Consumer Data Use In E-Commerce : Compliance under the 2026 Rules

Introduction : Nowadays, if we notice, we get everything personalised; like, with one search we get advertisements or suggestions of goods and services we have searched for, and this is all because of e-commerce. These practices depend on collecting and analysing consumer information, including browsing history, purchase records, search queries, and individual preferences. Such practices improve convenience and commercial efficiency. E-commerce heavily relies on consumer personal data to determine the customer's choice and what products they are seeing and what is their need. However, while these practices improve convenience and commercial efficiency, they also raise concerns regarding transparency, consumer autonomy, and the responsible use of personal information.

On 9 September 2026, India's Ministry of Consumer Affairs notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, which introduce important changes to India's e-commerce regulatory framework, and they will come into force on 1 January 2027. The amendments raise an important compliance question: how can e-commerce marketplaces use consumer information to support their commercial operations without undermining consumer choice, transparency, or fair competition? Implementing them requires e-commerce entities to establish clear procedures for collecting, using, and managing consumer information. Compliance also requires other statutory frameworks, such as the Consumer Protection Act and the data-protection framework, particularly the Digital Personal Data Protection Act, 2023 (DPDP Act).

Legal Provisions

Consumer Protection (E-commerce) Amendment Rules, 2026

The inserted Rule 4(11) expressly bars e-commerce entities from misleading users by manipulating search results or search indexes in response to a user’s search query.  The central data provision is the newly inserted Rule 5(6), which provides that a marketplace e-commerce entity shall not use consumer information collected by it to promote or advertise goods bearing its own brand or name, nor represent sellers on its platform as being associated with the platform, unless it has obtained the explicit and affirmative consent of the relevant consumer for such use.

The amendment also brings in the Guidelines for Prevention and Regulation of Dark Patterns, 2023, under which e-commerce entities must conduct annual self-audits and prominently display a certificate confirming compliance.

Consumer Protection Act, 2019

Section 2(47) defines an unfair trade practice, while Section 18 empowers the Central Consumer Protection Authority (CCPA) to issue guidelines to prevent unfair trade practices, which is the enforcement hook for dark patterns compliance, which is now made binding under the 2026 Rules. Section 94 empowers the Central Government to take measures to prevent unfair trade practices in e-commerce and protect the rights of consumers, forming the rule-making basis for the 2026 Amendment Rules.

These provisions are relevant where a platform's use of information, presentation of products, or design of its purchasing interface misleads consumers or interferes with informed decision-making. 

The DPDP Act, 2023

Most e-commerce operators are 'data fiduciaries' because they determine the purpose and means of processing. Section 4 permits processing only for a lawful purpose, with the data principal's consent or for a specified 'legitimate use'. Section 5 requires a notice stating the data collected, the purpose, and how to exercise rights or complain to the Data Protection Board.

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and 'limited to such personal data as is necessary' for the specified purpose. Section 6(4) allows withdrawal at any time, with ease comparable to giving consent. Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer served, unless law requires retention. Section 9 requires verifiable parental consent for children's data and bars tracking, behavioural monitoring and targeted advertising directed at children. However, the Digital Personal Data Protection Act, 2023, is subject to phased commencement, so these provisions come into force in May 2027.

The DPDP Rules, 2025

In accordance with the DPDP Rules, 2025, which are implemented in phases and alongside the DPDP Act, they come into operation through an 18-month phased timeline. Rule 3 introduces distinct and understandable consent notices listing the data and exact purpose of data processing. The Rules bring about constraints regarding the purpose and scope of data by prohibiting the use of data beyond what has been indicated in the consent notice.

Legal Analysis

Consumer Information and Affirmative Consent

The amendment is introduced to restrict the specified uses of information collected by the entities. Rule 5(6) prohibits such information from being used for the sale of goods, directly or indirectly, through sellers offering products bearing a brand or name common with that of the marketplace, or to promote or advertise a seller as being associated with the marketplace, unless express and affirmative consent is obtained from the relevant consumer.

