Indian consumption has shifted online over the past decade, particularly during the COVID-19 pandemic, with the e-commerce sector growing at a 19-21% Compound Annual Growth Rate (“CAGR”). Quick commerce has also emerged as a major growth driver, scaling to USD 10-11 billion GMV and is projected to reach USD 65-70 billion by 2030. This growth has created significant economic opportunities, but has also raised concerns about consumer trust and distorted market outcomes. In 2025, nearly 29 percent of grievances received by the National Consumer Helpline were related to e-commerce.

E-commerce platforms, therefore, are no longer intermediaries connecting buyers and sellers. Through search rankings, recommendations, targeted advertising, pricing strategies, and data collection, they shape what consumers see and purchase. Regulatory attention has shifted toward how these systems are designed and governed as platforms have become more influential in determining market visibility and consumer choice. In India, this is reflected in two frameworks: the Digital Personal Data Protection Act, 2023 (“DPDP Act”), which governs personal data processing, and the Consumer Protection Act, 2019 read with the Consumer Protection (E-Commerce) Rules, 2020, as amended by the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 (“Amended Rules”), which seek to strengthen transparency and accountability in digital marketplaces.

Read together, these frameworks signal a shift in India's approach to platform governance: from addressing individual consumer transactions to shaping the systems through which digital marketplaces operate. This article examines the intersection and argues that Rule 5(6) of the Amended Rules relies on consumer consent to respond to what is, in large part, an antitrust or competition concern. We further argue that this issue can be resolved through clearer guidance and regulatory coordination instead of amending the law, thereby reducing overlaps with the DPDP framework.

Beyond Consumer Protection: What Do the Amended Rules Change

In September 2026, the Department of Consumer Affairs notified the Amended Rules, effective January 2027, introducing enhanced obligations on marketplace and inventory e-commerce entities. The definition of “ranking” now extends to sellers as well as goods and services. Marketplace e-commerce entities must explain, in plain and simple language, the key parameters that determine the ranking of goods or sellers on their platform, in descending order of importance, and indicate the relative weight of those parameters through a publicly accessible description. The Amended Rules also prohibit e-commerce entities from manipulating search results or indexes in a way that misleads consumers. Sponsored listings must be clearly and prominently identified so consumers can distinguish organic results from paid promotional content.

To address misleading discount practices, any announced price reduction must show both the discounted price and the prior price, defined as the lowest price offered during the preceding 30 days. The Amended Rules also incorporate the Guidelines for Prevention and Regulation of Dark Patterns, 2023 (“Dark Patterns Guidelines”) by requiring annual self-audits and the prominent display of a compliance certificate. The Central Consumer Protection Authority (“CCPA”) notified the Dark Patterns Guidelines in 2023, and the Amended Rules now include a periodic self-certification requirement.

Taken together, these measures represent a shift in policy thinking. E-commerce regulation is no longer focused only on whether sellers comply with consumer-facing obligations. It also considers how e-commerce entities are structured, influence consumer choices, and shape participation in digital marketplaces. Ranking transparency, sponsored listings, price disclosures, and dark-pattern audits influence how an e-commerce entity curates information and manages consumer protection.

Rule 5(6) of the Amended Rules: Policy around Self-Preferencing

Rule 5(6) of the Amended Rules prohibits a marketplace e-commerce entity from using information collected by it for the sale of goods under a brand or name common with the marketplace, or to promote a seller associated with the marketplace, unless it has obtained affirmative consumer consent. The policy objective appears aimed at addressing concerns around self-preferencing: the possibility that a platform may compete with sellers that depend on it while also controlling visibility, ranking, and access to consumer data. India has addressed related concerns; as of 2018, foreign-owned marketplaces are restricted from controlling inventory sold on their platforms and from permitting sales by entities in which they hold an equity stake.

However, self-preferencing is fundamentally a competition law concern linked to platform incentives and market power, rather than solely being a question of consumer consent. The key issue is often not the existence of own-brand products, but whether e-commerce entities use consumer data and visibility advantages to favor them. In this regard, Rule 5(6) of the Amended Rules leaves uncertainty as to whether it extends beyond consumer information to cover non-public seller data, which is central to competition law concerns.

A related issue concerns aggregated or anonymized data. Decisions on product launches and pricing often rely on aggregated purchase and search trends rather than individual records. While such data may fall outside the scope of the DPDP framework, it could still qualify as information “collected by” the marketplace under the Amended Rules. This creates uncertainty about whether consent is required and, if so, from whom, highlighting the limits of a consent-based approach to these concerns.

The Amended Rules may appear to enhance transparency obligations, but they do not directly address self-preferencing as a competition issue, leaving consumer consent under the Amended Rules as the primary safeguard against data-driven advantages. This matters because the Competition Commission of India has already examined similar concerns, and the draft Digital Competition Bill, 2024 proposes ex-ante regulation of self-preferencing and the use of non-public business-user data.

