CCPA Fines PharmEasy for Auto-Enrolling Users Into Paid Service Without Consent

The Central Consumer Protection Authority (CCPA) has fined online pharmacy PharmEasy ₹2 lakh for automatically enrolling users into a paid subscription service without their explicit consent. The regulator held that this design was a “basket sneaking” dark pattern—where paid services are pre-selected or added to a customer’s cart during checkout without clear approval.

A bench consisting of Chief Commissioner Nidhi Khare and Commissioner Anupam Mishra said that PharmEasy’s auto-subscription feature was misleading and amounted to an unfair trade practice. According to the order, this practice violated Sections 2(28) and 2(47) of the Consumer Protection Act as it reduced consumer choice and led people to pay for a service they never knowingly opted for.

How the issue came to light

The CCPA began proceedings on its own after noticing that a paid service was being added to users’ carts automatically. This behaviour is listed as a potential dark pattern under the 2023 Guidelines for Prevention and Regulation of Dark Patterns. On June 14, 2024, the authority issued a show-cause notice to Axelia Solutions, the operator of PharmEasy.

In its reply dated June 2, 2024, PharmEasy admitted that an “auto-addition” feature had been enabled for some users. The company claimed the feature was only meant for existing subscribers and would be withdrawn. It also stated that backend changes would require three to four weeks. A second response on June 28, 2024, informed the regulator that the feature had been removed.

Regulator finds prolonged use of auto-subscription

However, after analysing the company’s data, the CCPA found that the auto-subscription mechanism had been active for much longer than PharmEasy had suggested. It functioned in two phases—first from November to December 2023, and again from March to June 2024.

During these months, thousands of users were subscribed without clear consent. The order notes that 7,230 users were enrolled in April 2024 and 9,730 in May 2024. The feature remained active until June 27, 2024. The CCPA said the high numbers clearly showed that the issue was neither brief nor limited in scope.

Violation of E-Commerce Rules

The authority also held that PharmEasy violated Rule 4(9) of the Consumer Protection (E-Commerce) Rules, which require platforms to obtain explicit and affirmative consent before charging for any service. Instead of seeking such consent, PharmEasy added the paid feature by default, leaving users to manually remove it during checkout.

According to the CCPA, this approach failed to protect consumers’ autonomy and directly went against rules that prohibit default opt-ins.

Unfair clauses in Terms & Conditions

PharmEasy’s terms and conditions also faced criticism. The CCPA observed that the platform’s T&C allowed the company to modify or introduce new features—such as auto-renewal—based solely on the consumer’s original agreement. The authority said that this created a recurring financial obligation without fresh consent and constituted an “unfair contract term” under Section 2(46) of the Consumer Protection Act.

The order notes that such clauses effectively force consumers into repeated payments they did not knowingly accept.

PharmEasy’s defence rejected

PharmEasy argued that most consumers benefitted from the paid service and that the auto-subscription happened due to a technical glitch. The CCPA rejected this explanation, noting that no evidence supported the glitch claim and that the large number of enrolments made the explanation hard to believe. The regulator held that the “technical error” justification appeared to be an afterthought made after the inquiry began.

Final directions

After categorising the practice as “basket sneaking” under the Dark Patterns Guidelines, the CCPA ordered PharmEasy to:

• Completely discontinue the auto-addition feature
• Issue refunds to all users charged without explicit consent
• Update its terms and conditions to comply with consumer protection laws
• Pay the ₹2 lakh penalty

Advocates Ankur Khandelwal and Kajal appeared for PharmEasy before the authority.