E-Commerce Law in India: Marketplace Liability and the IT Act

An online purchase is one click and five legal regimes: contract law through s.10A, intermediary law for the platform, consumer law for the buyer, payment law for the money, and data protection for everything typed in. The IT Act supplies the electronic foundations, and the recurring courtroom question is the platform's own liability, whether a marketplace is a mere intermediary for its sellers or an active trader answerable for counterfeits and deficiencies. Topics 45 and 46 built the contract layer; this note, as asked, covers the commerce: the models, the safe harbour line, the consumer and payment interfaces, and jurisdiction.

1. The Contract Layer

• Electronic contracts. s.10A validates contracts formed through electronic means; offer, acceptance, consideration and capacity stay with the Contract Act, and ss.11 to 13 attribute, acknowledge and time-stamp the communications (Topics 45, 47)
• Click-wrap and online terms. Assent by clicking I agree binds like any signature, subject to the ordinary policing of standard form terms: reasonable notice of onerous clauses, unconscionability doctrine for gross one-sidedness, and consumer law's list of unfair contract terms; browse-wrap, terms merely posted, binds only on proof of notice (Topic 45)
• The platform's terms. Seller agreements, user terms and privacy policies are the marketplace's private constitution, but the 2021 Rules and consumer law override them where they conflict with due diligence duties and consumer rights.

2. Marketplace, Inventory and the Safe Harbour Line

Figure 1: The two business models

• Marketplace as intermediary. A pure marketplace hosts sellers' listings and processes the transaction: for the listings it is an intermediary under s.2(1)(w) and claims s.79, and the FDI regime confines foreign-funded platforms to exactly this model, barring inventory ownership and equity-linked sellers.
• Inventory model. Where the entity owns the stock and sells it, there is no third-party information to be exempt for: it is the seller, with full contract, consumer and product liability.
• Active vs passive role. The safe harbour follows function, not the label: a platform that selects and promotes goods, warehouses and ships them, assures quality, brands the packaging and takes margins on the sale participates in the trade, and participation is where immunity ends.

Figure 2: Where immunity ends

• Counterfeits and trademark infringement by sellers. The seller is the primary infringer; the platform's exposure turns on the Louboutin analysis, with later marketplace litigation ordering seller disclosure, listing takedowns and certification of authenticity mechanisms.
• Copyright infringement by users. For user-uploaded content the MySpace line governs: specific, notice-based knowledge and expeditious removal, no general monitoring duty, s.79 read harmoniously with the Copyright Act notwithstanding the s.81 proviso (Topics 67, 90)
• Platform knowledge. Across both fields, knowledge means particularised knowledge of identified infringing material, court order, statutory notice or precise rights-holder complaint, not a general awareness that infringement happens on the platform.

3. The Consumer Law Interface

Figure 3: The five regimes on one sale

• The Consumer Protection Act, 2019. Brings e-commerce expressly within consumer law: unfair trade practices online, product liability, and the e-commerce entity within the definitions, with the Central Consumer Protection Authority's enforcement powers.
• The E-Commerce Rules, 2020. Duties on every e-commerce entity, country of origin and seller details displayed, no price manipulation, no misrepresentation of reviews, grievance officer with a one-month clock, and model-specific duties: marketplace entities take seller undertakings and display seller information, inventory entities answer for the goods themselves.
• Interface with s.79. Consumer law duties are the platform's own obligations, so s.79, which shields only third-party information liability, does not answer a consumer claim for the platform's own defaults, deficient service, unfair practice, breached disclosure duties, a distinction courts have repeatedly enforced.

4. Payments: Fraud, Gateways and Wallets

Figure 4: Who bears a fraudulent debit

• The payment stack. The Payment and Settlement Systems Act, 2007 and RBI's authorisations govern gateways, payment aggregators and prepaid instruments; aggregator guidelines impose capital, escrow and KYC disciplines, and wallet balances sit under the prepaid instrument master directions.
• Electronic payment fraud and limited liability. RBI's customer protection circulars allocate unauthorised transaction losses: zero customer liability where the fault is the bank's or the system's, or where a third-party fraud is reported within three working days; bounded liability on delayed reporting; and board policy beyond seven working days, with the burden of proving customer negligence on the bank.
• Gateway and platform exposure. Gateways and aggregators answer for their own security and settlement failures under the PSS Act and contract; the criminal track against the fraudster runs ss.66C, 66D and cheating, with the 1930 freeze machinery on the proceeds (Topics 85, 86)
• E-commerce privacy. Checkout data, cards, addresses, behaviour, sits today under s.43A and the SPDI Rules and migrates to the DPDP Act's consent and safeguard regime, with RBI's card-on-file tokenisation limiting what merchants may store at all (Topic 87)

5. Jurisdiction in E-Commerce Disputes

• Civil jurisdiction. The CPC places suit where the defendant resides or the cause of action arises; for online dealings the cause arises where the offer was accepted, payment made or goods delivered, and website interactivity alone does not found jurisdiction, courts requiring purposeful availment, commercial targeting of the forum, on the Banyan Tree line.
• Consumer fora. The 2019 Act lets the consumer sue where the complainant resides or works, a deliberate pro-consumer widening that makes the buyer's home district the usual e-commerce forum.
• Contract clauses and criminal jurisdiction. Exclusive jurisdiction clauses in platform terms bind within the settled limits, only a court otherwise competent can be chosen, and consumer fora have held such clauses ineffective against the statutory venue; on the criminal side, cheating and IT Act offences lie where any part of the transaction or its consequence occurred (Topic 86)

6. Frequently Asked Questions

When does an e-commerce platform lose the Section 79 safe harbour?

When its role stops being passive. Louboutin v. Nakul Bajaj holds that a platform which selects and promotes products, identifies with sellers, warehouses, ships, quality-certifies and profits from the sales participates in the trade and cannot claim the intermediary exemption for infringing goods. Safe harbour also falls on the general grounds: failed due diligence under the 2021 Rules, conspiracy or abetment, or failure to act on actual knowledge through a court or government order. And it never covered the platform's own obligations under consumer protection law.

Where can a consumer sue over an online purchase?

Under the Consumer Protection Act, 2019, before the consumer commission of the district where the consumer resides or personally works for gain, besides where the opposite party carries on business or the cause of action arose, so the buyer's own district is ordinarily available. Civil suits follow the CPC's cause-of-action rules with the purposeful availment gloss for online defendants, and exclusive jurisdiction clauses in platform terms cannot displace the consumer forum the statute provides.

7. Related Topics

• Topic 45: Section 10A and e-contracts. The contract layer in full.
• Topic 67: Section 79 and IP claims. The safe harbour doctrine this note applies to commerce.