Consent or Coercion? Dark Patterns and the Illusion of User Autonomy under India’s Digital Personal Data Protection Framework

Consent is the principal legitimating device of contemporary data-protection law, yet digital interfaces increasingly shape rather than merely record individual choice. This article examines whether consent obtained through dark patterns can satisfy the Digital Personal Data Protection Act, 2023 (DPDP Act) and the constitutional requirement of informational autonomy. It adopts a doctrinal and interdisciplinary methodology, analysing the DPDP Act, the Digital Personal Data Protection Rules, 2025, Indian constitutional privacy jurisprudence, consumer-protection regulation, the European Union’s General Data Protection Regulation (GDPR), and behavioural scholarship on interface manipulation. The article finds that section 6 of the DPDP Act imposes a demanding cumulative standard requiring voluntariness, purpose specificity, adequate information, freedom from impermissible conditions and unmistakable affirmative conduct but the framework does not expressly identify manipulative design, specify interface-neutrality duties, or create a direct evidentiary presumption against consent collected through prohibited dark patterns. Fragmented enforcement between data-protection and consumer-protection institutions may therefore permit formal compliance while substantive autonomy is impaired. Comparative experience also shows that disclosure and consent alone cannot correct structural power, cognitive overload and dependency on dominant platforms. The article argues that dark patterns materially affecting a data decision should create a rebuttable presumption that consent is invalid. It proposes coordinated enforcement, symmetrical choice architecture, purpose-specific consent, auditable consent records, design-risk assessments and fiduciary-style duties for high-risk data fiduciaries.