E-commerce and marketplaces

The Consent Box That Cures Nothing

Written by Nikitha Vaitheeswaran, Partner. 2026-10-05. 8 min read.

Private labels have become a fixture of Indian e-commerce. Marketplaces that host thousands of independent sellers, increasingly sell goods under their own names, with decisions on what to source, how to price it and where to place it being driven by the data that the platform collects every day. The question of how far a marketplace may use that data to favour its own brands has so far been addressed largely through competition law, both in investigations and in proposals for ex-ante regulation.

The Department of Consumer Affairs has now taken up the question through consumer protection law. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026, notified on 9 September 2026 vide G.S.R. 789(E) w.e.f. 1 January 2027, inserts a new Rule 5(6) into the Consumer Protection (E-Commerce) Rules, 2020. While early commentary has largely read the provision as a consent requirement, and compliance teams are designing consent flows accordingly, a closer reading of the text suggests that consent may not be available at all for the use that matters most.

The Provision

Rule 5(6) reads as under-

No marketplace e-commerce entity shall use information collected by it,

(a) for sale of goods directly or indirectly by any seller, whether related or not, bearing a brand or name which is common with that of the marketplace e-commerce entity; or

(b) to promote or advertise any seller as being associated with the marketplace e-commerce entity, unless the marketplace e-commerce entity has obtained the express and affirmative consent for such use from the consumer(s) to whom such information pertains.

The provision itself operates on three main features i.e., the scope of "information", the placement of the consent exception, and the person from whom consent must be obtained.

The Meaning of "Information Collected by It"

The express prohibition refers neither to "personal data" nor to "consumer information" but to "information collected by it". The principal Rules adopt the definition of "information" in section 2(1)(v) of the Information Technology Act, 2000, which includes data, text, images, codes, software and databases. The expression is therefore wide enough to cover what a marketplace learns about its sellers, including which listings convert, at what price, and where demand outruns supply.

Seller data of this kind was at the centre of the European Commission's investigation into Amazon, which closed in December 2022 with Amazon committing not to use non-public seller data for its retail business [1]. Rule 5(6) reaches the same category of data, and consent obtained from shoppers cannot address it.

Where the Consent Exception Sits

In the gazette text, the words "unless... consent" appear within clause (b), written in beneath it, rather than as a separate paragraph governing both clauses. Under the rule of last antecedent, a qualifying phrase attaches to the words immediately preceding it unless the context requires otherwise, a rule the Privy Council applied in Irrawaddy Flotilla Co. v. Bugwandas when it confined a qualifying phrase in section 1 of the Indian Contract Act, 1872 to the clause immediately before it [2].

The Patna High Court in the case of Sunil Srivastava Vs. Union of India and Another [3] has held as under:-

Ordinarily when two clauses are separated by a semi-colon they have to be read disjunctively. That is why there is a semi-colon after clause (i) and clause (ii) and 'and' before clause (iii) of Rule 41 of the Estate Duty Rules, 1953.

The Full Bench of the Punjab and Haryana High Court in Rajinder Singh Vs. Kultar Singh [4] has held as under:-

After the words administration of justice in Entry 3 there is a semi-colon and this punctuation cannot be discarded as being inappropriate. The punctuation has been put with a definite object of making this topic as distinct and not having relation only to the topic that follows thereafter.

The Supreme Court in the case of Jamshed N Guzdar Vs. State of Maharashtra [5] in para 70 has held as under:-

In our view, the Full Bench of the Punjab and Haryana High Court was right in giving emphasis and meaning to semi-colon in Entry 3 of the List after the words 'administration of justice' in Rajinder Singh.

On this reading, consent operates only on clause (b), that is, on the promotion of sellers as associated with the marketplace. Clause (a), which covers the use of information to sell goods bearing the marketplace's own brand or name, carries no exception and operates as an outright prohibition.

Whose Consent?

