DPDP Act for e-commerce: consent, cookies and erasure
For D2C brands, marketplaces and online sellers: what an order lets you do with a shopper’s data, what marketing needs on top, how tracking fits, and the erasure rule for large platforms.
Last updated 22 October 2026
How does the DPDP Act apply to e-commerce businesses?
An online store is a Data Fiduciary for its shoppers’ data. Fulfilling an order and marketing to the shopper are separate purposes that need separate, withdrawable consent. Platforms with at least two crore registered users must also erase inactive users’ data after three years, warning them 48 hours before.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upDoes an online store need separate consent for marketing and order fulfilment?
Yes, in effect. Under section 6(1) of the DPDP Act, 2023, consent must be specific to the purpose and limited to the data that purpose needs. Delivering an order needs a name, address, phone number and payment confirmation. Sending offers, building a lookalike audience or personalising recommendations are different purposes, and a single pre-ticked “I agree” cannot cover them. Consent must also be unconditional (section 6(1)), so a store should not refuse to deliver an order because a shopper declines marketing.
| Data you hold | DPDP duty | Section or rule | Applies from |
|---|---|---|---|
| Name, address, phone for delivery | Notice and consent for order fulfilment | Sections 5, 6(1); Rule 3 | 13 May 2027 |
| Email and WhatsApp for offers | Separate marketing consent; withdrawal as easy as opt-in | Section 6(1), 6(4); Rule 3(c)(i) | 13 May 2027 |
| Browsing, cart and pixel data | A lawful ground and a notice; no tracking or targeted ads aimed at children | Sections 4, 5, 9(3); Rule 3 | 13 May 2027 |
| Order, payment and delivery logs | Keep at least one year, even after account deletion | Rule 8(3) | 13 May 2027 |
| Inactive accounts on a 2-crore-user platform | Erase after three years, with 48 hours’ warning | Rule 8(1), 8(2); Third Schedule | 13 May 2027 |
| Grievances and rights requests | Publish the means and a response period of no more than 90 days | Section 13; Rule 14 | 13 May 2027 |
Sections 3 to 17 of the Act, which hold every duty above, come into force on 13 May 2027 under the commencement order of 13 November 2025 (G.S.R. 843(E)), the same day as Rules 3 and 5 to 16 (Rule 1).
Section 5(2) also reaches back. Where shoppers consented before the Act commenced, the store must give them a notice as soon as reasonably practicable; the Act’s illustration is an online shopping app sending it by email or in-app notification. It may continue processing until the shopper withdraws.
How does the DPDP Act treat cookies, pixels and tracking?
Neither the Act nor the DPDP Rules, 2025 uses the word “cookie”. There is no cookie-specific rule, consent category or exemption. The question is simply whether a tool processes personal data, meaning data about an identifiable individual (section 2(t)). An analytics cookie tied to a logged-in account, an advertising pixel that sends hashed emails to an ad platform, and a session-replay script all do. Each then needs:
- a lawful ground, which for marketing and advertising is almost always consent (section 4);
- a notice that itemises the data and the purpose (section 5; Rule 3);
- a way to withdraw that is as easy as accepting (section 6(4)); and
- a contract with the vendor if it processes data on your behalf (section 8(2)).
Section 9(3) is the one place the Act names tracking: a Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. A store selling to a general audience should know which of its users are under eighteen. Shoppers can also ask for the identities of all Data Fiduciaries and Data Processors their data was shared with (section 11(1)(b)), so every tag on your site belongs in your vendor register.
When must an e-commerce platform erase data and answer grievances?
The Third Schedule erasure rule
Rule 8(1) and the Third Schedule to the DPDP Rules, 2025 apply to an e-commerce entity with not less than two crore registered users in India. For all purposes except letting the user access her account and access any virtual token issued by or for the platform, stored on it and usable to get money, goods or services, the platform must erase her data after three years from the latest of: the date she last approached it for the specified purpose or exercised her rights, or the commencement of the DPDP Rules, 2025. Retention a law requires is excepted. At least 48 hours before erasure, Rule 8(2) requires telling her the data will be erased unless she logs in or otherwise makes contact.
Account deletion
When a shopper deletes her account, section 8(7) requires erasure once the purpose is served, and section 12(3) once she asks, in both cases unless a law requires retention. Rule 8(3) then sets a floor: personal data, associated traffic data and logs of processing must be kept for at least one year from the processing, for the purposes in the Seventh Schedule. The Rules’ own illustration is an e-book platform that must keep order, payment and delivery records for a year even after the buyer deletes her account. Build deletion as “stop using now, purge when the retention clock ends”.
Grievances
| Step | Requirement | Source |
|---|---|---|
| Publish how to raise a request | Means of making a request and any identifier needed, prominently on the site or app | Rule 14(1) |
| Publish a contact person | Business contact of the DPO, if any, or a person who can answer questions; repeat it in every rights response | Section 8(9); Rule 9 |
| Respond to grievances | Within a published period not exceeding ninety days | Section 13(2); Rule 14(3) |
| Escalation | The shopper must exhaust your grievance process before going to the Data Protection Board | Section 13(3) |
How will the Perimattic DPDP Compliance Suite help online stores?
For D2C brands, marketplaces and online sellers, the planned features most relevant are:
- Consent capture and records that keep order and marketing consent separate.
- A notice builder for Rule 3 notices in English and Eighth Schedule languages.
- A rights-request tracker for access, correction, erasure, nomination and grievances, with response-time tracking.
- Retention and erasure schedules under Rule 8, including the 48-hour pre-erasure intimation.
- A processor and vendor register covering analytics, ad and payment tools.
- A breach response workflow for shopper intimations and Board reports under Rule 7.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Using it will not by itself guarantee compliance. Sign up to tell us how your store handles shopper data.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP Act for e-commerce, answered
Does the DPDP Act require a cookie banner?
The Act and the DPDP Rules, 2025 do not mention cookies at all. What they regulate is processing of personal data. If a cookie, pixel or SDK collects data that identifies a shopper, that processing needs consent or a legitimate use like any other, with a notice for consent and an easy way to withdraw. A banner is one way to do that, not a named requirement.
What happens to orders if a shopper withdraws consent?
The Act’s own illustration to section 6(5) answers this: the store may stop letting her place new orders, but may not stop processing to supply goods she has already ordered and paid for. Withdrawal does not affect the legality of processing done before it, and the store must make its processors stop processing her data within a reasonable time.
Does Rule 8’s three-year erasure apply to every online store?
No. Under the Third Schedule it applies only to an e-commerce entity with not less than two crore registered users in India. The definition, taken from the Consumer Protection Act, 2019, excludes a seller offering goods on a marketplace. Smaller stores still owe the general duty in section 8(7) to erase data once the purpose is no longer served.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up