E-Commerce Consent Requirements India | DPDP Act 2026

E-Commerce Consent Requirements in India: DPDP Act and Consumer Protection Rules 2026

India's e-commerce industry is entering a new phase of digital privacy and consumer protection. As online businesses collect increasing amounts of customer information, the responsibility to manage personal data transparently and protect consumer interests is becoming more important.

Two regulatory frameworks deserve particular attention: the Digital Personal Data Protection (DPDP) Act, 2023 and the Consumer Protection (E-Commerce) (Amendment) Rules, 2026.

While the DPDP Act focuses on the lawful processing of digital personal data, the amended E-Commerce Rules strengthen requirements relating to consumer transparency, fair business practices, and certain uses of consumer information.

For e-commerce businesses, these developments raise an important question:

Is collecting customer consent through a website checkbox enough to meet India's evolving digital compliance requirements?

The answer is no.

Businesses need appropriate consent-management processes, transparent customer communications, reliable records, and coordinated workflows across their websites, applications, and marketing systems.

This is where DPDP Compliance Software and a centralized Consent Management Platform (CMP) can help organizations manage consent-related responsibilities more effectively.

1. Understanding the DPDP Act and E-Commerce Rules 2026

The two frameworks address different but sometimes overlapping aspects of online business operations.

Digital Personal Data Protection Act, 2023

The DPDP Act regulates the processing of digital personal data within its scope.

It establishes requirements relating to lawful processing, consent, notices, security safeguards, Data Principal rights, and other obligations.

For an e-commerce business, personal data may include customer names, mobile numbers, email addresses, delivery addresses, account information, and other information relating to identifiable individuals.

The DPDP framework follows a phased implementation schedule, with several major operational obligations scheduled to commence on 13 May 2027.

Consumer Protection (E-Commerce) Rules, 2020 and 2026 Amendments

The Consumer Protection (E-Commerce) Rules, 2020 establish consumer-protection obligations for e-commerce entities.

In September 2026, the government notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, which are scheduled to come into force on 1 January 2027.

These amendments strengthen requirements relating to business disclosures, grievance redressal, sponsored listings, pricing transparency, dark patterns, marketplace practices, and certain uses of consumer information.

The key distinction is that DPDP compliance concerns personal data processing, while e-commerce consumer-protection compliance also addresses how businesses present products, prices, choices, and services to consumers.

An online business may need to comply with both frameworks.

2. What Are the Consent Requirements for E-Commerce Businesses Under the DPDP Act?

E-commerce platforms process customer information at multiple stages, including account registration, product browsing, checkout, delivery, customer support, and marketing.

Where consent is the applicable legal basis for processing, the DPDP Act requires consent to satisfy statutory conditions.

Clear and Informed Consent

Consent must be free, specific, informed, unconditional, unambiguous, and expressed through clear affirmative action for the specified purpose.

For example, an online retailer seeking consent to send promotional communications should explain the relevant processing purpose.

A vague statement authorizing unrestricted future use of customer information may not meet the applicable requirements.

Purpose-Based Consent Management

Different processing activities may involve different purposes and legal grounds.

An e-commerce business might process information for order fulfilment, customer support, account management, or promotional marketing.

Businesses should assess each processing activity rather than assuming that every use requires consent or that a single checkbox authorizes every purpose.

A DPDP Consent Management Platform can help organize purpose-based consent preferences where consent is required.

Consent Withdrawal

Section 6 of the DPDP Act provides for withdrawal of consent, with withdrawal required to be as easy as giving consent.

Following withdrawal, processing based on the withdrawn consent must cease within a reasonable time, subject to applicable legal exceptions.

For example, withdrawing promotional consent should lead to the appropriate suppression of affected marketing communications.

However, withdrawal does not automatically prohibit processing needed for other legally permitted purposes.

Consent Records

Businesses should maintain suitable records to support accountability and demonstrate how consent-related activities were handled.

Relevant information may include consent timestamps, purpose selections, notice versions, and withdrawal histories.

A reliable DPDP CMP can help businesses manage these records centrally rather than relying on disconnected forms and spreadsheets.

3. What's New in the Consumer Protection E-Commerce Amendment Rules 2026?

The 2026 amendments introduce several important changes that online businesses should prepare for.

Greater Transparency in Sponsored Listings

E-commerce entities will need to ensure that sponsored product and service listings are distinctly identified through clear and prominent disclosures.

This helps consumers distinguish paid promotions from other search results.