Even where the consent exception applies, the Rule requires that consent be obtained from "the consumer(s) to whom such information pertains". That works for an individual's purchase history but not for a category-level demand trend, an aggregate basket analysis or a seller's sell-through rate. No identifiable consumer stands behind such information. Under either reading, therefore, a consent toggle cannot authorise the use of seller sales data to sell co-branded goods.

Legislative History

The drafting history gives some insight into how the provision came to take this form. The draft amendments published on 21 June 2021 contained two separate clauses, the first prohibiting a platform from making consumer information available to any other person without "express and affirmative consent" and barring the use of pre-ticked boxes. The second prohibited the use of marketplace-collected information to sell common-brand goods or to promote association with the marketplace, but only where the practice amounted to an unfair trade practice affecting the interests of consumers.

The 2026 text omits both the unfair-trade-practice qualifier and the data-sharing clause, so that the data-use prohibition survives in unconditional form with the consent language of the privacy clause attached to its second limb.

Interplay with the DPDPA and Competition Law

The Digital Personal Data Protection Act, 2023 (DPDPA) governs only personal data, that is, data about an individual who is identifiable by or in relation to such data [6], so that aggregated and anonymised data, and data relating to companies, fall outside its scope. Rule 5(6) is therefore among the first binding Indian rules to restrict a platform's use of data that is not personal data, and it does so through consumer protection law rather than through data protection or competition law.

The Draft Digital Competition Bill, 2024 proposed a comparable restriction, prohibiting systemically significant digital enterprises from using non-public business-user data to compete with those business users, and this has yet to be enacted. In the European Union, Article 6(2) of the Digital Markets Act imposes a similar obligation on gatekeepers and expressly extends to aggregated data [7], and while Rule 5(6)(a) is narrower in scope, it applies to every marketplace e-commerce entity rather than only to the largest platforms.

The Brand-Name Test

Clause (a) applies only where goods bear "a brand or name which is common with that of the marketplace", with the result that private labels sold under unrelated brand names fall outside the prohibition, as, on a plain reading, do services, since the clause refers only to goods. A co-branded label, which at least discloses who stands behind the product, is thus caught while a private label under an invented name is not, although the words "whether related or not" do extend the prohibition to brand-licensing arrangements in which an unrelated manufacturer sells goods under the marketplace's name.

Implications for Marketplaces

In light of the above, marketplace e-commerce entities may consider the following before 1 January 2027:

(i) mapping data flows by type and destination rather than by consent status, including every pipeline from marketplace data into private-label sourcing, pricing and merchandising;

(ii) treating clause (a) as a prohibition for co-branded goods and maintaining an information barrier between marketplace data and the teams responsible for such goods;

(iii) confining reliance on consent to promotion under clause (b) that uses an individual consumer's own data, with such consent captured separately from DPDPA consent and without pre-ticked or bundled boxes; and

(iv) reviewing brand-licensing and white-label arrangements in which an unrelated seller uses the marketplace's name.

Concluding Thoughts

(i) Rule 5(6) is better understood as a restriction on the competitive use of platform data than as a consent requirement, and compliance programmes built only around consent may not meet it;

(ii) the placement of the consent exception is a matter of interpretation, and, in case the intention of the Government is otherwise, and the Government intends to build consent for both clauses, then clarifications may be required.

References

European Commission, Summary of Commission Decision of 20 December 2022, Cases AT.40462 Amazon Marketplace and AT.40703 Amazon Buy Box, OJ C 87, 2023.
(1891) 18 IA 121 : ILR (1891) 18 Cal 620 (PC).
(1984) 145 ITR 356
(AIR 1980 P&H 1)
(2005) 2 SCC 591
Digital Personal Data Protection Act, 2023 (Act 22 of 2023), sections 2(t) and 3.
Regulation (EU) 2022/1925 (Digital Markets Act), Article 6(2).

Topics

This note is a general account of the law at the date shown. It is not legal advice.