Dark-pattern self-audits: turn two storefront observations into evidence

Separate existing prohibitions from the new annual process

The 2023 Guidelines for Prevention and Regulation of Dark Patterns already apply. A June 2025 advisory separately called for e-commerce self-audits. Rule 4(15) in the September 2026 amendment adds an annual self-audit and prominent compliance-certificate requirement from 1 January 2027. The advisory is not the same instrument as that new yearly requirement.

Treat the annual review as a checkpoint, not a permission to leave known problems until the next audit. Scope the work around discovery, product selection, cart, checkout and, where relevant, subscriptions and cancellation. Include mobile journeys and features supplied by themes or third-party apps.

Sources: Official Gazette: 2026 amendment, rule 4(15), English pages 5–7 · PIB: June 2025 dark-pattern self-audit advisory · Primary text: Guidelines for Prevention and Regulation of Dark Patterns, 2023

Observation one: a countdown restarts in a fresh session

Imagine a product page says “Offer ends in ten minutes”. After the timer expires, the same offer remains; a fresh browser session starts another ten-minute countdown. Capture the wording, timestamps, session conditions and price before and after expiry. Then inspect the promotion configuration and ask what deadline the message is meant to represent.

The concern is false urgency if the presentation fabricates a deadline or pressure to purchase. A genuine customer-specific offer or an actual timed reservation needs its own contextual assessment; a reset alone does not settle the finding. Compare the promise made to that shopper with the real offer rules, including what happens when the clock runs out.

Sources: Primary text: Guidelines for Prevention and Regulation of Dark Patterns, 2023

Observation two: a paid add-on appears in the cart

Imagine an optional protection product appears after the shopper adds a shirt. Start from a clean cart and record each action, the add-on’s price, the default selection and any affirmative choice. Repeat the relevant route through quick-add, product-page and mobile controls. Check whether the shopper knowingly selected the item earlier.

The concern is basket sneaking when an additional item or payment is inserted without consent. Not every extra line item establishes that pattern: distinguish an optional product from a clearly disclosed necessary charge and examine the actual interaction. If a paid optional extra is being added by default without consent, remove that default and retest an explicit choice with no unexpected cart addition.

Sources: Primary text: Guidelines for Prevention and Regulation of Dark Patterns, 2023

Make the evidence, resolution and sign-off traceable

Use a working log that lets another reviewer reproduce the observation and understand the conclusion. This is a recommended structure, not an official audit template. Preserve unresolved questions instead of converting every automated flag into a confirmed violation.

Publish a certificate that matches the completed work

The amendment calls for prominent display of a certificate of compliance. It is not government certification or proof that a regulator approved the store. The cited materials do not establish an approved auditor scheme, prescribed certificate template or prescribed audit format. Avoid official-looking endorsement claims that the review cannot support.

Before publishing, have the responsible person review the scope, outstanding findings and factual basis of the certificate. Software can help organise observations, but it cannot confirm every contextual fact or make a certificate accurate automatically. Keep change ownership clear after sign-off so a new promotion or cart app does not reintroduce the issue.