Consumer Protection (E-Commerce) (Amendment) Rules, 2026 : A Watershed Moment in Consumer Protection Regime in India

India’s e-commerce regulatory framework is entering a significant new phase at a time when AI-driven recommendation engines, dynamic ranking systems and increasingly autonomous algorithms shape what consumers see, compare and ultimately purchase. On September 9, 2026, the Ministry of Consumer Affairs notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, substantially revising the Consumer Protection (E-Commerce) Rules, 2020 (“E-Commerce Rules”). The amendments take effect on January 1, 2027, leaving marketplaces, sellers and associated businesses a limited window to reassess their data practices, automated ranking and advertising systems, pricing disclosures, seller- information architecture, grievance-redressal processes and user-interface design.

For businesses, the amendments convert issues previously governed by general consumer - protection principles, data-protection requirements or non-binding guidance into specific, enforceable obligations. Their importance is amplified by the growing use of AI systems that can optimise, personalise and rank content at scale, often with limited human intervention. Businesses can no longer treat the outputs of a recommendation engine or autonomous decision-making system as technologically neutral: they must understand how such systems use data, influence consumer choice and create foreseeable risks.

Non-compliance may generate legal, operational and reputational exposure, while implementation will require coordination across technology, product, marketing, legal and customer-support teams. This article examines four principal areas of impact:

cross-use of

consumer data,

search and ranking mechanisms,

pricing practices, &

mandatory compliance with the guidelines against dark patterns.

It also identifies practical steps businesses should take before the new regime comes into force.

CROSS-USE OF CONSUMER DATA

The new Rule 5(6) restricts how marketplace e-commerce entities may use consumer data collected through their platforms. Significantly, consumer-protection law—rather than a dedicated data-protection statute—now imposes specific obligations governing data use and consent. Rule 5(6) creates two requirements :

(a) an absolute prohibition on using consumer data across sellers that share a brand or name; and

(b) express consumer consent before such data is used to advertise associated sellers.

Rule 5(6)(a) prevents marketplaces from using the behavioural data they collect to benefit sellers operating under common brands or names. This responds to concerns that platforms may use marketplace data to favour their private labels or affiliated sellers over independent sellers, thereby undermining marketplace neutrality.

These concerns have also arisen in investigations before the Competition Commission of India (“CCI”), particularly in relation to platform neutrality and preferential treatment by e-commerce entities with market power. Competition law and consumer law both seek to promote consumer welfare and well-functioning markets. Under competition law, however, such conduct would generally be examined under Sections 3(4) or 4 of the Competition Act, 2002, requiring an assessment of market power or dominance. Rule 5(6)(a) is considerably broader: it applies to all e-commerce entities, irrespective of their market strength. Rule 5(6)(b) separately requires express, affirmative consent before customer data is used to advertise associated sellers. This obligation is additional to those under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), creating a consent-gated restriction on this specific use of data.

The amendments supplement, rather than displace, the DPDP Act. The DPDP Act continues to govern the general collection and processing of personal data, while the E-Commerce Rules impose a sector-specific consent requirement aimed at self-preferencing and seller promotion. Accordingly, general compliance with the DPDP Act will not permit a platform to use consumer data to advertise an associated seller without separate, express and affirmative consent for that purpose.

Platforms will therefore need a two-layer consent architecture : a DPDP-compliant framework covering notice, withdrawal and purpose limitation, and a separate, auditable consent mechanism for using customer data to promote associated sellers. Keeping the two distinct should also enable consumer authorities to determine more readily whether the specific consent required by Rule 5(6)(b) was obtained.

PRACTICAL IMPLICATIONS AND COMPLIANCE FOR BUSINESS

• Audit data flows, algorithms and business processes to ensure that marketplace data is not used to benefit private labels or sellers sharing a brand or name.

• Treat Rule 5(6)(b) as an obligation additional to the DPDP Act; general data- processing consent will not by itself be sufficient.

• Map consumer-data flows and implement a separate, purpose-specific and auditable consent mechanism for promoting associated sellers.

• Define clearly where the DPDP consent framework ends and the Rule 5(6) regime begins, avoiding both duplicate notices and compliance gaps.

SEARCH & RANKING MECHANISMS

Amended Rule 3(1)(j) defines “ranking” broadly as the relative prominence given to sellers, goods or services on a platform, regardless of the technology used. The definition captures both direct and programmatic advertising, including AI-driven recommendation engines. Rule 4(11)(c) prohibits e-commerce entities from manipulating search results or indexes in a manner that misleads consumers about their queries. Although its precise reach remains uncertain, the provision may enter the debate on brand-keyword bidding, where a competitor purchases another company’s brand or trademark as a keyword so that its advertisement appears in response to a search for that brand. Traditionally examined through trademark law 2and safe harbor under IT laws, the practice may now also attract scrutiny where a sponsored result displaces or obscures the product the consumer intended to find.

