How the new marketplace data restrictions interact with the DPDP Act, and what businesses must do before 1 January 2027
Prepared by Shubhank Suman, AI, Privacy, and IP Counsel
On 9 September 2026, the Ministry of Consumer Affairs, Food and Public Distribution notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, amending the Consumer Protection (E-Commerce) Rules, 2020 made under the Consumer Protection Act, 2019. The amendment comes into force on 1 January 2027. It covers several subjects, including pricing disclosure, dark patterns, ranking transparency and seller disclosure. One change is directly relevant to data protection practice. The amended Rule 5(6) restricts how a marketplace e-commerce entity may use the information it collects through its platform. This note
explains that restriction in plain terms, maps it against the corresponding obligations under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and sets out what a marketplace platform needs to do to comply with both regimes at the same time.
1. Rule 5(6) Closely
"No marketplace e-commerce entity shall use the information collected through its platform,(a) for sale of goods directly or indirectly by any seller, whether related or not, bearing a brand or name which is common with that of the marketplace e-commerce entity, or (b) to promote or advertise any seller as being associated with the marketplace e-commerce entity, unless the marketplace e-commerce entity has obtained the express and affirmative consent for such use from the consumer or consumers to whom such information pertains."
- Who is bound: only a marketplace e-commerce entity, as defined in Rule 3(1)(f) of the 2020 Rules, meaning a platform that provides an information technology platform to facilitate transactions between buyers and sellers. An inventory-led entity selling only its own stock directly is not covered by this particular Rule.
What is covered: "the information collected through its platform." This phrase is wider than "personal data" as defined under the DPDP Act. It is not expressly limited to information that identifies a person, though in practice it will almost always involve personal data such as browsing history, purchase history, search queries and location.
1. Restriction on the use of consumer information: A marketplace cannot use a consumer’s personal information for either of the following commercial purposes unless it has obtained the consumer’s express and affirmative consent:
2. Promotion of the marketplace’s own or related goods: The marketplace cannot use the consumer’s information to advertise, recommend, promote, or sell goods offered under a brand or name that is the same as, or commonly associated with, the marketplace’s own name. This may include goods sold directly by the marketplace, products offered under its private label, and goods sold by an affiliated or related seller.
3.Promotion Of Sellers Presented As Associated With The Marketplace: The
marketplace cannot use the consumer’s information to advertise or promote a seller by presenting that seller as having a special connection with, approval from, or preferred status on the marketplace. This may include badges or descriptions such as “Official Store,” “Preferred Seller,” or “Marketplace Assured,” as well as preferential placement in search results, recommendations, targeted advertisements, or other promotional spaces. This restriction may apply even if the seller does not share the marketplace’s brand or name, because the relevant consideration is whether the seller is presented as being specially associated with or endorsed by the marketplace.
4. Requirement of express and affirmative consent: The marketplace may use the consumer’s information for either of the above purposes only after clearly informing the consumer about the proposed use and obtaining the consumer’s active and specific consent. The consent must relate to the particular consumer whose information will be used and should be indicated through a deliberate action, such as selecting an unticked checkbox.
5. What would not amount to valid consent: Consent should not be treated as valid merely because the proposed use is mentioned in a general or lengthy privacy policy, a checkbox has been selected in advance, the consumer has not objected, or the consumer continues to access or use the marketplace. In other words, silence, inactivity, or continued use of the platform cannot replace a clear and conscious choice. The marketplace must separately and clearly explain that the consumer’s information will be used either to promote the marketplace’s own or related products, or to favour or promote particular sellers. It must then obtain the consumer’s active agreement before using the information for that purpose.
Practical Example
Facts-
Assume an online marketplace called “QuickCart” collects information about a consumer named Riya, including her searches, previous purchases, products viewed, items added to her cart, and preferred price range.
Riya frequently searches for wireless earphones and recently purchased a mobile phone through QuickCart. Use of information to promote the marketplace’s own or related products: QuickCart uses Riya’s browsing and purchase history to show her advertisements for wireless earphones sold under the brand “QuickCart Basics.
Alternatively, the earphones may be sold by a company affiliated with QuickCart or under QuickCart’s private-label brand. Because QuickCart is using Riya’s information to promote goods carrying its own or a related name, it cannot do so unless Riya has given express and affirmative consent for this specific use. Use of information to promote a preferred or associated seller: QuickCart also uses Riya’s browsing history to recommend earphones sold by SoundHub Electronics, a seller displayed with an “Official Store,” “QuickCart Assured,” or “Preferred Seller” badge. SoundHub Electronics does not use the QuickCart name, but the badge and prominent placement create the impression that the seller is specially approved, associated with, or preferred by QuickCart. Therefore, QuickCart cannot use Riya’s information to target her with this promotion unless it has obtained her express and affirmative consent. The restriction may also apply if QuickCart gives SoundHub Electronics a higher position in Riya’s personalised search results or repeatedly displays its products in recommendations based on her activity.
