The dark-pattern self-audit certificate
Rule 4(15) · in force 1 January 2027
Under Rule 4(15) of the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 (G.S.R. 789(E), notified 9 September 2026, in force 1 January 2027), an online store audits itself once a year for dark patterns and displays the resulting self-audit certificate on the store.
The 13 dark patterns
The self-audit covers the 13 patterns named in the Guidelines for Prevention and Regulation of Dark Patterns, 2023:
- False urgency
- Basket sneaking
- Confirm shaming
- Forced action
- Subscription trap
- Interface interference
- Bait and switch
- Drip pricing
- Disguised advertisement
- Nagging
- Trick question
- SaaS billing
- Rogue malware
How SahiSeal records it
- A guided self-audit: one pattern per step, each with plain-language checks phrased so that "No" means the pattern is absent.
- A certificate can only be issued when every check is answered "No", or "Not applicable" with a reason. A signer gives their name and designation and confirms a declaration.
- The certificate is a PDF with a serial number and a QR code linking to a public verification page that shows whether it is current, expired or replaced.
- A storefront badge links to that page and hides itself when the certificate expires. A reminder email is sent 30 days before expiry.
The certificate records the merchant's own self-audit. SahiSeal does not audit, inspect or certify any store.
This page summarises the rules for orientation. It is not legal advice; read the notification for the exact text.