For over a decade, India’s e-commerce story has rested on a simple premise: platforms connect buyers and sellers, while data fuels efficiency, personalisation, and scale. However, as the market matured, its structure has revealed a growing imbalance. E-commerce platforms, especially marketplace entities, provide an unmatched venue and access to large consumer bases, but they also hold enormous leverage through consumer data. This leverage increasingly shapes markets, helps privilege affiliated sellers, and tends to skew not only competition but also the overall consumer experience today. 

 

Against this backdrop, the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, represents a decisive attempt to correct this imbalance and protect consumer interests. Much of the public conversation has focused on greater transparency measures, curbing “dark patterns” and misleading discounts. Yet a more consequential shift lies in how the law begins to treat consumer data as a regulated resource and not merely a commercial or strategic asset. 

 

At the heart of this shift is the newly introduced Rule 5(6), which turns platform-held consumer information into a disciplined and ring-fenced regulatory category. Its deliberate drafting restricts how marketplace entities may use information collected through their platforms and seeks to close gaps that could otherwise allow data to be channeled back into self-preferencing or associated-seller advantages. In particular, it prohibits a marketplace entity from using such information to facilitate, directly or indirectly, the sale of goods carrying a brand or name shared with the marketplace entity, whether through related or unrelated sellers. Further, it also prevents marketplaces from using consumer information to promote or advertise a seller as being associated with the platform without their consent.

 

While the amendment prohibits a marketplace entity from acting as both referee and player in the same game, its permission for advertising of associated sellers hinges squarely on “express and affirmative consent”. 

 

Crucially, consent in digital ecosystems has often been reduced to boilerplate privacy policies and pre-ticked boxes. Echoing developments in India’s data protection framework, the amended e-commerce rules raise the bar. They reject passive or implied consent and move towards a higher threshold for consumers’ consent. This approach is consistent with the broader regulatory push across sectors, from prohibiting dark patterns to imposing stricter disclosure requirements, and reflects a clear change toward enabling meaningful and informed consumer choice. In this sense, the amendments do not merely restrict platform conduct; they seek to actively restore consumer agency in the e-commerce space. 

 

The interesting dimension of Rule 5(6) is how closely it mirrors principles typically associated with data protection law, particularly purpose limitation and data minimisation. The idea that data collected for one purpose (facilitating transactions) should not be repurposed for another (promoting or advertising competing sellers) without consent is foundational to modern privacy regimes. 

 

As digital markets evolve, data becomes the site of regulatory overlap. Control over data translates into market power, which, in turn, affects consumer welfare. The 2026 amendments recognise this linkage and recalibrate the requirements at the point where market interactions and various regulatory frameworks converge on consumer data.

 

Earlier iterations of e-commerce regulation in India focused heavily on transparency disclosures around pricing, country of origin, seller information, and the factors determining the ranking of goods and sellers. While transparency remains important, the 2026 amendments go further towards building structural fairness.

 

For instance, disclosure-oriented requirements sought to reduce information asymmetries by ensuring that consumers had access to material information before making purchasing decisions. Similarly, the crackdown on deceptive interface designs, or so-called “dark patterns,” targets behavioural manipulation rather than mere informational gaps. Rule 5(6) pushes beyond mere transparency to a higher degree of fairness. It recognises that even perfectly transparent systems can remain unfair to consumer interests if underlying incentives allow platforms to exploit their position.

 

For e-commerce platforms, compliance with the new rules will require more than policy updates. It will necessitate architectural changes in how data flows are managed across business units and how the user experience is designed. Platforms will need to: (i) ring-fence marketplace data from private label or affiliated seller operations; (ii) revisit recommendation algorithms that may indirectly favour associated sellers; (iii) build robust consent frameworks that meet the “express and affirmative” threshold. 

 

It goes to the core of how digital platforms treat consumer data and will not be a trivial change. Simultaneously, the rules also create a valuable opportunity. By reinforcing trust and ensuring fair play, they may strengthen the long-term sustainability of India’s e-commerce ecosystem, particularly for small and medium sellers who rely on platform neutrality while benefiting from access to scale due to network effects.

 

The success of the 2026 amendments will ultimately depend on enforcement. Concepts such as “indirect use” of data or “association” between platforms and sellers are inherently nuanced and invite interpretational challenges. Regulators may look beyond formal ownership links and examine data flows, recommendation systems, and the practical operation of commercial arrangements. Yet, despite these challenges, the direction of travel is clear. India is moving towards a regulatory architecture that enables digital markets to grow in ease and efficiency, while also aiming to improve fairness, accountability, and trust.

 

Recent CCPA advisories and enforcement actions on ‘dark patterns’ signal strong regulatory monitoring and implementation. When the amended rules take effect, data-use and consent requirements are likely to receive similar attention. Consumers should remain vigilant, while e-commerce entities should act with even greater care by promptly reviewing their data flows, platform design, and consent mechanisms.