Transparent Discount Pricing

When an e-commerce entity or seller announces a price reduction, the amended rules require disclosure of the reduced price alongside the relevant prior price.

The amendments define the prior price by reference to the lowest price during the preceding 30 days.

This is intended to address misleading discount practices.

Stronger Restrictions on Dark Patterns

The amendments expressly require e-commerce entities to comply with the Guidelines for Prevention and Regulation of Dark Patterns, 2023.

They also introduce annual self-audit requirements and prominent display of the relevant compliance certificate.

Dark patterns can include deceptive interface practices that manipulate consumer decisions.

For consent-related interfaces, businesses should avoid confusing choices, misleading buttons, or designs that undermine informed decision-making.

Consumer Grievance Redressal

The amended provisions require acknowledgement of consumer complaints within 48 hours and redressal within one month, along with providing consumers a copy of the complaint as recorded.

These are consumer-protection grievance requirements and should not be confused with every response timeline applicable to Data Principal requests under the DPDP framework.

Express Consent for Certain Marketplace Uses

An important consent-related provision addresses marketplace e-commerce entities using collected consumer information for specified activities involving sellers or brands associated with the marketplace.

The amended rules restrict such uses unless the marketplace obtains the consumer's express and affirmative consent.

This requirement is particularly relevant for marketplaces operating related brands or promoting associated sellers.

It should not be interpreted as a universal requirement for separate consent for every marketplace transaction.

4. DPDP Act vs Consumer Protection E-Commerce Rules 2026

Although the two frameworks have different objectives, both can influence how online businesses design customer experiences.

For businesses, the practical challenge is ensuring that privacy choices, customer communications, and e-commerce operations work consistently across different systems.

5. Why Basic Consent Checkboxes Are Not Enough

Many e-commerce websites collect customer consent through a checkbox during registration or checkout.

However, a checkbox only captures an initial response.

It does not necessarily provide a complete system for managing consent across multiple applications.

Consider an online retailer using:

• A website for customer registration and checkout.
• A CRM for customer information.
• An SMS gateway for promotional campaigns.
• WhatsApp for marketing communications.
• An email marketing platform for offers and newsletters.

A customer initially agrees to receive promotional messages.

Later, the customer withdraws that consent.

The website may record the withdrawal, but the CRM or marketing platforms may continue using the previous preference.

This creates a consent-management problem.

Businesses need processes that communicate relevant consent changes across connected systems and verify whether required actions have been completed.

A centralized DPDP Compliance Software solution can help coordinate these activities.

6. How Consent Server Helps E-Commerce Businesses Manage Consent

Consent Server is a DPDP Compliance Software and Consent Management Platform developed by Iconic Infotech Pvt. Ltd. for Indian businesses.

It is designed to help organizations manage consent-related operations through centralized records, configurable workflows, APIs, webhooks, and Data Principal rights management.

For e-commerce businesses, these capabilities can support more consistent consent management across websites, applications, and connected marketing systems.

Centralized Customer Consent Management

Consent Server helps businesses collect and manage purpose-based customer consent through configurable forms and centralized records.

Organizations can manage relevant consent preferences across multiple websites and applications.

Consent Lifecycle Management

Consent Server supports consent collection, updates, withdrawal, renewal, and expiry.

This helps businesses maintain a structured history of customer consent-related activities.

API and Webhook Integration

E-commerce businesses frequently use CRM, SMS, WhatsApp, ERP, and marketing automation platforms.

Consent Server supports APIs and webhooks to communicate consent-related events to connected systems.

For example, a promotional consent withdrawal can trigger an instruction to update the customer's marketing eligibility in relevant applications.

Acknowledgement and Action Tracking

Sending a webhook does not automatically prove that a connected application has implemented the requested change.

Consent Server supports a more comprehensive workflow:

Consent Event --> Webhook/API Notification --> Delivered --> Acknowledged --> Action Completed --> Completion Evidence

The platform also supports retries, failure monitoring, and escalation mechanisms.

This helps organizations identify unresolved consent-related actions.

The actual changes must still be performed by the connected applications or responsible teams.

Audit-Ready Consent Records

Consent Server maintains consent timestamps, purpose selections, notice versions, and activity histories.

These records can help businesses demonstrate how consent was collected, updated, or withdrawn.

Data Principal Rights Management

The platform provides workflows for access, correction, erasure, withdrawal, and grievance-related requests.

This helps organizations organize their responses to applicable personal data requests.

