From consumer consent to competition control: The vires of Rule 5(6)

The Consumer Protection (E-Commerce) (Amendment) Rules, 2026, notified on September 9, 2026 under Section 101(2)(zg) of the Consumer Protection Act, 2019, contain a provision that deserves closer scrutiny than its privacy-facing language suggests.

Rule 5(6), which takes effect on January 1, 2027, provides that no marketplace e-commerce entity shall use information collected by it:

- first, for the sale of goods, directly or indirectly, by any seller, whether related or not, bearing a brand or name common with that of the marketplace or

- second, to promote or advertise any seller as being associated with the marketplace, unless express and affirmative consent for such use has been obtained from the consumer concerned.

The provision speaks the language of consent, but the conduct it regulates has an obvious competition dimension as regards a marketplace using what it knows about consumers to advantage a connected seller over others on the same platform. The question this raises is not whether such conduct should be regulated, but whether the Consumer Protection Act authorises the Central government to regulate it through delegated legislation.

Even the reach of the consent clause is contested. The words “unless … consent” sit within the second limb and some practitioners read the first limb as an outright prohibition that consent cannot unlock, while the government’s press release and other commentary describe the consent requirement more broadly. On the narrower reading, the first limb applies whatever the consumer wants and a restriction that no consumer choice can lift is hard to explain as a measure protecting consumer choice.

Closely related conduct is already before the Competition Commission of India (CCI). In January 2020, in Case No. 40/2019, the CCI directed an investigation into Amazon and Flipkart on information concerning the online sale of smartphones, identifying four practices - the exclusive launch of mobile phones, preferred sellers, deep discounting and preferential listing or promotion of private labels. Its prima facie concern was framed under Section 3(1) read with Section 3(4) of the Competition Act, 2002.

The probe has been in litigation for most of its life. A single judge of the Karnataka High Court dismissed the platforms’ writ petitions on June 11, 2021, a Division Bench dismissed their appeals on July 23, 2021 and on August 9, 2021, the Supreme Court declined to interfere. The Director General’s investigation reportedly found preferential treatment of select sellers. Sellers’ challenges in several High Courts were then transferred by the Supreme Court to the Karnataka High Court on January 6, 2025. No final order of the Commission appears to have been reported.

The point is not that these proceedings establish liability they do not. The reason why is because such behaviour fits in well with what Rule 5(6) aims to combat and how competition law deals with this issue in an entirely different way. In a Section 3 case, it depends on whether an agreement leads to an adverse impact on competition while in a Section 4 case, it relies on the issue of dominance and abuse of that dominant position. This does not apply to Rule 5(6), which just requires the information use and lack of consent in the latter case.

There is a serious case for the Rule. Consumer information is not commercially neutral and using it to steer consumers towards a platform-connected seller, without their understanding how, is a plausible consumer harm. The government’s textual case is also respectable. Section 2(47) defines an unfair trade practice as one that adopts “any unfair method or unfair or deceptive practice” for the purpose of promoting the sale or supply of goods or services, followed by an inclusive list of examples. Section 2(47)(ix) already covers the disclosure to another person of personal information given in confidence by the consumer. Section 94 empowers the Central government to take measures to prevent unfair trade practices in e-commerce “and also to protect the interest and rights of consumers”. The Rule, it would be said, simply carries this logic into the digital marketplace.

The difficulty, therefore, is not with the objective. It is with statutory fit.

Section 101(2)(zg) permits rules on the measures to be taken to prevent unfair trade practices in e-commerce under Section 94. How far that power reaches may differ between the two limbs. The second limb, which concerns presenting a seller as associated with the marketplace, has a genuine consumer-facing element. The first limb, a restriction on using information for the sale of goods bearing a brand or name common with the marketplace’s, is where the competition character of the rule is most pronounced and where the vires question bites hardest. Neither limb makes deception or misrepresentation a condition of breach a consumer who knows exactly whom she is buying from, and is satisfied with the purchase, does not by that fact prevent a violation.

Section 2(47)(ix) does not close the gap. It concerns disclosure, to another person, of information given in confidence. Rule 5(6) governs the marketplace’s own use of any information “collected by it”, which can include browsing and purchase data the consumer never consciously confided and its first limb is framed around sales rather than disclosure. The practices listed in Section 2(47), such as false representations, bait advertising, spurious goods and refusal to take back defective goods, cluster around the trader’s dealings with the consumer. This disadvantage that the first limb aims to address applies more particularly to rival sellers. This is clear when one looks at the 2026 amendments the provisions concerning search rankings, sponsored results and previous prices apply to what the consumer sees at the point of purchase, whereas Rule 5(6) applies to what the marketplace does with what it knows.

