Dark Patterns on the Chain: Blockchain-Enabled Consent Manipulation and Decentralised Consent Infrastructure under India’s DPDP Act, 2023
DOI:
https://doi.org/10.69971/dss.3.2.2026.69Keywords:
consent, dark patterns, blockchain, smart contracts, self-sovereign identity, data protection, privacy by design, consent manipulation, GDPRAbstract
Consent is the basis of India’s data protection framework. The Digital Personal Data Protection Act, 2023 (DPDP Act) created its entire lawful processing framework based on the concept of consent that must be “free, specific, informed, unconditional and unambiguous” as per section 6(1). The law enactment time coincided with the emergence of products related to blockchain identification and consent, as solutions to the very problem that the DPDP Act intends to resolve. The effectiveness of blockchain technology for securing consent records is only partially true. It can secure consent records from being changed retrospectively, but it cannot prevent the process of consent manipulation from taking place before a person accepts an agreement. This phenomenon is known as ‘dark patterns,’ where users are either persuaded or tricked to consent, can even occur on an error-proof consent ledger. Current study analyses the doctrinal framework of consent established by the DPDP Act and its rules and investigates the interaction between certain dark pattern classifications and the use of smart contracts and the systems of self-sovereign identity. It explores possible technical and regulatory interventions for improving this situation, using the EU experience with consent due to GDPR and Indian legislation on the subject.
Downloads
References
AI Act. 2024. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). Official Journal of the European Union L, 2024/1689, July 12, 2024.
Brignull, Harry. 2013. Dark Patterns: Inside the Interfaces Designed to Trick You. The Verge, August 29, 2013.
Casey, Michael J., and Pindar Wong. 2017. Global Supply Chains Are About to Get Better, Thanks to Blockchain. Harvard Business Review, March 13, 2017. https://hbr.org/2017/03/global-supply-chains-are-about-to-get-better-thanks-to-blockchain.
CCPA (Central Consumer Protection Authority). 2023. Guidelines for Prevention and Regulation of Dark Patterns, 2023. Gazette of India, November 30, 2023. New Delhi: Department of Consumer Affairs, Government of India.
Consumer Protection Act. 2019. The Consumer Protection Act, 2019. Act No. 35 of 2019. New Delhi: Government of India.
Crosby, Michael, Pradan Pattanayak, Sanjeev Verma, and Vignesh Kalyanaraman. 2016. Blockchain Technology: Beyond Bitcoin. Applied Innovation Review, no. 2 (June): 6–19.
De Filippi, Primavera, and Aaron Wright. 2018. Blockchain and the Law: The Rule of Code. Cambridge, MA: Harvard University Press. https://doi.org/10.4159/9780674985933
DPDP Act. 2023. The Digital Personal Data Protection Act, 2023. Act No. 22 of 2023. New Delhi: Government of India.
DPDP Rules. 2025. The Digital Personal Data Protection Rules, 2025. New Delhi: Ministry of Electronics and Information Technology, Government of India.
DSA. 2022. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and Amending Directive 2000/31/EC (Digital Services Act). Official Journal of the European Union L 277, October 27, 2022, 1–102.
EDPB (European Data Protection Board). 2020. Guidelines 05/2020 on Consent under Regulation 2016/679. Version 1.1, adopted May 4, 2020. Brussels: EDPB.
EDPB (European Data Protection Board). 2023. Guidelines 03/2022 on Deceptive Design Patterns in Social Media Platform Interfaces: How to Recognise and Avoid Them. Version 2.0, adopted February 14, 2023. Brussels: EDPB.
EU Blockchain Observatory and Forum. 2018. Blockchain and the GDPR. Thematic report, October 16, 2018. Brussels: European Commission.
Finck, Michèle. 2018. Blockchains and Data Protection in the European Union. European Data Protection Law Review 4 (1): 17–35. https://doi.org/10.21552/edpl/2018/1/6
GDPR. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation). Official Journal of the European Union L 119, May 4, 2016, 1–88.
Gray, Colin M., Yubo Kou, Bryan Battles, Joseph Hoggatt, and Austin L. Toombs. 2018. The Dark (Patterns) Side of UX Design. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems, paper 534, 1–14. New York: ACM. https://doi.org/10.1145/3173574.3174108
ICO (Information Commissioner’s Office). 2023. Guidance on the Use of Cookies and Similar Technologies. Wilmslow, UK: ICO.
IT Rules. 2011. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. G.S.R. 313(E). New Delhi: Government of India.
Mathur, Arunesh, Gunes Acar, Michael J. Friedman, Eli Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan. 2019. Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites. Proceedings of the ACM on Human-Computer Interaction 3 (CSCW): article 81, 1–32. https://doi.org/10.1145/3359183
Matthan, Rahul. 2018. The Third Way: Privacy Should Not Be a Trade-Off with Innovation. Discussion document. Bengaluru: Takshashila Institution.
MeitY (Ministry of Electronics and Information Technology). 2018. A Free and Fair Digital Economy: Protecting Privacy, Em-powering Indians. Report of the Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. New Delhi: Gov-ernment of India.
Millard, Christopher. 2018. Blockchain and Law: Incompatible Codes? Computer Law & Security Review 34 (4): 843–46. https://doi.org/10.1016/j.clsr.2018.06.006
Planet49. 2019. Case C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV v. Planet49 GmbH. ECLI:EU:C:2019:801. Court of Justice of the European Union (Grand Chamber), October 1, 2019.
Preukschat, Alex, and Drummond Reed. 2021. Self-Sovereign Identity: Decentralized Digital Identity and Verifiable Credentials. Shelter Island, NY: Manning.
Puttaswamy. 2017. Justice K. S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. Supreme Court of India, August 24, 2017.
RBI (Reserve Bank of India). 2016. Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016. As amended. Mumbai: RBI.
Zuboff, Shoshana. 2019. The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. London: Profile Books.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Authors
This work is licensed under a Creative Commons Attribution 4.0 International License.
