Dark Patterns on the Chain: Blockchain-Enabled Consent Manipulation and Decentralised Consent Infrastructure under India’s DPDP Act, 2023

Abstract

Consent is the basis of India’s data protection framework. The Digital Personal Data Protection Act, 2023 (DPDP Act) created its entire lawful processing framework based on the concept of consent that must be “free, specific, informed, unconditional and unambiguous” as per section 6(1). The law enactment time coincided with the emergence of products related to blockchain identification and consent, as solutions to the very problem that the DPDP Act intends to resolve. The effectiveness of blockchain technology for securing consent records is only partially true. It can secure consent records from being changed retrospectively, but it cannot prevent the process of consent manipulation from taking place before a person accepts an agreement. This phenomenon is known as ‘dark patterns,’ where users are either persuaded or tricked to consent, can even occur on an error-proof consent ledger. Current study analyses the doctrinal framework of consent established by the DPDP Act and its rules and investigates the interaction between certain dark pattern classifications and the use of smart contracts and the systems of self-sovereign identity. It explores possible technical and regulatory interventions for improving this situation, using the EU experience with consent due to GDPR and Indian legislation on the subject.