What the CCPA's SpiceJet penalty changes for digital opt-in workflows

On July 17, 2026, the Central Consumer Protection Authority (CCPA) penalised SpiceJet Limited ₹1 lakh for deploying deceptive user interface designs during online flight bookings. The authority, headed by Chief Commissioner Nidhi Khare and Commissioner Anupam Mishra, identified three distinct non-compliances under the Guidelines for Prevention and Regulation of Dark Patterns, 2023: “Forced Action” through automatic enrolment into the SpiceClub loyalty programme via pre-ticked checkboxes; “Interface Interference” by pre-selecting consent for promotional communications; and “Trick Question” mechanics using ambiguous opt-in phrasing. The CCPA held that these practices breached Rule 4(9) of the Consumer Protection (E-Commerce) Rules, 2020 and amounted to unfair trade practices under the Consumer Protection Act, 2019, directing the airline to permanently discontinue default-consent mechanisms.

Scope Across Digital Consumer Platforms

While the order penalises a single airline, its operative reasoning binds every consumer-facing digital interface operating in India. Under the 2023 Dark Patterns Guidelines and E-Commerce Rules, digital platforms, travel aggregators, subscription services, and direct-to-consumer (D2C) brands cannot treat user passivity or checkout progression as affirmative consent. The ruling confirms that the CCPA treats pre-checked boxes—whether for paid add-ons, marketing lists, or loyalty memberships—as per se unfair trade practices rather than benign user-experience defaults.

Operational Playbook for Legal and Product Teams

In-house legal teams managing digital surfaces must coordinate with product and engineering leads to enforce three interface controls:

• Audit conversion funnels: Remove all pre-selected checkboxes across booking, payment, and account-creation workflows. All ancillary services, memberships, and recurring options must default to an unselected state.
• Unbundle communication consent: Separate transactional notifications from promotional marketing across SMS, WhatsApp, and email, requiring distinct, affirmative opt-ins for each commercial channel.
• Review consent phrasing: Eliminate double negatives and leading prompts that obscure the consequences of opting out or declining an optional service.