Rule 4(12) further requires online advertisements to be clearly and prominently identified. Paid placements must therefore be distinguishable from organic listings. Platforms that elevate private labels in search results without identifying the placement as advertising will need to revisit that practice. The disclosure allows consumers to see when commercial considerations, rather than organic relevance, influence a product’s ranking. Rule 5(3)(f) requires e-commerce entities to disclose, in plain language and descending order of importance, the principal parameters that determine the ranking of goods and sellers. The obligation is limited to the main parameters; it should not require disclosure of algorithms or information that could enable third parties to manipulate rankings. The CCI made similar recommendations in its market study on e-commerce in India. Rule 5(3)(f), however, applies to all e-commerce entities.

PRACTICAL IMPLICATIONS AND COMPLIANCE FOR BUSINESS

• Audit ranking systems, sponsored placements and advertisements displayed in response to brand-specific searches.

  
  

• Clearly distinguish sponsored content from organic listings across the platform.

  
  

• Adopt a plain-language ranking policy that identifies the principal factors influencing visibility, in descending order of importance.

PRICING PRACTICES

Rule 4(13) requires a platform or seller announcing a price reduction to display both the discounted price and the “prior price”—the lowest price charged during the preceding 30 days. Amended Rule 5(7) also prohibits marketplace e-commerce entities from bundling fees for services unrelated to the underlying transaction, except fees connected with a loyalty or membership programme. The provision targets unwanted subscriptions and charges that surface only during checkout.

PRACTICAL IMPLICATIONS AND COMPLIANCE FOR BUSINESS

• Build a reliable price-history system so that every advertised discount is accompanied by the required prior-price disclosure. 

• Redesign fee structures and checkout flows to remove unrelated charges outside the loyalty or membership context.

MANDATORY COMPLIANCE WITH THE GUIDELINES AGAINST DARK PATTERNS

Rule 4(15) makes compliance with the Guidelines for Prevention and Regulation of Dark Patterns, 2023 (“2023 Guidelines”) binding under the E-Commerce Rules. The Guidelines are no longer merely a reference point : e-commerce entities must comply with them and conduct an annual audit to confirm that their platforms are free from dark patterns. This materially strengthens the enforcement framework.

PRACTICAL IMPLICATIONS AND COMPLIANCE FOR BUSINESS

Treat any breach of the 2023 Guidelines as a breach of the E-Commerce Rules, potentially attracting enforcement by the Central Consumer Protection Authority. Establish a recurring, documented annual review covering checkout journeys, urgency and discount messaging, pre-ticked boxes and other interface choices capable of distorting consumer choice. Prominently display the required compliance certificate, turning internal compliance into a visible representation to consumers. Review consent journeys for the intersection of dark patterns and data privacy. Pre - ticked opt-ins, asymmetric accept-and-decline choices and consent bundled with unrelated terms may invalidate an otherwise compliant Rule 5(6) process and separately breach Rule 4(15).

CONCLUSIONS

The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 mark a decisive shift from disclosure-based compliance to active platform governance. Compliance can no longer sit with the legal function alone: it requires coordinated changes to data architecture, consent management, pricing systems, seller disclosures, advertising practices, grievance redressal, interface design, and the governance of search and ranking models. Before January 1, 2027, platforms should map data flows, test ranking outcomes, document the principal parameters influencing visibility, distinguish sponsored placements, review consumer journeys for dark patterns, and assign clear accountability across legal, technology, product, marketing and customer-support teams.

Crucially, the time has passed when a business could treat “the algorithm produced this result” as a sufficient defence. As recommendation engines and ranking systems become increasingly AI-led, businesses must identify, test, document and mitigate risks arising from their design, training data, objectives and deployment. Former U.S. Federal Trade Commissioner Maureen Ohlhausen captured the point succinctly: “If the word ‘algorithm’ can be replaced by the phrase ‘a guy named Bob,’ then algorithms can be dealt with in the same way as traditional agreements.” Although made in an antitrust context, the logic applies equally here. Automated decision-making does not dilute accountability; it makes governance, explainability, auditability and human oversight more important.

Please feel free to reach out to our Team to discuss any of the Technology Law, Competition Law, International Trade and Policy Issues.