2. Illustrations: What Falls Inside And Outside The Rule
No. | Covered | Business practice | What is needed, or why it falls outside |
|---|---|---|---|
1 | Yes, 5(6)(a) | Search results surface the marketplace's own private-label detergent above other sellers' detergent for a user who has bought detergent before on the platform. | A separate express, affirmative consent covering this specific use. The general privacy policy does not suffice. |
2 | Yes, 5(6)(a) | A home page widget recommends the marketplace's own electronics brand based on a user's browsing history. | Same as above. The recommendation is generated from the user's own information. |
3 | Yes, 5(6)(a) | An email campaign to past buyers of a product category promotes the marketplace's private-label alternative in that category. | Same as above, plus the DPDPA notice for this specific purpose. |
4 | Likely, 5(6)(b) | A sponsored listing described as an "Assured" or "preferred" partner is shown to a user based on that user's own search and click history. | Separate consent, in addition to the existing sponsored-listing disclosure already required under the amended Rules. |
5 | No | A "Sold by Official Store" badge is shown identically to every visitor, based only on the seller's registration category, not on any individual user's data. | This is a labelling practice, not a use of consumer information. It falls outside Rule 5(6) as drafted. |
6 | No | The marketplace cross-sells its own logistics or payment service at checkout using the user's order data, without describing any seller as associated with the marketplace. | No seller is being promoted through a shared brand or claimed association, so Rule 5(6) does not apply. DPDPA consent may still be needed depending on the original notice. |
3. Mapping The Obligation Against The DPDP Act
Section 4 of the DPDP Act permits processing of personal data only under consent or one of the nine legitimate uses listed in Section 7. None of the eight legitimate uses apart from Section 7(a), covering state functions, employment, medical emergencies, and similar situations, fit ordinary retail marketing. Section 7(a) itself requires the consumer to have voluntarily provided the data for that specified purpose without objecting to its use, which is a stretch for most current sign-up flows that never mention brand promotion. In practice, this means a marketplace can rarely rely on a legitimate use ground for this activity under the DPDP Act, and has to obtain consent under Section 6, the same conclusion Rule 5(6) reaches independently.
Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. This is, if anything, more detailed than the "express and affirmative consent" standard in Rule 5(6), since Section 6 separately requires the consent to be tied to a specified purpose and limited to necessary data. A consent flow that genuinely satisfies Section 6 for this automatically. A consent captured only to satisfy Rule 5(6), without the itemised notice that Section 5 of the Act and Rule 3 of the DPDP Rules require, would not by itself discharge the platform's obligations under the DPDP Act.
purpose will, in almost every case, also satisfy Rule 5(6). The reverse does not hold
Section 6(4) to (6) gives the Data Principal a right to withdraw consent, with consequences no more difficult than the process of giving it, and requires the fiduciary to stop the relevant processing once consent is withdrawn, subject to any independent legal retention requirement. Applied here, if a consumer withdraws consent for the private-label promotion use, the marketplace must stop that specific use while continuing any other lawful use of the same data, such as order fulfilment, that rests on a different basis. The consent architecture therefore needs to be granular and tied to this specific purpose, not a single account-level marketing toggle.
4. Subject Matter, Differences And Which One Prevails
Aspect | Consumer Protection Rules, Rule 5(6) | DPDP Act and Rules |
|---|---|---|
Governing statute | Consumer Protection Act, 2019, Section 101(2)(zg) | Digital Personal Data Protection Act, 2023 |
Regulator | Central Consumer Protection Authority and consumer commissions | Data Protection Board of India |
What it protects | Fair market conduct, and prevents a marketplace from using its platform position against independent sellers and consumers | The individual's control over her own personal data, across every sector and purpose |
What is regulated | Two specific uses of information collected through the platform: private-label sale and seller-association promotion | All processing of digital personal data, for any purpose, by any data fiduciary |
Consent standard | Express and affirmative consent, not otherwise defined in the Rule | Free, specific, informed, unconditional and unambiguous consent with clear affirmative action, limited to necessary data, Section 6(1) |
Remedy for breach | Consumer complaint, CCPA inquiry and orders, penalties under the Consumer Protection Act | Data Principal complaint, Board inquiry, financial penalties under the Act |
There is no direct conflict between the two regimes on the facts likely to arise. Both independently require the same practical outcome, a specific and genuine opt-in before the consumer's information is used this way. Section 38(1) of the DPDP Act states that its provisions are in addition to, and not in derogation of, any other law for the time being in force. Section 38(2) gives the DPDP Act primacy only "in the event of any conflict" with another law. Where the two regimes are not actually inconsistent, as appears to be the case here, Section 38(2) has no work to do, and Section 38(1) governs instead. A marketplace cannot treat compliance with one regime as satisfying the other. It needs both, and the practical answer is to design a single consent event that separately meets both sets of conditions, rather than two disconnected prompts. This reading is my own analysis. Neither the Data Protection Board
nor the Central Consumer Protection Authority has issued guidance on the interaction between the two regimes, and Rule 5(6) itself is not yet in force.
