DarkPatternAudit by VatsGlobal

GuideRule 4(15) · Myths · Updated 5 October 2026

What Rule 4(15) does not require

Rule 4(15) is one sentence long, and a lot is being sold on the back of it. Here is what the rule actually asks, and what it doesn't: no filing, no fee, no prescribed format, no approved auditor and no third-party certificate.

01What it asks

Three things

Sub-rule 4(15), inserted by G.S.R. 789(E) on 9 September 2026 and in force from 1 January 2027, asks every e-commerce entity to:

  1. comply with the Guidelines for Prevention and Regulation of Dark Patterns, 2023;
  2. conduct a yearly self-audit to ensure its platform is free from dark patterns; and
  3. display a certificate to that effect prominently.

02What it doesn't ask

Seven things it doesn't require

  • No filing

    The rule asks you to display the certificate. Nothing in it requires you to submit the certificate or the audit to the CCPA or anyone else.

  • No fee

    There is no registration and nothing to pay to any authority.

  • No prescribed format

    Neither the certificate's format nor the audit method, sampling or evidence standard is specified. That's why we published an open format; a filled sample shows it in use.

  • No approved or empanelled auditor

    It is a self-audit. You can get help, but no vendor is recognised to "certify" you, and none can make the declaration on your behalf.

  • No third-party "pass" certificate

    The certificate is your own statement. A vendor's pass or fail badge isn't what the rule asks for, and calling it government-approved would itself be misleading.

  • No named signatory

    The rule doesn't say who signs. Choose someone with the authority to stand behind it, and record their name and designation.

  • No definition of "prominently"

    A sensible reading is a dedicated page linked from every page's footer and from your policies, not a link buried three clicks deep.

03What still applies

"Not required" isn't "optional"

  • It is yearly. One audit in December 2026 doesn't cover December 2027.
  • The declaration is absolute. It says the platform is free of dark patterns, and customers, journalists and the regulator can test that claim. In 2025, a citizen platform reported that 21 of 26 platforms that self-declared still showed at least one dark pattern.
  • Enforcement runs through the Consumer Protection Act, 2019. The amendment adds no penalty clause of its own, but the CCPA can issue directions, and failing to comply with a CCPA direction is punishable under section 88 with up to six months' imprisonment, a fine of up to ₹20 lakh, or both.

What makes a statement defensible is the record behind it: what was examined, how, what was found and what was fixed, with dates. The checklist and generator are free; the Audit Sprint does it with you.

General information, not legal advice.