Consumer Privacy and Data Protection in the Digital Marketplace: An International Perspective through the Lens of Indian Law

Abstract The digital marketplace has transformed commerce by enabling consumers to purchase goods and services, make digital payments, obtain credit, receive personalised recommendations and interact with online platforms across geographical boundaries. However, these benefits are accompanied by extensive collection, analysis, sharing and monetisation of consumer data. Personal information has become a commercial asset, while consumers frequently lack meaningful knowledge or control over how their data is used. This creates risks of surveillance, profiling, discrimination, identity theft, manipulation, data breaches and unfair commercial practices. In India, consumer privacy is constitutionally protected as part of the right to life and personal liberty under Article 21 of the Constitution. The Supreme Court’s decision in Justice K.S. Puttaswamy (Retd.) v. Union of India established privacy as a fundamental right connected with dignity, autonomy and decisional freedom. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) represents India’s principal statutory framework for digital personal data. It regulates Data Fiduciaries, recognises rights of Data Principals and introduces obligations relating to notice, consent, security safeguards, breach management and accountability. The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020 supplement this framework by addressing misleading representations, unfair trade practices, cancellation, refunds and platform responsibilities. This paper examines consumer privacy and data protection in digital marketplaces from an Indian law perspective, while comparing India’s approach with the European Union’s General Data Protection Regulation (“GDPR”), OECD privacy principles and international digital-market regulation. It argues that India’s legal framework is an important foundation but requires stronger consumer control, clearer rules on targeted advertising and profiling, independent regulatory capacity, effective remedies, algorithmic transparency and greater coordination between data protection and consumer-protection institutions.