Technology

Consumer internet & apps. Every tap is a design decision.

Regulators now read the interface as closely as users do.

Social and creator platforms, subscription and dating apps, marketplaces and super-apps, where growth is won in the interface and regulators now judge the interface itself. We design sign-up, consent, subscription and reporting flows that convert without dark patterns, the trust and safety tools behind them, and AI that labels what it makes.

Talk about consumer internet & apps Read the rulebook
The number we move
Day-30 retention
Where we work in consumer internet & apps
  • Social & creator platforms
  • Subscription apps
  • Marketplaces & classifieds
  • Dating & community apps
  • Super-apps
Rules mapped
7 rules · 5 areas
Disciplines that lead
TechnologyProduct
Frameworks we build to
DPDP Act 2023 — Digital Personal Data Protection Act, 2023GDPR — General Data Protection Regulation (EU) 2016/679WCAG 2.2 AA — Web Content Accessibility GuidelinesOWASP Top 10 for LLM Applications — LLM and generative AI security risksEU AI Act — Artificial Intelligence Act (EU) 2024/1689CERT-In Directions 2022 — Cyber incident reporting directions
A hand holds a phone whose screen lights up the dark around it
Consumer internet & appsThe interface is where the rules are read now.

Where the rules biteMap of all forty-one industries

  • Claims Advertising & claims: Shapes most of the work
  • Regulator Sector regulator: Shapes most of the work
  • Payments Payments: Often shapes the work
  • Data Personal data: Shapes most of the work
  • Security Security & incidents: Often shapes the work
  • Access Accessibility: Often shapes the work
  • AI AI governance: Often shapes the work

What is shifting

The regulator reads the interface, not just the terms of service.

Dark patterns, synthetic media, grievance clocks and children’s data moved from policy pages into the product. Each shift names what it demands, with a fact you can check.

Two people sit side by side on outdoor wooden steps, each looking at a phone
Hundreds of small decisions a day, all made on a screen.

  1. Regulators now read the interface, not only the terms.

    It demandsSign-up, checkout and renewal screens that pass a dark-pattern audit before they ship.

    SignalThe CCPA named 13 dark patterns in 2023; in June 2026 it fined an edtech platform for a pre-ticked donation and a security-software maker for a renewal screen offering ‘Accept risk’.

  2. Synthetic media must be labelled at the source.

    It demandsCreation tools that label AI output by default, and upload flows that ask before anything is published.

    SignalIndia’s IT Rules amendment of 10 February 2026 requires prominent labels and embedded metadata on AI-generated media, in force from 20 February 2026.

  3. Platform response clocks are now measured in hours.

    It demandsReporting, grievance and takedown tooling with every clock visible to the trust and safety team.

    SignalUnder the IT Rules as amended with effect from 20 February 2026, intermediaries must act on government or court orders within three hours and resolve grievances within seven days.

  4. Children’s data is regulated by default, not by an age gate.

    It demandsAge-aware journeys with verifiable parental consent and no behavioural advertising to minors.

    SignalThe DPDP Act bars tracking, behavioural monitoring and targeted advertising directed at children; its parental-consent rules apply from 13 May 2027.

The rulebook

Every screen is evidence, every complaint has a clock.

The intermediary rules, the dark-pattern guidelines, the e-mandate framework and the data law, read for a typical consumer app. Your counsel keeps sign-off.

Frameworks we build to

  • DPDP Act 2023 — Digital Personal Data Protection Act, 2023
  • GDPR — General Data Protection Regulation (EU) 2016/679
  • WCAG 2.2 AA — Web Content Accessibility Guidelines
  • OWASP Top 10 for LLM Applications — LLM and generative AI security risks
  • EU AI Act — Artificial Intelligence Act (EU) 2024/1689
  • CERT-In Directions 2022 — Cyber incident reporting directions

Frameworks we design and build to — not a claim of certification.

Advertising & claims

Shapes most of the work

  1. Central Consumer Protection Authority

    CCPA dark-patterns guidelines, 2023

    Thirteen specified dark patterns, among them false urgency, basket sneaking, confirm shaming, forced action, subscription traps, drip pricing and nagging, are unfair trade practices for platforms offering goods or services in India.

    We designEvery journey is checked against the thirteen patterns before release, and the check is kept as evidence.

    CCPA · Guidelines for Prevention and Regulation of Dark Patterns, 30 November 2023 Official text: CCPA dark-patterns guidelines, 2023

Sector regulator

Shapes most of the work

  1. Ministry of Electronics and IT

    IT Rules, 2021 — due diligence and grievances

    Intermediaries publish their rules and a grievance officer, acknowledge complaints within 24 hours and resolve them within seven days, and act on government or court orders within three hours; large social platforms carry extra duties.

    We designReporting, appeal and takedown flows are designed as product features, with each clock on screen for the team.

    IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 · as amended by G.S.R. 120(E), 10 February 2026 Official text: IT Rules, 2021 — due diligence and grievances

  2. European Union

    EU Digital Services Act

    Online platforms may not design interfaces that deceive or manipulate users, must explain how their recommender systems rank content, and may not show profiling-based ads to users they know are minors.

