. Where dark patterns are found to manipulate user behaviour through psychological pressure or emotional cues, regulators may increasingly examine whether such practices pose heightened risks when directed at minors.
Beyond the substantive legal questions, the PhysicsWallah order exposes a structural challenge in India's regulatory architecture. Consumer protection authorities and data protection regulators operate under separate statutory frameworks with different objectives, procedures, and enforcement mechanisms. While the CCPA investigated and established detailed factual findings relating to user interfaces and data collection practices, any future inquiry by the Data Protection Board of India would likely require an independent assessment under the DPDPA.
The case therefore illustrates the growing need for coordination among India's digital regulators. As technology companies increasingly operate at the intersection of consumer protection, privacy, competition, and digital governance laws, regulatory overlap may result in duplicate investigations and inconsistent outcomes unless stronger institutional mechanisms are developed.
The PhysicsWallah order is consequently more than a dark patterns enforcement action. It serves as an early indicator of how consumer protection and data protection regimes may converge in India's digital economy, particularly in sectors such as ed-tech where large numbers of children and young users interact with online platforms daily.