Your funnel runs on consent.The Act just redefined consent.

Every pixel, every retargeting list, every abandoned-cart message is now a question about purpose.

In one line: Generally yes. Consent must be specific to a purpose. Processing an order and sending marketing are different purposes, so marketing typically requires its own consent that can be refused and withdrawn.

The estate · E-commerce & D2CHover to inspect

Abandoned cart. Abandoned consent.

The scene

A shopper bought one pair of shoes in 2022. Since then she has received four hundred messages across email, SMS and WhatsApp, been added to lookalike audiences on three ad platforms, and had her address shared with a delivery partner that later changed hands. She agreed to buy shoes.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Buying means agreeing to marketing. Purchase and marketing are separate purposes needing separate consent. Ask for marketing on its own, and accept no.
Pixels are just analytics. Pixels send personal data to third parties; that is processing on your behalf. Treat every pixel as a processor, with a contract.
Pre-selected boxes convert better. Consent needs a clear affirmative action; dark patterns are also regulated as unfair practices. Earn the yes. A trick is not consent.

Erasure clocks for large platforms

The DPDP Rules set a time limit for certain large e-commerce entities: personal data of users inactive for three years must be erased, after notice to the user. Size brings its own schedule.

The full E-commerce & D2C briefing

3 deep dives
Deep dive 01→

Forty pixels on checkout. Forty processors without paper.

You installed a snippet. You appointed a processor.
Deep dive 02→

A trick is not an agreement.

If the customer had to be fooled into yes, you do not have a yes.
Deep dive 03→

Inactive is not a retention strategy.

The customer left. The data should follow.

Monday morning

  1. 01Export your tag manager. Count the pixels.
  2. 02Separate transactional messaging from marketing, in systems and in consent.
  3. 03Remove one pre-selected box this week.

Questions, answered plainly

Do e-commerce companies need separate consent for marketing under DPDPA?

Generally yes. Consent must be specific to a purpose. Processing an order and sending marketing are different purposes, so marketing typically requires its own consent that can be refused and withdrawn.

What is the three-year erasure rule in the DPDP Rules?

The Rules require certain classes of large Data Fiduciaries, including e-commerce entities above a user threshold, to erase personal data of users who have not engaged for three years, after notifying them in advance.

Sector · SaaS & IT servicesYou think you're the processor. Your contract may disagree.Read → Sector · TelecomA billion subscribers. A billion Data Principals.Read → Sector · InsuranceYour agent's phone is part of your data estate.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner