DPDP Act for E-commerce and D2C Brands: A Compliance Guide

ConsentifyAI Team5 October 20262 min read

TL;DR

For e-commerce and D2C brands, the DPDP Act bites hardest on marketing, cookies and retention. Order data can be processed to fulfil orders, but promotions, retargeting and ad audiences need consent. Marketplaces with two crore or more Indian users must erase inactive users' data after three years with 48 hours' notice. Sellers, logistics partners and payment gateways must be governed by contract, and consent flows must avoid the dark patterns India's consumer regulator prohibits.

Who this is for: founders, growth, product and operations leaders at online marketplaces, D2C brands and omnichannel retailers.

E-commerce runs on customer data: accounts, addresses, order histories, browsing behaviour, payment references, reviews and the marketing that turns one order into ten. Much of it is fine under the DPDP Act. Some of it, especially in marketing and tracking, is not, without changes.

The basis for e-commerce data

Activity	Likely basis
Account creation, checkout, delivery, returns, support	Section 7(a): provided to receive the order or service
Order updates, OTPs, delivery messages	Section 7(a) (keep them free of promotions)
Promotional email, SMS, WhatsApp, push	Consent
Analytics and advertising cookies and pixels	Consent
Custom audiences and retargeting	Consent
Personalised recommendations on your own site	Consent is the safest basis unless clearly part of the service requested
Sharing data with brands or sellers for their marketing	Consent

See marketing consent under DPDP and cookie consent in India.

The three-year rule for large platforms

Under Rule 8 and the Third Schedule, e-commerce entities with two crore or more registered users in India must erase a user's personal data after three years in which the user has not approached them or exercised their rights, counted from the later of the user's last activity or the commencement of the Rules. Users must be warned at least 48 hours before erasure. Data needed only to keep access to the account or virtual tokens such as wallets is excluded.

Smaller stores are not subject to the fixed three-year rule, but Section 8(7) still requires erasure once the purpose is served. See data retention policy.

Sellers, logistics and payments

Partner	Typical role	What to control
Marketplace sellers	Often fiduciaries for fulfilling their own orders	Share only order-necessary data; prohibit reuse for marketing; mask contact details where possible
Logistics and last-mile partners	Processors	Contracted safeguards; masked phone numbers; deletion after delivery
Payment gateways	Separate fiduciaries for payment data, subject to RBI rules	Avoid storing card data you don't need
Marketing agencies and martech	Processors	DPAs; consent-gated data flows
Review and loyalty platforms	Processors or partners	Clear purpose and contracts

Under Section 8(1), you remain responsible for your processors. See vendor risk under DPDP.

Dark patterns: two regulators

E-commerce is the main target of the Central Consumer Protection Authority's 2023 dark patterns guidelines, covering false urgency, basket sneaking, confirmshaming, forced action, subscription traps, interface interference and more. Many of these also appear in consent flows, where they can make consent invalid under the DPDP Act. See 7 consent dark patterns.

Children

If your catalogue or audience includes under-18s, Section 9(3) prohibits targeted advertising and behavioural tracking directed at them, even with parental consent. Make sure advertising tags do not fire for users who may be children.

Breaches

Customer address and order databases are frequent targets. Every personal data breach must be reported to affected customers and the Data Protection Board, with a detailed report within 72 hours. See the Rule 7 playbook.

Significant Data Fiduciary

Large marketplaces process the volumes that make SDF designation likely. See Significant Data Fiduciary.

E-commerce DPDP checklist

Order and service data separated from marketing data
Unbundled marketing consent per channel at checkout and sign-up
Cookie banner with tags blocked until consent
Ad audiences built only from consented customers
Seller and logistics data minimised and contracted
Retention schedule, including the Third Schedule rule if over two crore users
48-hour pre-erasure notices where applicable
Consent and checkout flows reviewed for dark patterns
Section 5(2) notices and re-permission for existing customers

How ConsentifyAI helps

ConsentifyAI gives e-commerce teams per-channel marketing consent at checkout and sign-up, a DPDP-ready cookie banner that blocks tags until consent, consent-gated audience syncs, and retention rules that handle the Third Schedule pre-erasure notice, all with a tamper-evident record.

Sources & references

DPDP Act, 2023 — Section 6, 7(a)
DPDP Act, 2023 — Section 8(1), 8(2), 8(7)
DPDP Act, 2023 — Section 9(3), 10
DPDP Rules, 2025 — Rules 3, 6, 7, 8 and Third Schedule
Other — Consumer Protection (E-Commerce) Rules, 2020; CCPA Dark Patterns Guidelines, 2023

Frequently asked questions

Do e-commerce sites need consent to process orders?

No. Data customers provide to place and receive an order can be processed for that purpose under Section 7(a). Marketing and retargeting need consent.

Does the three-year erasure rule apply to all online stores?

No. It applies to e-commerce entities with at least two crore registered users in India, under the Third Schedule to the Rules. Smaller stores still must erase data when its purpose ends.

Can we share customer data with marketplace sellers?

Share only what the seller needs to fulfil the order, under clear terms. Sellers using the data for their own marketing need their own basis.

Do we need a cookie banner?

If your store uses analytics, advertising or retargeting cookies and pixels, you need consent for them, and a banner is the practical way to get it.

Can we upload customer lists to ad platforms?

Only with a lawful basis for that purpose, which for advertising usually means consent.