Technology
Regulators now check app screens as closely as users do.
We design every journey from sign-up to cancellation for social, creator, dating, marketplace and subscription apps. We also build the trust and safety tools behind them and the labels on AI-generated content.
Where the rules biteMap of all forty-one industries
What is shifting
The changes cover dark patterns, AI labels, grievance deadlines and children’s data. Each shift names what it demands, with a fact you can check.
What it requiresSign-up, checkout and renewal screens that pass a dark-pattern audit before release.
EvidenceThe CCPA named 13 dark patterns in 2023. In June 2026 it fined an edtech platform for a pre-ticked donation and a security-software maker for an ‘Accept risk’ renewal screen.
What it requiresCreation tools that label AI output by default, and upload flows that ask users to declare AI content before publishing.
EvidenceIndia’s IT Rules amendment of 10 February 2026 requires prominent labels and embedded metadata on AI-generated media, in force from 20 February 2026.
What it requiresReporting, grievance and takedown tools that show the trust and safety team every deadline.
EvidenceThe IT Rules, as amended from 20 February 2026, require intermediaries to act on government or court orders within three hours. Grievances must be resolved within seven days.
What it requiresAge-aware journeys with verifiable parental consent and no behavioural advertising to minors.
EvidenceThe DPDP Act bars tracking, behavioural monitoring and targeted advertising directed at children. Its parental-consent rules apply from 13 May 2027.
The rulebook
We set out how the IT Rules, CCPA dark-pattern guidelines, RBI e-mandate rules, DPDP Act and EU Digital Services Act apply to consumer apps. Your counsel confirms the position for your product.
Frameworks we build to
We design and build to these frameworks; this is not a claim of certification.
Shapes most of the work
Central Consumer Protection Authority
Thirteen dark patterns are unfair trade practices for platforms offering goods or services in India. They include false urgency, basket sneaking, confirm shaming, forced action, subscription traps, drip pricing and nagging.
We designEvery journey is checked against the thirteen patterns before release, and the check is kept as evidence.
CCPA · Guidelines for Prevention and Regulation of Dark Patterns, 30 November 2023 Official text: CCPA dark-patterns guidelines, 2023
Shapes most of the work
Ministry of Electronics and IT
Intermediaries publish their rules and a grievance officer, acknowledge complaints within 24 hours and resolve them within seven days. They act on government or court orders within three hours, and large social platforms carry extra duties.
We designReporting, appeal and takedown flows are built into the product, with each deadline on screen for the team.
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 · as amended by G.S.R. 120(E), 10 February 2026 Official text: IT Rules, 2021 — due diligence and grievances
European Union
Online platforms may not design interfaces that deceive or manipulate users. They must explain how their recommender systems rank content and may not show profiling-based ads to users they know are minors.
We designFor EU users, recommendation settings and ad explanations are built into the product itself.
Regulation (EU) 2022/2065 · Articles 25, 27 and 28 · applicable from 17 February 2024 Official text: EU Digital Services Act
Often shapes the work
Reserve Bank of India
Recurring charges carry a notice at least 24 hours before each debit, with a way to opt out of that debit or the whole mandate. Charges of up to ₹15,000 may run without an extra authentication step.
We designRenewal screens show the next charge, its date and the way out, in words that match the bank’s notice.
RBI · Digital Payments – E-mandate Framework, 2026 (Master Direction of 21 April 2026) Official text: RBI e-mandate framework, 2026
Shapes most of the work
Ministry of Electronics and IT
A parent’s verifiable consent before processing a child’s data, and no tracking, behavioural monitoring or targeted advertising directed at children. Consent is given per purpose and withdrawn as easily as it was given.
We designAge-aware journeys, parental-consent flows and ad systems that switch profiling off for minors.
DPDP Act, 2023 · section 9 · DPDP Rules, 2025, rule 10 (from 13 May 2027) Official text: DPDP Act, 2023 — children and consent
Ministry of Electronics and IT
Social media platforms and e-commerce entities with two crore or more registered users in India erase personal data three years after a user’s last contact. Users get at least 48 hours’ warning.
We designDormancy notices and deletion jobs are designed and tested, with one easy way to keep the account.
DPDP Rules, 2025 · rule 8 and Third Schedule (from 13 May 2027) Official text: DPDP Rules, 2025 — erasure after inactivity
Often shapes the work
Ministry of Electronics and IT
Tools that create or alter media with AI must label the output prominently and embed permanent metadata where technically feasible. Large social platforms must ask users to declare synthetic content and verify the declaration before publishing.