On-Premise and Hosted Deployment

Consent Server offers both On-Premise and Hosted Deployment options.

Businesses can select a deployment model that matches their infrastructure, integration, and operational requirements.

By combining centralized consent management, lifecycle automation, application integration, and supporting evidence, Consent Server helps e-commerce businesses strengthen their DPDP compliance readiness.

However, Consent Server does not replace the separate product-disclosure, pricing, consumer-grievance, or dark-pattern audit obligations under consumer-protection law.

7. Practical Example: Consent Management for an Online Shopping Platform

Consider an e-commerce company that sells clothing, electronics, and household products.

The business collects customer information through its website and uses connected systems for order processing, customer support, and marketing.

A customer registers, purchases a product, and separately agrees to receive promotional communications.

Later, the customer withdraws promotional consent.

With an appropriately configured DPDP Consent Management Platform, the following process can occur:

Step 1: The customer submits a withdrawal request through the website or consent-management interface.

Step 2: Consent Server records the withdrawal and updates the relevant consent status.

Step 3: Connected CRM and marketing applications receive withdrawal notifications through configured APIs or webhooks.

Step 4: The receiving systems suppress the customer from affected promotional campaigns.

Step 5: The systems acknowledge the instructions and report completion where supported.

Step 6: Consent Server maintains relevant event histories and completion information.

If an application fails to respond, retry and escalation mechanisms can help identify the unresolved action.

Meanwhile, the retailer must separately ensure that its website provides accurate product information, transparent pricing, appropriate seller disclosures, and compliant consumer-grievance processes.

This example demonstrates why e-commerce businesses need both sound privacy-management practices and broader consumer-protection controls.

8. E-Commerce DPDP Compliance Checklist for 2026–2027

Businesses preparing for the upcoming regulatory milestones should review the following areas:

1. Personal Data Mapping: Identify the personal data collected through websites, applications, payment systems, and marketing platforms.
2. Processing Purpose Review: Determine which activities rely on consent and which may be permitted under other applicable legal provisions.
3. Privacy Notices: Review notices for clarity, accessibility, and relevant processing purposes.
4. Consent Management: Establish suitable consent collection, withdrawal, and recordkeeping processes.
5. Marketing Integration: Ensure relevant consent changes can be communicated to CRM, SMS, WhatsApp, and email marketing systems.
6. Data Principal Rights: Establish appropriate procedures for handling applicable personal data requests.
7. Consumer Disclosures: Review seller details, product descriptions, pricing, refund policies, and grievance information.
8. Dark-Pattern Assessment: Evaluate website interfaces, checkout flows, and promotional practices against applicable requirements.
9. Security Safeguards: Review technical and organizational measures for protecting personal data.
10. Compliance Evidence: Maintain appropriate documentation, activity histories, and supporting records.

A DPDP CMP such as Consent Server can support several consent-related elements of this checklist, while other requirements may need separate legal, technical, and operational measures.

9. Why E-Commerce Businesses Should Start Preparing Now

The 2026 E-Commerce Amendment Rules are scheduled to take effect on 1 January 2027, while several major DPDP obligations are scheduled to commence on 13 May 2027.

These dates create an important preparation period for Indian online businesses.

Organizations should review their current systems, identify operational gaps, and establish suitable processes before the relevant obligations become enforceable.

Businesses relying on multiple marketing and customer-management applications may require additional time to implement consent synchronization and withdrawal workflows.

Adopting appropriate DPDP Compliance Software early can help organizations prepare their consent-management infrastructure and reduce dependence on manual processes.

The goal should be to build sustainable compliance processes rather than treating regulatory preparation as a one-time exercise.

Conclusion: E-Commerce Compliance Requires More Than a Consent Checkbox

India's evolving regulatory framework is placing greater emphasis on customer privacy, transparency, and responsible digital business practices.

The DPDP Act, 2023 establishes requirements for personal data processing, while the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 strengthen important consumer-protection obligations.

For e-commerce businesses, compliance preparation requires attention to both frameworks.

Organizations must understand their applicable consent requirements, maintain suitable records, handle relevant withdrawal requests, and ensure that connected applications implement required consent-related changes.

Consent Server helps Indian e-commerce businesses manage these operational challenges through centralized consent management, consent lifecycle automation, Data Principal rights workflows, audit-ready records, APIs, webhooks, and flexible deployment options.

By establishing reliable consent-management processes, businesses can strengthen their DPDP compliance readiness while building greater customer trust.