Jaipur, a Wednesday evening call. The owner of a jewellery store that sells on its own website and on two marketplaces wants to know if his abandoned-cart WhatsApp messages are “okay.” Sales from those messages are up 20 percent. He’s a little proud of it.
I asked one thing. “Did those customers ever say you could message them there?”
Long pause. “They gave us their number at checkout.”
Yes. For the order. That’s the catch with the DPDP Act for e-commerce businesses. A phone number given for one reason doesn’t quietly become a marketing list.
Why the DPDP Act for E-Commerce Businesses Hits Harder
An online store is basically a data machine. Names, addresses, phone numbers, email IDs, payment details, browsing habits, wishlists, return reasons, even photos in product reviews. Most of it collected in a few clicks, from people who just wanted a pair of earrings.
More data means more places to slip. And e-commerce teams move fast. Marketing adds a pixel on Monday, a new app arrives on Tuesday, and nobody updates the privacy notice for six months.
Checkout Is Where Consent Starts
The checkout page is your busiest consent moment, and usually the sloppiest one.
Take the common trick of a pre-ticked box that says “Send me offers and updates.” That’s not real consent. Consent has to be a clear, active yes, for a specific purpose. Delivery updates are one purpose. Promotions are another. Mix them together and you’ve got a problem.
Keep the order data separate from the marketing permission. Let people say yes to one and no to the other. It costs you a few opt-ins and saves you a compliance headache. For the full picture of what a valid yes looks like, read our post on consent withdrawal under the DPDP Act, because the way out has to be as easy as the way in.
The Usual Trouble Spots
Abandoned-cart messages. Back to Jaipur. If the customer never agreed to marketing messages, those reminders need a proper basis. Check it before you scale it.
Retargeting pixels. The Meta pixel and Google tags follow people around the internet. They need disclosure and, in most cases, a proper cookie choice. We covered what a compliant banner looks like in cookie consent under the DPDP Act.
Payment data. Don’t store card details yourself unless you absolutely must. Let your payment gateway handle it. Fewer copies, fewer problems.
Delivery partners. Your courier sees names, addresses and phone numbers. That makes them someone handling data on your behalf, and that needs a contract. Here’s the simple breakdown of data fiduciary vs data processor if you’re not sure who’s who.
Marketplaces. Selling on a big platform doesn’t remove your duties. Once an order reaches you, the customer’s details are with you, and you handle them with care.
Reviews and photos. A customer posts a photo wearing your product. Face included. Get permission before you reuse it in your ads.
Old customer data. Three-year-old order sheets sitting in someone’s email. Delete what you don’t need. See our guide on data retention under the DPDP Act for how long is too long.
Don’t Forget Customer Requests
Customers can ask what data you hold, ask for corrections, ask you to delete it, or take back their consent. That’s their right. Somebody on your team needs to own those requests, and a customer should know where to send them.
A grievance contact on the website isn’t decoration. If you haven’t set one up, our post on the Grievance Officer under the DPDP Act tells you what’s needed.
A Quick Store Audit
Grab your own website and go shopping on it. Add something to the cart, abandon it, and see what arrives. Check the checkout boxes. Look at what loads before you click anything on the cookie banner. Read your own privacy notice and ask whether it still matches what you do.
You’ll probably find three or four things in ten minutes. That’s normal. It’s also why it’s better you find them than a customer or a regulator.
Read the Source
Check the Act and the rules yourself on the Ministry of Electronics and Information Technology website. Rules get updated, so look at the latest version before you change your store.
Fix It Before It Fixes You
The Jaipur owner kept his cart reminders. He just added a clear opt-in at checkout first. His list got a bit smaller. It also got a lot safer, and the customers on it actually wanted to hear from him.
If you run an online store and aren’t sure where you stand, book a free consultation. We’ll walk through your checkout and your tools together.
lit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.