Archive · 19 Nov 2025
India's New Data Rules Bolster Privacy, Impact E-commerce
India's new data privacy rules make it harder for e-commerce and food delivery apps to trick people into sharing more data than they want.
They have to make it easy to stop sharing data and delete old data.
This could change how these apps work and might affect ad revenues.
Companies have 18 months to adjust to these new rules.
India's Digital Personal Data Protection (DPDP) Rules notified on 14 November 2023
Rules target 'dark patterns' and require easy consent withdrawal, inactive data deletion
E-commerce platforms must rewrite data collection and usage practices
New rules impact data sharing, storage, and use, potentially affecting ad revenues
Companies have 18 months to comply and build compliance systems
- Who
- E-commerce, ride-hailing, food delivery apps, and consumers
- What
- Affected by new data privacy rules
- When
- Rules notified on 14 November 2023, compliance required within 18 months
- Where
- India
- Why
- To protect user data and prevent manipulative practices
Consumer Advocates
E-commerce Platforms
Data Collection
Consumer Advocates
Should be minimal, specific, and consent-driven
E-commerce Platforms
May need to collect more data for services, fear impact on ad revenues
- Dark Patterns
- Manipulative interface designs to influence user data sharing
- New Rule Impact
- Makes consent withdrawal easy, deletes inactive user data, impacts data sharing and storage
- E-commerce Affected
- E-commerce, quick-commerce, food-delivery, and app taxis
- Compliance Deadline
- 18 months from notification
- Penalties
- Fines and regulatory action for non-compliance
Sources
Mint Explainer | How data privacy rules may tighten screws on dark patterns in e-commerce, food delivery apps
Complying with India’s personal data protection law is easy: Businesses have no excuse not to
New data era
DPDP Act rules tighten data norms for retail firms
As Rs 250cr penalties loom, brands race to rebuild consent and compliance