When Consent May Not Address Structural Concerns

The DPDP Act requires consent to be free, specific, informed, unconditional, unambiguous, and require it to be a clear affirmative action. Meaningful consent also presupposes that an individual could weigh the consequences of their choices. However, in this scenario consumers consenting to personalized recommendations may be unable to evaluate the broader effects on competing sellers, future prices, or marketplace diversity. Third parties and the market bear the impact, while consumers have little incentive to refuse.

The effectiveness of this safeguard is further complicated because marketplaces control the interfaces through which consent is sought. Design choices can influence consumer decisions, and larger platforms may be better positioned than smaller competitors to secure consent at scale. Volume also matters from the consumer’s perspective: research by a consulting firm suggests the average internet user encounters up to 5,000 consent requests annually. Moreover, repeated consent requests may contribute to consumer fatigue and indifference.

From May 2027, e-commerce entities may need to manage consent requirements under both the DPDP framework and the Amended Rules, in addition to existing marketing permissions. This could increase operational complexity and further contribute to consumer fatigue. Consent Managers may offer a way to streamline consent management through a unified interface, but it remains unclear whether consent under the Amended Rules can be integrated into that framework.

Avoiding Fragmentation in the Consent Ecosystem

A paradox in consent-mechanism enforcement is that the same consent interaction may be examined by two authorities: the CCPA under the Consumer Protection Act, 2019 and the Data Protection Board (“DPB”) under the DPDP framework. The DPDP Act applies in addition to other laws and prevails in the event of a conflict, providing a statutory basis for interpreting these laws consistently.

The CCPA has moved from advisory guidance to active enforcement on dark patterns, and some of its orders already address consent and personal data. In its June 2026 order against an EdTech platform, it treated requiring personal data before accessing free courses as forced action and held that consent cannot be assumed through pre-selected options and must be obtained through clear affirmative action. By contrast, at the time of writing, the Central Government is in the process of appointing the Chairperson and Members of the DPB. In practice, the CCPA may set the working standard for consent in commercial settings before the DPDP framework is fully operational. Differing interpretations of valid consent could raise compliance costs for industry and leave customers facing inconsistent experiences, making early coordination between the two authorities prudent.

Practical Path Toward a More Coherent Regulatory Approach

The overlap between the Amended Rules and the DPDP framework offers a unique opportunity to ease compliance and reduce duplication. As a first step, the CCPA could clarify that the requirement for "express and affirmative consent" under Rule 5(6) may be interpreted consistently with the DPDP Act, allowing a single, itemized consent request to satisfy both regimes. The same guidance could also confirm whether consent under the Amended Rules may be given, reviewed, and withdrawn through Consent Managers registered under the DPDP Rules, helping reduce compliance burdens for platforms and consent fatigue for consumers. It could also clarify what amounts to using information to promote or advertise a seller and how the Amended Rules would apply to non-personal data.

E-commerce entities would benefit from clear design standards for consent requests. Such standards could rely on the DPDP Act and similar international counterparts, which state that withdrawing consent should be as easy as accepting it. The CCPA may also publish a methodology for the annual dark pattern self-audit that expressly covers consent interfaces, so certification rests on a consistent, verifiable basis rather than individual interpretation.

Concerns about self-preferencing and the use of seller data may be better addressed through competition law, rather than consumer consent. In the absence of such coordination, the CCPA may require e-commerce entities to disclose whether marketplace affiliation influences ranking as part of their ranking parameter disclosures, in line with comparable international legislation. Once the DPB is operational, the CCPA and the DPB could establish a formal coordination arrangement on consent, so a single consent interaction is not assessed against divergent standards.

Conclusion

The Amendment Rules mark a welcome shift in India's approach to e-commerce, moving beyond seller conduct to address how platforms are designed and governed. Rule 5(6) of the Amended Rules reflects a sound objective, but by relying on individual consent to address what is largely a structural concern, it risks placing more weight on consent than it can reasonably bear. Operating alongside the DPDP consent framework and overseen by two authorities, it may also add to consent fatigue and regulatory uncertainty while India's data protection framework is still being implemented.

These risks can be addressed without reopening the Amended Rules. Guidance on the consent standard, design safeguards, a clear audit methodology, and early coordination between the CCPA and the DPB would address many of these concerns. With the Amendment Rules taking effect in January 2027 and the full operationalization of the DPDP framework in May 2027, e-commerce entities can design their consent frameworks under the Amended Rules before the DPDP measures are in place. Industry and regulators both stand to gain from a consent framework that works for platforms and is meaningful for consumers.