What happened
In November 2025 the Central Consumer Protection Authority fined Axelia Solutions — the parent of online pharmacy PharmEasy — ₹2 lakh for 'basket sneaking': a three-month, ₹99 membership that pre-selected and auto-renewed at checkout without explicit consent. The regulator held the design misled users about the total payable amount, an unfair trade practice under Sections 2(28) and 2(47) of the Consumer Protection Act, and a breach of Rule 4(9) of the E-Commerce Rules, which demands affirmative consent before charging.
PharmEasy's defence was that the auto-addition was a limited issue affecting some existing subscribers — a technical glitch. The regulator's numbers said otherwise: the feature ran across two windows, November–December 2023 and March–June 2024, with 7,230 auto-subscriptions in April 2024 and 9,730 in May, live until it was switched off on June 27, 2024. Nearly 24,000 subscriptions went through the mechanism in total. The CCPA rejected the malfunction claim, noting the company produced no evidence of one and raised the explanation only after proceedings began.
The order, which began as a suo motu case when the authority noticed paid services adding themselves to carts, directed PharmEasy to remove the pattern, refund everyone charged without express approval, and rewrite terms that allowed unilateral auto-renewals off old consent — a clause it called an unfair contract term. 'The corrective steps were reactive and undertaken only after regulatory intervention, which reinforces the seriousness of the initial breach,' the CCPA wrote.
The deeper cost is standing precedent. India's 2023 dark-pattern guidelines had already named basket sneaking a banned tactic, and a June 2025 advisory had asked platforms to self-audit. PharmEasy self-audited, told the regulator it was compliant — and was fined again in the August 2026 nine-platform sweep. Checkout defaults are now enforcement surfaces, not growth levers.
What it cost
₹2 lakh penalty, refunds across roughly 24,000 auto-charged memberships, a forced UI and T&C redesign — then a fresh fine in the 2026 dark-pattern sweep
Why it happened
The renewal was tuned for revenue: a default that keeps billing is invisible until someone reads the invoice — and the CCPA reads the whole flow as one price claim.
The glitch story collapsed against the company's own disclosures: a malfunction does not process 9,730 subscriptions in a month and stay live for two separate windows.
The T&Cs let the platform auto-renew off consent given once, years earlier — 'they agreed before' is not affirmative consent under the E-Commerce Rules.
Compliance arrived on the regulator's clock, not the company's. Reacting only after a show-cause notice turned a fixable design flaw into a documented finding of bad faith.
The lesson
A checkout default is a price claim. If money moves without a conscious tap, the 'glitch' defence won't hold — your own logs exist, and the regulator reads them.
Aftermath
The auto-addition feature was disabled on June 27, 2024, while proceedings were underway. The November 21, 2025 order left PharmEasy owing refunds to every user charged without explicit consent, a redesigned interface, rewritten terms — and the ₹2 lakh penalty on Axelia Solutions. In August 2026 the CCPA's nine-platform dark-pattern sweep fined PharmEasy again, about ₹1 lakh. The fines remain small; the directive is not. For an e-pharmacy still shaving losses toward a listing, subscription growth engineered through defaults is now a liability regulators itemise.
FOLLOW THE EVIDENCE