    We designFor EU users, recommendation settings and ad explanations are built into the product, not a separate help page.

    Regulation (EU) 2022/2065 · Articles 25, 27 and 28 · applicable from 17 February 2024 Official text: EU Digital Services Act

Payments

Often shapes the work

  1. Reserve Bank of India

    RBI e-mandate framework, 2026

    Recurring charges carry a notice at least 24 hours before each debit, with a way to opt out of that debit or the whole mandate; charges of up to ₹15,000 may run without an extra authentication step.

    We designRenewal screens show the next charge, its date and the way out, in words that match the bank’s notice.

    RBI · Digital Payments – E-mandate Framework, 2026 (Master Direction of 21 April 2026) Official text: RBI e-mandate framework, 2026

Personal data

Shapes most of the work

  1. Ministry of Electronics and IT

    DPDP Act, 2023 — children and consent

    Verifiable consent of a parent before processing a child’s data, no tracking, behavioural monitoring or targeted advertising directed at children, and consent per purpose with withdrawal as easy as giving it.

    We designAge-aware journeys, parental-consent flows and ad systems that switch profiling off for minors.

    DPDP Act, 2023 · section 9 · DPDP Rules, 2025, rule 10 (from 13 May 2027) Official text: DPDP Act, 2023 — children and consent

  2. Ministry of Electronics and IT

    DPDP Rules, 2025 — erasure after inactivity

    Social media platforms and e-commerce entities with two crore or more registered users in India erase personal data three years after a user’s last contact, warning the user at least 48 hours before.

    We designDormancy notices and deletion jobs are designed and tested, with one easy way to keep the account.

    DPDP Rules, 2025 · rule 8 and Third Schedule (from 13 May 2027) Official text: DPDP Rules, 2025 — erasure after inactivity

AI governance

Often shapes the work

  1. Ministry of Electronics and IT

    IT Rules amendment, 2026 — synthetically generated information

    Tools that create or alter media with AI must label the output prominently and embed permanent metadata where technically feasible; large social platforms must ask users to declare synthetic content and verify the declaration before publishing.

    We designCreation and upload flows label AI output by default and keep the user’s declaration with the post.

    G.S.R. 120(E), 10 February 2026 · in force 20 February 2026 Official text: IT Rules amendment, 2026 — synthetically generated information

Compiled 3 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.

Challenges

Where consumer internet & apps loses customers and time.

What comes up first in most consumer internet & apps conversations — outside, at the screen, and inside, in the operation.

Your customers

  1. Cancelling as easily as subscribing

    Renewal reminders that arrive in time, a visible way out and no shaming copy on the way.

  2. Knowing what is real

    Labels on AI-generated images, voices and posts, and on paid creator content.

  3. A report that gets a reply

    Complaints acknowledged, tracked and resolved within the stated time, with a route to appeal.

Two hands hold and tap a phone against a dark background
Every tap is a consent, a purchase or a report.

Your operation

  1. Growth against friction

    Every consent step and disclosure tested against conversion, not argued about.

  2. Trust and safety at scale

    Moderation queues, appeals and government orders running against clocks of hours, not days.

  3. One product, many rulebooks

    Indian, EU and app-store rules applied to the same screens without forking the product.

What we build

The disciplines behind a typical consumer internet & apps programme.

A typical programme here draws on each discipline in this mix. Every line names what it builds for the industry and links to the capability that does the work.

Leads Core Supports Share of a typical programme, by role · illustrative
  1. 01

    Technology & Intelligence

    Leads

    Grievance, reporting and takedown tooling with clocks and audit logs, and the integrations behind them.

  2. 02

    Product & Experience Design

    Leads

    Sign-up, subscription and cancellation journeys checked against the thirteen dark patterns and tested for conversion.

  3. 03

    AI Design

    Core

    Creation tools that label what they make, and moderation assistants with a person deciding.

  4. 04

    Marketing Technology

    Core

    Consent-led lifecycle messaging, with preferences and quiet hours the user controls.

  5. 05

    Brand Design

    Supports

    A product voice that is plain about prices, renewals and what is an advertisement.

  6. 06

    Campaign & Content Design

    Supports

    Creator programmes with the disclosure built into every brief and post.

Programmes

Audit the flows first, then rebuild what users feel.

The way in walks every journey from sign-up to cancellation against the rules and ranks the fixes by risk and by revenue. Lengths are typical, never promised.

The way in

Dark-pattern and consent audit

We walk every sign-up, checkout, renewal and cancellation flow against the thirteen patterns, the e-mandate rules and DPDP consent, and rank the fixes by risk and by revenue.

Package
Sprint · Fixed fee
Typical length
2–3 weeks
It sets
Trial-to-paid conversion, as a baseline
  • Product experience audit
  • Martech stack audit & roadmap

What it hands over

  • A dark-pattern register with a fix for each finding
  • A cancellation journey as short as the sign-up
  • A consent map, purpose by purpose, for DPDP
Start here

  1. 02Milestone · 3–6 months

    Trust and safety console

    Reports, appeals, government orders and grievances in one queue, each with its clock and its audit trail.