This limitation refers to the possibility of a clash between the function of a marketplace as an intermediary and its wish to earn profit. Data or information about consumers can provide information about preferences while purchasing and about the market, which may result in having an edge over competitors. Compliance only requires marketplaces to understand the purpose of data and whether it comes under the restriction. If affirmative consent is needed, companies must explain purposes clearly and keep records where necessary. But it is essential to understand that the amendment should not be interpreted as prohibiting every type of personalization or internal analysis. Its application depends on its usage.

Search Rankings and Sponsored Listings

The 2026 amendments address misleading manipulation of search results and require marketplace entities to provide a publicly available explanation, in plain and intelligible language, of the principal parameters determining rankings and their relative importance. If rankings are manipulated or commercial preferences are concealed, consumers may be misled about the relevance of search results. Businesses should ensure that these explanations accurately reflect their ranking practices without assuming that every technical detail or source code must be disclosed.

Another area of concern is related to sponsored listings. When paid advertisements are not clearly identified, customers may confuse them with typical organic results. The updates stipulate that sponsored listings are as visible as possible through specific disclosures. Each business should analyse its websites and apps and make sure those positions are visible enough for customers. 

Dark Patterns and Consumer Choice

Dark patterns are designs that confuse customers. Examples of such patterns include false urgency, hidden advertisements, and distorted prices. The Guidelines for Prevention and Regulation of Dark Patterns, 2023 regulate certain manipulative practices from the perspective of consumer protection law. Under the changes introduced in the 2026 amendments, an organization has to comply with the Guidelines, perform self-review each year, and provide a compliance certificate. Therefore, companies should assess their consent forms, promotional material, and checkout practices to find any misleading design. Personalization itself is not against the law. Problems occur when the design applied in practice gives misleading information and deprives consumers of making informed decisions. Therefore, compliance involves checking the way the offer is presented rather than checking the existence of the privacy policy.

Relationship between Consumer and Data Protection

Consumer protection and data protection address related but distinct issues. The e-commerce amendments regulate specified marketplace practices, while the DPDP Act governs digital personal-data processing within its scope.

In Justice K.S. Puttaswamy (Retd.) v Union of India The Supreme Court recognised privacy as a fundamental right.[5] The judgement provides constitutional context for informational privacy, although it does not establish that every form of targeted advertising or personalisation is unlawful.

Businesses should independently assess their obligations under the applicable consumer-protection rules and the provisions of the DPDP framework that have commenced. This distinction is particularly important when developing consent mechanisms, advertising practices and data-governance policies.

Relevant Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India: The Supreme Court recognised privacy as a fundamental right under the Constitution. The judgment provides an important foundation for understanding individual autonomy and informational privacy in the digital economy.

2. Amazon Seller Services Pvt Ltd v Amway India Enterprises Pvt Ltd, 2020 SCC OnLine Del 454: The Delhi High Court considered disputes involving online marketplaces and direct-selling practices. Although the case does not interpret the specific 2026 amendments, it provides context for examining the commercial role and responsibilities of marketplace platforms.

Practical Implications

E-commerce businesses should begin by mapping the consumer information they collect, the purposes for which it is used, and the parties with whom it is shared. They should identify activities that may trigger the amended Rule 5(6) consent requirement and establish appropriate procedures for obtaining and documenting affirmative consent.

Platforms should also document their principal ranking parameters, ensure sponsored listings are clearly identified, and review search results for potentially misleading manipulation. Annual dark-pattern audits should examine promotional interfaces, pricing displays, and checkout journeys.

Legal, technology, marketing, and customer-support teams should coordinate these reviews. Businesses should also monitor the commencement of the amended Rules and the DPDP framework so that policies and operational systems are updated before the applicable deadlines.

Conclusion

Consumer information supports personalisation, advertising and product discovery, but its commercial value creates risks when its use is opaque or influences consumer choices unfairly. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 strengthen the focus on affirmative consent for specified uses, ranking transparency, sponsored listings, and dark-pattern prevention.

For businesses, compliance requires more than revising privacy policies. Clear disclosures, appropriate consent mechanisms, documented audits, and responsible interface design can help reduce regulatory risk and strengthen consumer confidence. Ultimately, transparent data use should form part of responsible e-commerce governance.

Author: Janvi Gaurav in case of any queries please contact/write back to us via email to content@khuranaandkhurana.com or at  Khurana & Khurana, Advocates and IP Attorney