DPDPA for D2C Brands and E-commerce Businesses
D2C brands run on customer data: checkout details, remarketing audiences, WhatsApp lists, analytics tools, loyalty signals, and behavioural targeting. Under DPDPA, the biggest problems usually show up in bundled consent, undisclosed tracking, sloppy opt-ins, and indefinite retention. This guide shows D2C teams how to keep growth systems running without turning the customer funnel into a compliance minefield.
If checkout consent is doing three jobs at once, it is probably doing all three badly.
Marketing Consent at Checkout
Critical RiskMost D2C checkouts bundle marketing consent with purchase acceptance — pre-ticked boxes or embedded T&Cs. This is non-compliant under DPDPA.
Action: Redesign checkout to include separate, unchecked consent boxes for email, SMS, and WhatsApp marketing. Separate from order processing.
WhatsApp and SMS Campaigns
High RiskWhatsApp Business API campaigns require documented opt-in. Sending marketing messages to customers who only gave transactional consent is a violation.
Action: Audit your WhatsApp subscriber list. Run a re-consent campaign for existing subscribers. Implement separate opt-in at checkout for WhatsApp.
Third-Party Analytics and Pixels
High RiskMeta Pixel, Google Analytics, Clevertap, and similar tools process customer personal data. They must be disclosed in your Privacy Notice.
Action: Update your Privacy Notice to list all tracking tools. Consider a cookie/tracking consent banner if you use non-essential tracking.
Customer Data Retention
Medium RiskHolding personal data of customers who haven't purchased in 2+ years without a purpose creates unnecessary risk and clutter.
Action: Define a retention policy: e.g., active customers indefinitely (with consent); inactive for 12 months post-last-purchase with a notice.
Loyalty and Personalisation Data
Medium RiskRich behavioural profiling for personalisation must be disclosed at the point of data collection.
Action: Update your Privacy Notice to describe your personalisation and loyalty data use. Obtain consent where profiling is significant.
Related Briefings
Last reviewed: March 2026
Legal baseline: DPDP Rules, 2025 notified on 14 November 2025, with phased commencement.
This page is for educational purposes and does not constitute legal advice.