    MovesGrievances resolved within the seven-day clock

    Services: Custom CRM or operations platform · End-to-end UX & UI design · System integration

    Enquire about Trust and safety console

  2. 03Project · 6–10 weeks

    Synthetic-media labelling

    Labels, provenance metadata and upload declarations for AI-generated content, tested against the 2026 amendment.

    MovesShare of AI-generated uploads labelled at the source

    Services: AI interaction pattern set · AI use policy, rights & disclosure · Front-end build

    Enquire about Synthetic-media labelling

  3. 04Retainer · Ongoing, 6-month minimum

    Lifecycle messaging on consent

    Onboarding, renewal and win-back journeys that respect preferences, quiet hours and the pre-debit notice.

    MovesDay-30 retention

    Services: Lifecycle journey build · Email, SMS & WhatsApp set-up · Customer data & identity foundation

    Enquire about Lifecycle messaging on consent

How success is measured

The number we moveDay-30 retention

  • Day-30 retention
  • Trial-to-paid conversion
  • Cancellations completed without contacting support
  • Grievances resolved within the seven-day clock

AI, under the rules

AI labels what it makes, people decide what stays up.

Each use case has an owner, an evaluation set and a log; no model removes content or closes a complaint on its own.

Use case 01

Content-label checker

Measured byShare of AI-generated uploads labelled at the source

Tested forOWASP LLM01 · Prompt injection

agent / content-label-checker Guarded
  1. TaskChecks uploads for signs of AI generation and prompts the creator to declare and label them before they are published.
  2. GuardrailTreats uploaded files and captions as untrusted input; never deletes or publishes on its own, and sends unclear cases to a reviewer.
  3. HumanTrust and safety reviewers decide every disputed label.
  4. LogDeclarations, checks run and reviewer decisions, per post.

Ships only with its evaluation set, its guardrail and an owner

Use case 02

Grievance triage assistant

Measured byGrievances resolved within the seven-day clock

Tested forOWASP LLM02 · Sensitive information disclosure

agent / grievance-triage-assistant Guarded
  1. TaskSorts incoming complaints by type and by clock, and drafts the acknowledgement.
  2. GuardrailDrafts only; no complaint is closed, rejected or answered by the model alone, and personal details are masked in its prompts.
  3. HumanA grievance officer approves every resolution.
  4. LogCategory, clock, draft and final reply.

Ships only with its evaluation set, its guardrail and an owner

Use case 03

Dark-pattern linter

Measured byFindings caught before release

Tested forOWASP LLM09 · Misinformation

agent / dark-pattern-linter Guarded
  1. TaskReviews new screens and copy against the thirteen patterns before release and flags likely matches.
  2. GuardrailAdvisory only: it cannot block or ship a release, and a clean result is never treated as approval.
  3. HumanThe product owner signs off each flagged screen.
  4. LogScreens checked, flags raised and the decision taken.

Ships only with its evaluation set, its guardrail and an owner

Work and insights

Case studies stay private until a client approves them.

No consumer internet & apps client is named or described without written approval. Here is what we have written that bears on the industry.

A typical programme · composite

A subscription app rebuilt its sign-up, renewal and cancellation flows around a dark-pattern checklist and the bank’s pre-debit notice, and ran the new flows against the old ones so retention, refunds and complaints were measured side by side.

Anonymised and illustrative: the shape a programme takes, never a named client.

Related reading

Nothing published on consumer internet & apps yet. Ask us what we are seeing in the industry.

Ask us

Questions

What product, trust and safety and legal leads ask us first.

Something else on your mind? Ask us directly

Q.01Do the dark-pattern guidelines apply to apps as well as websites?

They apply to platforms offering goods or services in India, to advertisers and to sellers, whatever the interface, and the CCPA has penalised digital platforms under them. We audit the app and web journeys together; your counsel confirms how they apply to you.

Q.02What does the 2026 IT Rules amendment mean for our AI features?

If your product lets people create or alter images, audio or video with AI, the output must carry a prominent label and, where technically feasible, embedded metadata that cannot be stripped. Large social platforms must also ask users to declare synthetic content before it is published. We design both into the product; your counsel confirms the position.

Q.03Can cancellation be easy without hurting revenue?

We measure it rather than assume it: the new flow runs against the old one, with retention, refunds and complaints tracked side by side, and the numbers decide what ships.

Q.04Do you build trust and safety tooling?

Yes: reporting, appeals, moderation queues and grievance tracking, with each regulatory clock visible and an audit trail for every decision. AI can sort and draft; people decide.

Keep exploring

Next in technology, then every sector we cover.

All forty-one industries

Let’s build what happens next.

Tell us what you’re building. We’ll answer straight.

Book a discovery call

Three ways to start

  1. 01About 2 minutes

    A quick question

    You get A reply from a lead, not a sales queue

  2. 02About 8 minutesMost useful

    A project brief

    You get Options and a first scope after one call

  3. 03About 15 minutes

    A formal RFQ or RFP

    You get Receipt confirmed and a named bid lead

Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced

See the work Explore our services Industries we serve Meet the team Email us Read our approach