Introduction
The Department of Consumer Affairs, Ministry of Consumer Affairs, Food and Public Distribution, notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 on 9 September 2026, amending the Consumer Protection (E-Commerce) Rules, 2020 framed under the Consumer Protection Act, 2019. The amendment, which comes into force on 1 January 2027, is the most significant recalibration of India’s e-commerce regulatory framework since the original Rules were notified, tightening requirements around pricing, search rankings, dark patterns and seller disclosures, while also introducing a distinct, sector-specific consent requirement for the use of consumer information that platforms will need to read alongside their existing obligations under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
Price Disclosure and Search Ranking Transparency
Where an e-commerce entity advertises a price reduction, the amended Rules require both the reduced price and the prior price to be displayed, with the prior price defined as the lowest price at which the product was offered in the preceding 30 days, closing off the practice of inflating a reference price shortly before a ‘sale’. The definition of ‘ranking’ under Rule 3(1)(j) has also been substituted to cover the relative prominence given to sellers or to goods and services on a platform, however that prominence is technically achieved, which brings algorithmic and AI-driven ranking mechanisms squarely within scope. Sponsored listings must be clearly labelled as such, addressing a long-standing consumer concern that promoted results are not always distinguishable from organic search results.
Regulation of Dark Patterns
The amendment formally integrates the Guidelines for Prevention and Regulation of Dark Patterns, 2023 into the binding Rules framework, requiring e-commerce entities to conduct an annual self-audit for compliance with those Guidelines and to prominently display a compliance certificate on their platform. This shifts dark-pattern compliance from a set of persuasive guidelines into a recurring, auditable and publicly verifiable obligation, meaning platforms will need a documented basis for that annual certificate rather than an informal internal review.
Seller and Product Disclosure Obligations
Amended Rule 6(5)(d) requires sellers to disclose a fuller set of product and transaction details, including country of origin, best-before or use-before dates where applicable, return, refund and exchange policies, warranties and guarantees, delivery and shipment details, return shipping costs, and accepted payment methods. A newly inserted Rule 6(5)(j) additionally requires disclosure of identification numbers issued by the Central Government, such as a seller’s GST Identification Number, and importer details and country of origin must be disclosed for imported goods. Taken together, these provisions push marketplace entities to build stronger seller-onboarding and listing-verification processes, since the obligation to disclose accurate information sits with the platform’s own compliance framework, not merely with individual sellers.
Grievance Redressal and the National Consumer Helpline Integration
The amended Rules tighten grievance-handling timelines, requiring acknowledgment of a complaint within 48 hours and resolution within 30 days, and require that a complainant be given a copy of the complaint as recorded by the entity’s grievance officer. E-commerce entities are also required to become partners in the convergence process of the National Consumer Helpline, integrating platform-level grievance handling with the national consumer redressal system rather than allowing it to remain a purely internal process.
Consumer Data Consent Requirements and Their Interface with the DPDP Act
The amendment’s treatment of consumer data introduces a further point platform will need to manage carefully. Under the amended Rules, a marketplace e-commerce entity cannot use consumer information for specified purposes, such as promoting goods sold under a brand or name common with the marketplace entity’s own, or advertising a seller as being associated with the marketplace entity, without first obtaining the consumer’s express and affirmative consent for that specific use. This is a narrower, purpose-specific consent requirement than the general consent architecture under the DPDP Act and the DPDP Rules, 2025, which already govern notice, consent and purpose limitation for the processing of personal data more broadly.
For platforms, this means two consent frameworks now operate side by side rather than one replacing the other: a general DPDP-compliant consent basis for processing personal data as such, and a specific, additional consent requirement under the E-Commerce Rules before consumer information can be used for these particular commercial purposes, such as cross-promoting a platform’s own-label products or implying a seller affiliation. A consent flow that is valid for general data processing under the DPDP Act will not automatically satisfy this narrower requirement, and platforms that operate both a marketplace and their own private-label brands, a common structure in Indian e-commerce, are likely to find this provision particularly relevant to how they use browsing and purchase data internally.
AMLEGALS Remarks
With the amended Rules taking effect from 1 January 2027, e-commerce entities have a defined runway to align pricing displays, ranking disclosures, sponsored-listing labelling and seller onboarding workflows with the new requirements, and to put in place the annual dark-pattern self-audit and compliance certificate well before the deadline rather than as a last-minute exercise. Grievance-handling systems should also be reviewed now against the 48-hour acknowledgment and 30-day resolution timelines, and platforms should confirm what NCH convergence will require of their existing complaint-management systems.
On the data side, platforms should map, specifically, which internal uses of consumer information, such as cross-promotion of own-brand products or implying seller affiliation, would trigger the E-Commerce Rules’ purpose-specific consent requirement, and build a consent capture mechanism for those uses that is separate from, and does not simply rely on, the platform’s general DPDP Act consent flow. Treating the two consent regimes as one, rather than mapping them separately, is the most likely source of an inadvertent gap once the amended Rules come into force.
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com or Khilansha.mukhija@amlegals.com