What changed
On September 10, 2026, India's Department of Consumer Affairs notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, amending the 2020 e-commerce rules under the Consumer Protection Act, 2019. The changes take effect January 1, 2027, and apply to every marketplace and quick-commerce platform operating in India — from Amazon and Flipkart to Zepto, Blinkit, and Swiggy Instamart (PIB).
The substance is broader than a single headline can carry. Platforms must now: disclose the "prior price" — the lowest price charged in the preceding 30 days — alongside any advertised discount; label sponsored or paid listings "clearly and prominently"; stop manipulating search rankings in ways that mislead users or bury relevant results, and explain the main parameters that drive those rankings; disclose country of origin and importer details for imported goods; obtain express, affirmative consent before using consumer data for anything beyond the transaction; and conduct an annual self-audit against the 2023 Guidelines for Prevention and Regulation of Dark Patterns, displaying a compliance certificate as proof (Lawbeat).
The case for it
Start with the strongest version of the government's argument, because it holds up. India's National Consumer Helpline logs an enormous and rising share of e-commerce complaints, and the underlying practices being targeted are real and well-documented: "drip pricing" that hides fees until checkout, fake countdown timers manufacturing urgency, pre-ticked add-ons, and search results quietly reordered to favor paid placements over relevance — all thirteen of which the Central Consumer Protection Authority (CCPA) formally catalogued in its November 2023 Dark Patterns Guidelines, issued under Section 18 of the Consumer Protection Act (IAPP).
Those 2023 guidelines, however, were advisory. When the CCPA followed up in mid-2025 with a formal push for self-audits, 26 major platforms — Flipkart, Myntra, Swiggy, Zomato, Zepto, Meesho, and BigBasket among them — dutifully submitted declarations stating they were free of dark patterns within three months (Tribune India). Given how quickly and uniformly that compliance materialized, and given persistent complaint volumes, it's fair for regulators to conclude that a voluntary advisory with no audit trail, no penalty schedule, and no third-party verification was not going to change behavior on its own. Writing the audit requirement into binding rules, with the threat of Consumer Protection Act penalties behind it, is a defensible response to that specific failure.
Where the rules actually bite — and where they don't
The amendment is really two different regulatory instruments bolted together, and they deserve different scrutiny.
The price-history, sponsored-listing, search-ranking, origin-disclosure, and consent provisions are objective and externally verifiable. A platform either shows the 30-day low alongside a discount or it doesn't; a listing is either labeled "sponsored" or it isn't; a consent flow either precedes data use or follows it. These are the kind of rules that regulators, auditors, and even automated scrapers can check without relying on the regulated party's word. That's good rule-design, and it should quiet critics who assume any consumer-protection rule is inherently vague.
The dark-pattern audit is a different animal. It converts a subjective, thirteen-category judgment call — is this urgency banner "false," is this pricing "drip," is this interface "confirm-shaming" — into a check the platform performs on itself, once a year, with no independent auditor mandated and no defined penalty tier written into the amendment itself. Legal analysts flagged exactly this gap in the 2023 guidelines: no audit mechanism, no investigation process, penalties left to inference rather than statute (IAPP). Making the self-audit annual and rule-bound instead of a one-off advisory does not close that gap — it institutionalizes it. The 2025 episode, where every major platform cleared itself within the government's own three-month deadline, is the closest thing to a pilot run this model has had, and it produced uniform compliance certificates rather than any documented remediation.
The proportionate fix
None of this argues for scrapping the rules. The transparency mandates — price history, sponsored labeling, ranking-parameter disclosure, origin labeling, opt-in consent — are low-cost for platforms that aren't currently gaming consumers and high-value for the ones that are; they belong in force on schedule. The dark-pattern audit clause is where the Department of Consumer Affairs should keep working before January 2027: pairing the self-audit with CCPA spot-checks or accredited third-party review, and publishing audit methodology rather than just a pass/fail certificate, would convert a paperwork exercise into something platforms and consumers can actually trust. Proportionate regulation shouldn't mean choosing between binding rules and honest self-assessment — it means writing rules precise enough that self-assessment isn't the only check left standing.