Fixed the Dark Pattern After Getting Caught? Why That Does Not Erase CCPA Liability

By S&S Co. Advocates & Solicitors · Published 17 October 2026 · Informational content, not legal advice: see our disclaimer

E-commerce, ed-tech and other digital platforms have a predictable reflex once a dark pattern draws regulatory attention: fix the checkout flow quietly, point to the fix as evidence of good faith, and hope the matter is treated as resolved. The Central Consumer Protection Authority's order against PhysicsWallah, issued on 1 June 2026, shows that reflex does not work. The CCPA penalised the platform for a pre-ticked donation checkbox at checkout, a practice its 2023 Guidelines classify as basket sneaking, and held expressly that removing the feature after the notice did not absolve liability for the period it had actually been live.

The order is useful less for the penalty amount, which was modest, than for the reasoning the CCPA used to get there, and for what it signals about how the regulator treats a platform's own compliance timeline against its own enforcement timeline.

What basket sneaking actually covers

The CCPA's 2023 Guidelines for Prevention and Regulation of Dark Patterns, effective from 30 November 2023, set out an indicative list of thirteen prohibited practices, including false urgency, confirm shaming, subscription traps, drip pricing and basket sneaking. Basket sneaking is defined to cover the inclusion of additional items, services, or a payment such as a donation, at checkout, without the user's consent, in a way that makes the total amount payable higher than what the user actually chose to pay for. Disclosed necessary fees and genuinely free complimentary items fall outside the definition; what is caught is the undisclosed or pre-selected addition that the consumer has to notice and actively remove rather than actively choose to add.

In the PhysicsWallah matter, the mechanism was a checkbox labelled for a donation to the platform's foundation, pre-ticked by default during checkout, which added a modest sum to the total payable unless the user consciously deselected it. The CCPA also examined two related practices on the same platform during the same enforcement action: emotionally charged messaging around the donation prompt shown when a user clicked for more information, and courses advertised as free that in fact required the user to hand over a phone number and email address before access was granted. All three were treated as falling within the Guidelines' prohibited categories, though it was the pre-ticked checkbox that the order specifically classified as basket sneaking.

Why removing the pattern after the fact did not help

PhysicsWallah had already modified its checkout interface by the time the CCPA's order was passed, a point the platform's defence leaned on. The CCPA's position, as reported, was that this kind of post-notice correction, however promptly made and whatever the platform's intentions, does not extinguish liability for violations already committed while the practice was live. The regulator treated the fix as relevant to future compliance, and nothing more.

The reasoning has an obvious practical consequence for any platform weighing whether to wait for a complaint before auditing its own checkout flow. By the time a notice actually arrives, the window during which the practice operated, and during which liability accrued, has already closed in the regulator's favour. There is no credit available in the order for having stopped doing something wrong once caught; the CCPA's enforcement logic treats the violation as complete the moment the pattern went live, independent of whatever happens afterwards.

How exposure is actually measured

A platform assessing its own risk from a dark pattern often starts by looking at the per-transaction amount involved, reasoning that a small default charge could not possibly support a significant finding. That reasoning understates how the CCPA appears to approach aggregate exposure. A modest default donation, multiplied across a large user base over an extended period the pattern was live, produces a materially larger aggregate figure than the per-transaction number suggests, and it is the aggregate effect, not the individual transaction, that the regulator is positioned to weigh when assessing the scale of a violation.

This is also why a platform cannot defend a basket-sneaking finding by pointing to how small the add-on amount was. The size of the individual charge affects how the practice is perceived by any one user, but it does not by itself limit the overall scale of what the regulator can treat as a dark pattern violation once the practice is shown to have operated across a broad user base.

The compliance direction and the deadline that comes with it

Alongside the penalty, the CCPA's order carried a binding direction requiring PhysicsWallah to eliminate dark patterns from its platform, and orders of this kind commonly attach a short compliance reporting deadline, typically counted in days rather than weeks, running from the date of the order. A platform found in violation needs an implementation plan ready to execute immediately once an order is passed, not a plan to eventually get around to compliance. Treating the reporting deadline as a soft target, on the assumption that the regulator will tolerate some slippage given that corrective action is already underway, misreads how tightly these directions are usually drawn.

There is a second, less obvious consequence worth building into any internal escalation protocol. Once a show cause notice is received, the clock on both the underlying violation and the compliance direction starts running on the regulator's terms, not the platform's. A legal team that treats the notice stage as an opportunity to negotiate a longer informal runway before making changes is working against the order the CCPA has already shown it is prepared to issue; the safer course is to make the fix the moment the notice lands, and argue the penalty quantum separately.

What to do once a dark pattern is actually flagged internally

A platform that discovers its own checkout flow contains something resembling basket sneaking, whether through an internal audit, a customer complaint, or a product review, should fix the live experience immediately regardless of whether a regulatory notice has arrived. The PhysicsWallah order does not suggest that fixing a pattern is pointless; it only establishes that a fix does not reach back and cover the period before it was made.

What the fix does accomplish is limiting ongoing exposure and strengthening the platform's position on remedy and penalty quantum once a notice does arrive, since a regulator weighing the scale of a direction is likely to take some account of whether the practice is still live at the time of the order. Keeping a dated internal record of when the pattern was identified and when it was removed is therefore worth doing for its own sake, independent of whether the CCPA ever opens a file on the matter.

What a genuine proactive audit looks like, and why it is different

The CCPA has issued self-audit directions across the e-commerce sector more broadly, and the PhysicsWallah order is a useful illustration of why those directions should be treated as a real compliance exercise rather than a box-ticking response triggered only once a specific complaint lands. An audit undertaken before any notice arrives, covering every checkout flow, every pre-selected option and every piece of copy that nudges a user toward an unintended charge or disclosure, closes the exposure window described above before it opens rather than after.

A platform's legal and product teams reviewing checkout design should work from the Guidelines' own list of thirteen categories as a checklist, rather than relying on instinct about what feels manipulative. Several of the categories, such as drip pricing and subscription traps, are easy to miss precisely because they can be framed internally as ordinary monetisation design choices rather than as the specific prohibited patterns the Guidelines name.

Frequently Asked Questions

References & Further Reading

The provisions and rulings below were relied on for this guide. The position can change with amendments and later decisions, so check the current text and the latest case law before acting on any of it.

1. Consumer Protection (Prevention and Regulation of Dark Patterns) Guidelines, 2023 (effective 30 November 2023), listing thirteen prohibited dark pattern categories including basket sneaking
2. Central Consumer Protection Authority order against PhysicsWallah (Case No. CCPA-2/94/2025-CCPA), dated 1 June 2026, penalising a pre-ticked donation checkbox and holding post-notice removal does not absolve prior liability
3. Consumer Protection Act, 2019 (statutory basis for the Central Consumer Protection Authority's power to investigate and penalise unfair trade practices, including dark patterns, on digital platforms)