CCPA fines PharmEasy ₹2 lakh for auto-renewing paid subscriptions without consent

The Central Consumer Protection Authority (CCPA) recently found that online pharmacy PharmEasy auto-subscribed users to a paid service without obtaining explicit consent, holding that the design amounted to the “basket sneaking” dark pattern.

The regulator imposed a ₹2 lakh penalty and directed the company to amend its platform design and terms & conditions to ensure full compliance.

A coram of Chief Commissioner Nidhi Khare and Commissioner Anupam Mishra concluded that the auto-subscription feature was misleading and unfair.

“The opposite party engaged in the dark pattern known as "Basket Sneaking", which involves pre-selecting or automatically adding paid options or services at the time of checkout without the explicit consent of the user, resulting in a misleading representation of the total payable amount. This practice squarely falls within the ambit of unfair trade practice under Section 2(28) & 2(47) of the Act, as it undermines consumer autonomy and induces consumers to pay for a service they did not knowingly opt for."

The proceedings began suo motu after the CCPA noticed that PharmEasy was auto-adding a paid service to users’ carts, a practice the regulator identified as a potential dark pattern under the 2023 Guidelines for Prevention and Regulation of Dark Patterns. The CCPA issued a show cause notice on June 14, 2024, asking Axelia Solutions (PharmEasy’s operator) to explain its conduct.

PharmEasy replied on June 2, 2024, admitting that an “auto-addition” feature was activated for certain users, but claimed that it was only applicable to existing subscribers and was being withdrawn. The company said backend changes would take 3–4 weeks. A further reply dated June 28, 2024, informed the regulator that the auto-feature had been removed

However, the regulator’s inquiry showed that the auto-subscription mechanism was active for far longer than PharmEasy initially claimed. According to the company’s own data, the feature was active in two distinct periods - November to December 2023 and again from March to June 2024. During these months, thousands of users were subscribed without express consent. The order records that 7,230 subscriptions occurred in April 2024 and 9,730 in May 2024, with further subscriptions continuing until June 27, 2024, when the feature was finally removed. The CCPA observed that such numbers could not be reconciled with the company’s assertion that the issue was brief or isolated.

The authority further held that PharmEasy’s practices violated Rule 4(9) of the Consumer Protection (E-Commerce) Rules, which mandate explicit and affirmative consent before charging for any service. Instead of seeking such consent, the platform added the paid feature by default, leaving users to notice and remove it during checkout. The CCPA found that this amounted to a critical failure in safeguarding consumer autonomy and was inconsistent with statutory requirements prohibiting default opt-ins.

The terms & conditions in use at the time also came under scrutiny. The CCPA noted that PharmEasy’s T&C allowed the company to modify or introduce new features, including auto-renewal, solely on the basis of a consumer’s original agreement. The authority held that this created a recurring financial obligation without fresh consent and therefore amounted to an “unfair contract term” under Section 2(46) of the Consumer Protection Act. The order states that such clauses “force consumers into a recurring financial commitment they have neither agreed to nor been made aware of.”

PharmEasy argued that most users benefitted from the service and that a majority of enrolled customers had utilised at least one feature. It also sought to describe the issue as a genuine technical error. The CCPA rejected these submissions, holding that no evidence was produced to support the claim of a malfunction and that the magnitude and duration of the auto-enrolments suggested otherwise. The regulator concluded that the “technical glitch” explanation appeared to be an afterthought raised only once the inquiry began.

After classifying the practice as “basket sneaking” under the 2023 Dark Patterns Guidelines, the authority directed PharmEasy to discontinue the feature entirely, issue refunds where consumers were charged without explicit consent, revise its T&C to comply with the law and pay the statutory penalty.

Advocates Ankur Khandelwal and Kajal appeared for PharmEasy.

[Read Order]