CCPA issues notices to 18 e-commerce and travel platforms over dark patterns
Enforcement focuses on drip pricing, false urgency and subscription traps, with the authority signalling that interface design is now an enforcement priority.
The Central Consumer Protection Authority has issued notices to eighteen e-commerce, travel and ticketing platforms alleging deployment of dark patterns prohibited under the 2023 guidelines.
The patterns cited
Three of the thirteen specified patterns account for most of the notices:
Drip pricing. Convenience fees, handling charges and platform fees revealed only at the payment stage rather than in the displayed price.
False urgency. Stock-count and viewer-count indicators that are not tied to actual inventory or actual concurrent users.
Subscription trap. Cancellation flows requiring materially more steps than sign-up, or requiring contact with a human when sign-up was self-service.
Why this reaches product, not legal
Each of these is a design decision, usually made by a product team optimising a conversion metric, usually shipped without legal review, and usually A/B tested to demonstrate that it works.
That last point is the awkward one. The existence of an experiment showing that a false urgency indicator increased conversion is, in enforcement terms, evidence of intent. Several of the notices reportedly reference internal experiment documentation.
The compliance design that works
Treating dark patterns as a legal review item fails because the volume of interface changes is too high for legal to see them. The organisations handling this well have moved the check earlier and made it mechanical:
- The thirteen patterns expressed as concrete design rules in the design system documentation, not as a legal summary
- A check in the pull request or design review template, owned by the reviewer rather than by compliance
- A rule that urgency and scarcity indicators must be driven by a real data source, enforced technically rather than by policy
- Cancellation flow step-count parity with sign-up, tested in the release checklist
Read-across
The notices are concentrated in e-commerce and travel, and the guidelines apply to any online interface — including banking apps, insurance purchase journeys, subscription software and telecom self-care portals. Organisations outside the sectors named should not read the enforcement focus as scope.
How Regulens customers received this
This item was scoped against every customer footprint within 15 minutes of publication. Customers to whom it applies received it routed to the named owner for the relevant theme, with the obligations decomposed, the affected entities identified and any prior assessment carried forward with the delta highlighted. Customers to whom it does not apply saw nothing — with the suppression reason recorded and auditable.
This analysis is provided for information only and does not constitute legal advice. Read it alongside the primary source it cites. Where a source reference is given (CCPA Notices, August 2026), that is the authoritative text.