5. The AI And Algorithmic Angle
Ranking, recommendation and personalisation systems on a marketplace are, in almost every case, algorithmic models trained on consumer information such as browsing history, purchase history, search queries and time spent on a listing. Rule 5(6) does not mention algorithms, but its practical effect falls squarely on these systems, since they are usually the mechanism through which a marketplace's private-label products or affiliated sellers gain visibility.
- Ranking systems: if a model weights the marketplace's own listings more favourably, and that weighting is triggered by an individual consumer's own browsing or purchase pattern, the output is a use of that consumer's information within Rule 5(6)(a). If the same weighting is applied uniformly to every visitor regardless of their own data, as a structural design choice rather than a per-user targeting decision, the position is less clear on the wording of the Rule, which is framed around information and the consumer to whom it pertains. A structural bias of this kind may fall outside Rule 5(6) as drafted, while still attracting scrutiny as an unfair trade practice or a self-preferencing concern under other provisions.
- Recommendation engines: a panel such as "recommended for you" that surfaces the marketplace's own brand, generated from the individual consumer's own behavioural profile, is a direct application of her information and squarely triggers Rule 5(6)(a) where the recommended item carries a common brand or private label.
- Targeted advertising: an ad-serving system that decides, using a consumer's own data, whether to show her a sponsored listing described as official or preferred, triggers Rule 5(6)(b) independently of any sponsorship disclosure already required for that listing.
- Operational difficulty: most ranking and recommendation systems are trained on pooled, platform-wide data, not on a query-by-query basis linked to one consumer's consent status. Building a system that can switch a specific promotional signal on for one consumer and off for another, at the moment the page is generated, is a real
engineering task that most current infrastructure does not support. This is likely to be the largest technical compliance cost the amendment creates.
A related obligation is worth flagging here. If the marketplace has been notified as a Significant Data Fiduciary under Section 10 of the DPDP Act, the same ranking or recommendation system is also subject to Rule 13(3) of the DPDP Rules, which requires the fiduciary to observe due diligence to verify that its algorithmic software is not likely to pose a risk to the rights of Data Principals. A ranking system that structurally favours the platform's own products using consumer data, without a working consent gate, is a plausible candidate for exactly this kind of risk. Rule 5(6) of the Consumer Protection Rules and Rule 13(3) of the DPDP Rules point the compliance function toward the same technical system for two different but overlapping reasons, and a review of one should not be treated as a substitute for the other.
6. Current Practice And Common Problems
Most marketplaces today obtain consent for marketing and personalisation through one of three mechanisms: a single checkbox at account creation covering all future marketing use, an omnibus privacy policy the consumer is deemed to accept by continuing to use the platform, or a cookie banner that bundles analytics, personalisation and advertising into one accept-all button. None of these will satisfy Rule 5(6) once the amendment takes effect, and most would also struggle to satisfy Section 6 of the DPDP Act, because none of them separately and specifically describes private-label promotion or seller-association advertising as a distinct purpose.
- A pre-ticked marketing preference at account signup.
- Consent bundled into acceptance of the terms of service, rather than captured as a separate action.
- No separate toggle distinguishing in-house brand promotion from general personalisation.
- No mechanism to honour withdrawal of this specific consent without disabling the account or unrelated services.
- No internal record connecting a particular promotional display to a valid, timestamped consent from that particular consumer.
The amendment does not create a new data protection law. It creates a narrow, sector-specific consent requirement for two particular practices, private-label promotion and seller-association advertising, sitting alongside the marketplace's existing obligations under the DPDP Act. The two regimes ask for the same thing in substance, a specific and genuine opt-in before a consumer's information is used this way, but they are enforced by different regulators, under different statutes, with different remedies, and neither substitutes for the other. A marketplace preparing for 1 January 2027 should treat this as one compliance exercise built around the ranking and recommendation systems that actually carry out the promotion, rather than as a separate item ticked off in a privacy policy update.