We designCreation and upload flows label AI output by default and keep the user’s declaration with the post.
G.S.R. 120(E), 10 February 2026 · in force 20 February 2026 Official text: IT Rules amendment, 2026 — synthetically generated information
Compiled 3 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
What comes up first in most consumer internet & apps conversations, from customer-facing screens to internal operations.
Renewal reminders on time, a visible way out and no shaming copy.
Labels on AI-generated images, voices and posts, and on paid creator content.
Complaints acknowledged, tracked and resolved within the stated time, with a route to appeal.
What we build
A typical programme here uses each discipline in this mix. Each line says what it builds for the industry and links to the capability behind it.
Grievance, reporting and takedown tools with deadlines, audit logs and the integrations behind them.
Sign-up, subscription and cancellation journeys checked against the thirteen dark patterns and tested for conversion.
Creation tools that label AI output, and moderation assistants where a person makes each decision.
Lifecycle messaging based on consent, with preferences and quiet hours the user controls.
A product voice that is clear about prices, renewals and advertising.
Creator programmes with the disclosure built into every brief and post.
Programmes
Each programme runs as one of our engagement packages and has its own measure. Durations are typical.
The way in
We check every sign-up, checkout, renewal and cancellation flow against the dark-pattern, e-mandate and DPDP consent rules, and rank fixes by risk and revenue.
What you get
02Milestone · 3–6 months
Reports, appeals, government orders and grievances in one queue, each with its deadline and audit trail.
MeasureGrievances resolved within the seven-day clock
Services: Custom CRM or operations platform · Complete UX & UI design · System integration
Enquire about Trust and safety console03Project · 6–10 weeks
Labels, provenance metadata and upload declarations for AI-generated content, tested against the 2026 IT Rules amendment.
MeasureShare of AI-generated uploads labelled at the source
Services: AI interaction pattern set · AI use policy, rights & disclosure · Front-end build
Enquire about Synthetic-media labelling04Retainer · Ongoing, 6-month minimum
Onboarding, renewal and win-back journeys that respect preferences, quiet hours and the pre-debit notice.
MeasureDay-30 retention
Services: Lifecycle journey build · Email, SMS & WhatsApp set-up · Customer data & identity foundation
Enquire about Lifecycle messaging on consentHow success is measured
Main measureDay-30 retention
AI, under the rules
Each use case has an owner, an evaluation set and a log. No model removes content or closes a complaint on its own.
Use case 01
Measured byShare of AI-generated uploads labelled at the source
Tested forOWASP LLM01 · Prompt injection
Goes live only with its evaluation set, automatic checks and a named owner
Use case 02
Measured byGrievances resolved within the seven-day clock
Tested forOWASP LLM02 · Sensitive information disclosure
Goes live only with its evaluation set, automatic checks and a named owner
Use case 03
Measured byFindings caught before release
Tested forOWASP LLM09 · Misinformation
Goes live only with its evaluation set, automatic checks and a named owner
Work and insights
No consumer internet & apps client is named or described without written approval. Here is what we have written that bears on the industry.
A typical programme · composite
A subscription app rebuilt its sign-up, renewal and cancellation flows around a dark-pattern checklist and the bank’s pre-debit notice. It ran the new flows against the old ones, measuring retention, refunds and complaints side by side.
Anonymised and illustrative: the shape a programme takes, never a named client.
Nothing published on consumer internet & apps yet. Ask us what we are seeing in the industry.
Ask usQuestions
Something else on your mind? Ask us directly
Yes, whatever the interface. They apply to platforms, advertisers and sellers offering goods or services in India, and the CCPA has penalised digital platforms under them. We audit app and web journeys together; your counsel confirms how they apply to you.
AI-made media in your product must be labelled. Images, audio or video created or altered with AI need a prominent label and, where technically feasible, embedded metadata that cannot be stripped. Large social platforms must also ask users to declare synthetic content before publishing. We design both in; your counsel confirms the position.
We test it rather than assume it. The new flow runs against the old one, with retention, refunds and complaints tracked side by side. The results decide which flow goes live.
Yes. We build reporting, appeals, moderation queues and grievance tracking, with each legal deadline on screen and an audit trail for every decision. We also connect them to the systems you already run.
Keep exploring
You will speak to a lead who would run the work, and get a straight answer on fit.
01About 2 minutes
You get A reply from a named lead
02About 8 minutesRecommended
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