None of this makes the rule necessarily ultra vires. Subordinate legislation is presumed valid and the burden lies on the challenger. But it may be struck down for failing to conform to the parent statute or for exceeding the authority conferred and courts examine the nature, object and scheme of the enabling Act in deciding this. A laudable objective cannot cure an excess of power.

In Kerala Samsthana Chethu Thozhilali Union v. State of Kerala, the Supreme Court struck down rules requiring toddy shops to employ former arrack workers, holding that the rule-making power under the Abkari Act did not extend to such a welfare measure. The crucial issue becomes one of characterisation. Is Rule 5(6) a consumer-protection rule that happens to implicate competition, or is it a rule regarding competitive activity, masquerading as a consumer-protection rule? Although the “pith and substance” approach, evolved in the context of legislative jurisdictional questions, is not yet a well-settled approach to delegated legislation, the point behind the principle is clear enough: courts examine what a rule does, not what it calls itself.

Indian law has generally treated regulatory overlap as a matter of coordination. In Competition Commission of India v. Bharti Airtel Ltd, a telecom dispute, the Supreme Court held that jurisdictional facts within TRAI’s domain had to be determined by TRAI before the CCI could proceed, without ousting the CCI’s jurisdiction altogether. Section 21 of the Competition Act allows a statutory authority to refer competition issues to the CCI and Section 62 makes the Act operate in addition to other laws. Section 62 explains why valid regimes can coexist; it does not show that every rule made under another statute is authorised by that statute. If the Central Consumer Protection Authority (CCPA) were to enforce Rule 5(6) against conduct also before the CCI, inconsistent outcomes on the same facts would be a real possibility.

Data protection adds a third regime. The Digital Personal Data Protection Act, 2023 requires consent to be free, specific, informed, unconditional and unambiguous, but its core consent obligations commence only in May 2027 and it covers personal data alone. The government can, therefore, present Rule 5(6) as filling a gap. That explains the consent mechanism in the second limb better than it explains the first; a ban on using information for the sale of common-brand goods does not fill a data-protection gap. The boundary is already contested elsewhere. In November 2024, the CCI held that WhatsApp’s 2021 privacy policy, which made data sharing with Meta group companies a condition of continued use, was an abuse of dominance. In November 2025, the NCLAT upheld the ₹213.14 crore penalty but set aside the five-year ban on data sharing for advertising.

The policy record points the same way. The Parliamentary Standing Committee on Finance, in its 53rd Report of December 2022, identified self-preferencing and data usage among the anti-competitive practices warranting ex ante regulation. The draft Digital Competition Bill, 2024 proposed barring systemically significant digital enterprises from self-preferencing and from using non-public data of business users to compete with them. It has not been enacted. Article 6(2) of the European Union’s Digital Markets Act imposes a comparable prohibition on gatekeepers. In India, the June 2021 draft amendments to the E-Commerce Rules had already proposed restricting marketplaces’ use of collected information for the benefit of goods bearing a brand or name common with the marketplace’s. In each of these, the conduct is approached through competition-law instruments, with thresholds, market analysis and expert enforcement. Rule 5(6) reaches a similar result through consumer-protection rule-making, without any of those preconditions.

A challenge would not ask whether data-driven self-preferencing is harmful or whether consent is desirable; those are policy questions. It would ask whether Section 101(2)(zg), read with Section 94, authorises this particular restriction. The Rule may survive if it is seen as protecting consumers against unfair practices and the Government will rely on Sections 2(47) and 94 to say so. It may struggle if a court concludes that consent is being used as the trigger for regulating conduct whose essential character is competitive advantage between sellers, a difficulty that would be sharpest for the first limb if consent plays no role there.

Before January 1, 2027, the useful debate is not whether consent is a good thing or whether competition law should give way to consumer law. It is whether the statutory scheme has been followed. A rule formulated under consumer protection laws needs to have something to do with consumer protection. If, in fact, its real purpose is regulation of competition, it cannot be evaded simply by having “consent” as its focus.

Varun Pathak is a Partner at Shardul Amarchand Mangaldas & Co.

Bijendra Shandilya is a final-year law student at Indian Institute of Management, Rohtak (IIM-R).