Annual Dark-Pattern Self-Audit and Compliance Certificate: What the 2026 E-Commerce Rules Require

From 1 January 2027, every e-commerce entity in India must comply with the Guidelines for Prevention and Regulation of Dark Patterns, 2023, undertake a yearly self-audit and prominently display a certificate of compliance. The rule is part of the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, notified on 9 September 2026. This is general information, not legal advice; confirm the detail with a lawyer.

What exactly does the rule say?

The Department of Consumer Affairs release of 10 September 2026 says e-commerce entities "shall comply with the Guidelines for Prevention and Regulation of Dark Patterns, 2023, undertake a yearly self-audit and prominently display a certificate of compliance". The amended Rules come into force on 1 January 2027.

A law-firm summary places the clause at Rule 4(15) of the E-Commerce Rules and says the certificate should confirm the platform is free of dark patterns. Another summary calls it a new sub-rule and describes it as the first statutory incorporation of the 2023 guidelines. Commentators differ on the exact rule number, so quote the gazette, not a blog, in any internal document.

Who has to do the audit?

The obligation falls on e-commerce entities, not on sellers specifically. In practice that means three groups.

The law-firm summary lists "all e-commerce entities", marketplace entities (Rule 5), sellers (Rule 6(5)) and inventory entities (Rule 7(1)(a)) as the parties the amendment touches. Whether a very small D2C store falls inside the definition is a legal question we have not seen answered in the sources we opened.

What is a self-audit, and who signs the certificate?

The sources we opened do not say. One commentary notes that the self-audit is an internal review and should not be confused with independent verification of every screen, and that the rules do not say what the audit must cover or who issues the certificate. Another summary says the entity audits itself, with no external auditor mentioned, and that platforms will need a documented basis for the certificate. A law-firm piece recommends appointing an auditor but gives no qualifications or format.

So, as of November 2026, not confirmed:

• the deadline for the first audit and the first certificate;
• a prescribed format or template for the certificate;
• whether an outside auditor is required or only recommended;
• where on the site the certificate must sit, beyond "prominently";
• the penalty for not displaying one.

Is there any earlier signal on how the CCPA sees audits?

Yes. On 5 June 2025 the Central Consumer Protection Authority issued an advisory asking e-commerce platforms to conduct self-audits to identify dark patterns within three months, and to consider issuing self-declarations based on those audits. That advisory was a request. The 2026 amendment turns the yearly audit and the displayed certificate into a rule, according to the summaries above.

The same advisory cites Rule 4(9) of the 2020 E-Commerce Rules, under which consent to a purchase is recorded only by an explicit, affirmative action, not through something like a pre-ticked checkbox. That is a good first test for any checkout.

How do I run a defensible audit before 1 January 2027?

Nothing below is prescribed by the rules. It is a sensible way to build the paper trail the summaries say you will need.

1. Name an owner. One person signs off, with product, design, marketing and legal input.
2. Read the 2023 Guidelines. They name 13 types of dark pattern. We could not open the official text, so work from the Guidelines themselves, not from our summary. Our dark patterns guide for sellers covers the practical side.
3. List every screen and flow. Product pages, cart, checkout, subscription and cancellation, pop-ups, emails, push messages, app-install prompts.
4. Test each against each pattern. Record pass, fail or not applicable, with a screenshot and a date.
5. Fix, then re-test. Keep the before and after.
6. Check the other new duties together. The same amendment requires sponsored listings to be clearly identified and price cuts to show the prior price, the lowest price in the 30 days before the announcement. Countdown timers and "only 2 left" banners sit squarely in an audit.
7. Keep the file. Store the evidence for each yearly cycle. The certificate should rest on it.

Why is the government doing this now?

The release gives the context: in 2025 the National Consumer Helpline received 17,71,622 grievances, of which 5,11,196, around 29 per cent, related to e-commerce. The same amendment makes every e-commerce entity a partner in the Helpline's convergence process and requires it to give the complainant a copy of the complaint as recorded by its grievance officer. Expect complaints about misleading interfaces to reach platforms through that channel, which is one more reason to keep the audit file ready.

What should marketplace sellers do?

You do not issue the certificate. You do control things the marketplace will audit and the shopper will see: your price history, your discount claims, your stock claims and your listing content. The amended Rules also require sellers to give the platform country of origin, return, refund and warranty terms, delivery and payment details, and a GSTIN or MSME number. Our E-Commerce Amendment Rules guide has the full seller checklist, and the compliance calendar puts the dates in order.

FAQ

Do I need a dark-pattern certificate if I only sell on Amazon or Flipkart? Not as the seller. The summaries we read put the audit and certificate on the e-commerce entity, which for a marketplace is the platform. You still have to give accurate listing data and honest price and stock claims.

When does the first certificate have to be displayed? The rules apply from 1 January 2027. The sources we opened do not give a separate deadline for the first audit or certificate, so it is not confirmed whether it is due on day one or within a window. Plan to be ready by 1 January 2027.

Does my D2C Shopify store count as an e-commerce entity? Likely yes if you sell goods directly to Indian consumers, since the amendment reaches inventory e-commerce entities. A very small store may argue otherwise, but we found no source that settles it. Ask a lawyer and plan the audit anyway.

Can I audit myself, or must it be an outside firm? The amendment says "self-audit". Summaries say no external auditor is mentioned, while one recommends appointing one. Not confirmed either way. An outside review makes the certificate easier to defend, but is not shown as required.

What is the penalty for not displaying the certificate? None of the sources we opened names a penalty amount for this clause. Contraventions after 1 January 2027 attract the applicable provisions of the Consumer Protection Act, 2019, according to a law-firm summary.

Is there an official certificate template? Not that we could find as of 9 November 2026. Check the Department of Consumer Affairs and the CCPA before you design your own.

Start the audit file now

Listing copy, price claims, badges and pop-ups are the first things an audit reviews. Blooprint is a Bengaluru e-commerce agency and Amazon SPN verified partner that manages catalogues across marketplaces; see our catalogue and listing optimisation service if you want the content side cleaned up before the audit.