Mobile Optimization For Ecommerce Websites

Is your team's WhatsApp group a compliance liability under the DPDP Act, 2023? If your organisation uses messaging apps for customer service, marketing broadcasts, partner groups, or team coordination, here is what many teams miss: the DPDP framework does not exempt business chat merely because it happens on a messaging app. And where consent is the basis, consent-after-access can create Section 5(1) risk. This guide breaks down 12 operational rules, grounded in the Act and Rules, for using WhatsApp and similar platforms with lower risk of breach notification triggers, consent-flow defects, and grievance handling issues. What's inside: • Traffic-light risk framework (green / amber / red use cases) • Consent flow that precedes access, not follows it • Compliant first-message templates with statutory grounding • Breach playbook with 72-hour Board notification timeline • Retention, erasure, and rights-request workflows • 12 rules covering policy, notice design, group structure, and lawful basis Who this is for: General Counsels, DPOs, CISOs, compliance teams, and founders running customer-facing or internal groups on messaging apps. Swipe through. Save. Share with your ops and customer service teams. The full 14-slide guide is attached as a native carousel — no links, no downloads, just the statutory framework translated into working practice. See pinned comment for statutory references and related guides. #DPDPAct #DataProtection #WhatsApp #ComplianceIndia #PrivacyLaw #MessagingApps #DPDP2023 #DataGovernance #InfoSec #LegalTech #DPDPActDecoded #DPDP #DPDPA

Miranda, Head of Growth at Runna (+1M app users): 'I was on a call chatting through different tax thresholds & I was like… This is just not the life I need to live.' Imagine you've built a super successful app like Runna (millions of runners from +180 countries, growing like crazy, just acquired by Strava)... Then, as their global user base exploded, they faced significant limitations with their app-store-only monetization strategy: - Customer acquisition was becoming costly - Attribution and measurement became very difficult - Waiting on App Store release cycles slowed them down In search of a better way forward, they landed on the Web2App approach: 'A lot of our marketing is app-focused, but we realized by adding web monetization we could reach an entirely new audience.' And like with most apps, Web2App solved these growth challenges (c. acquisition, attribution, speed)... But, it also introduced new, billing & tax compliance responsibilities: - Handling sales tax compliance (in 175 countries!) - Dealing with chargebacks - Processing refunds - Preventing payment fraud - Owning buyer support - Managing delinquent payments In this realm of billing & tax compliance, they had two options: 1. Go with a traditional payment processor, become responsible for all the above billing & tax compliance matters 2. Go with a Merchant of Record model, let Paddle handle all of the billing & tax compliance matters for them After a lengthy search, Runna chose Paddle as their web monetization partner, sold on the Merchant of Record (MoR) model. One joint Runna + Paddle team run & a week of implementation later, Runna team now doesn't have to worry about billing & tax compliance, but they've also seen: - 15% higher retention on the web - Faster pricing, onboarding & checkout experimentation - Unified data & support (w/ RevenueCat + Paddle integration) Best of all, the Merchant of Record model means Runna can focus entirely on product development and customer acquisition, on their mission to make running accessible and enjoyable for everyone. ...while Paddle handles all compliance, invoicing, and tax remittance across their +175 country footprint. Runna, thank you for this awesome partnership and giving us an excuse to make running dad jokes like 'run billing ops' & 'Runna now runs even MoR fast with Paddle'.

Children's information and sharing it is top of mind for regulators, as we have been telling our clients for a while, and as we saw yesterday in a new CA AG $500,000 settlement with Tilting Point Media LLC (Tilting Point) for #CCPA and #COPPA compliance issues in mobile app game “SpongeBob: Krusty Cook-Off.” Practice points: Directed at children: 🔹 If you are aware that children under 13 are using your services - they are is directed to children. Saying in your terms of service and privacy policy that consumers under 13 are not authorized to use it - doesn't change this. Regulator 1, 2, 3: 🔹 CA AG will use every enforcement tool to ensure compliance with the law and that companies exercise diligence with privacy law requirements 🔹 If one regulator tells you that you are not compliant (here BBB National Programs CARU): assess your compliance with other laws you could be enforced against by another regulator Data minimization: 🔹 Don't collect more personal information than reasonably necessary for a child to participate. Mind your SDKs: 🔹An SDK facilitates data sharing that can be a sale (CCPA) and/or unfair/deceptive (FTC) and/or subject to COPPA just like any data sharing. 🔹 You need to know: what information each SDK collects; evaluate contracts re: sharing of data through them - making sure you have the right consent. 🔹 You may need a formal SDK governance framework. 🔹 Every year: assess data minimization and SDK usage. (ensuring data flows appropriately change based on the consumer's age). 🔹 Every year: conduct adequate training for personnel re sharing and SDKs Sale/share: 🔹 Disclose your sale and share correctly in your privacy notice 🔹 Don't sell/share personal information of under 13's without parental consent 🔹When you do sell/share: provide a just-in-time notice explaining what information is collected, the purpose, sale/share, link to privacy policy, & parental or opt-in consent required. [FTC also says this in BetterHelp] Mixed audience 🔹When using an age screen it has to be neutral. 🔹Neutral means: (1) ask age information in a neutral manner that does not default to a set age of 16 or above or encourage users to falsify age information; (2) not suggest that certain features will not be available; and (3) provide CLEAR AND CONSPICUOUS notice that the age entered should be accurate to the user and is collected to ensure data use and advertising is appropriate. 🔹If the person is under 13 or 16 - direct them to a portion of the service that doesn't use data other than as permitted by COPPA/CCPA or get parental / opt in consent For ads in your apps, make sure they are: 🔹Identified as being an ad; 🔹Include a prominent one-click “X” or “Close” button; 🔹Do not manipulate or deceive consumers into engaging 🔹Do not advertise activities/products in which children cannot legally engage/possess. #dataprivacy #dataprotection #privacyFOMO Complaint: https://rb.gy/enu19e Agreement: https://rb.gy/jq6lke

New LAW - Made in China or India to be mention compulsory on E-Commerce and Quick Commerce Platforms! Country of Origin filter amended in to Legal Metrology Rules Mandates now .. As a legal expert specializing in consumer rights and regulatory compliance, I’m excited to share this latest development from the Ministry of Consumer Affairs. On February 13, 2026, the Government of India notified the Legal Metrology (Packaged Commodities) Amendment Rules, 2026, which introduce a crucial update to empower consumers in the digital marketplace. Key Highlight: Under the new sub-rule (10A) inserted in Rule 6 of the 2011 Rules, every e-commerce entity selling imported products MUST provide product listings with a searchable and sortable filter specifying the “Country of Origin” (COO). This means platforms like Amazon, Flipkart, and others will need to enable users to easily filter and sort imported goods based on their origin country. Effective Date: July 1, 2026. Why This Matters ? • Consumer Empowerment: Shoppers can now make informed choices, supporting ‘Make in India’ by easily identifying local vs. imported products. • Transparency Boost: This aligns with global best practices, reducing misleading claims and enhancing trust in online shopping. • Compliance Alert for Businesses: E-commerce players, importers, and sellers – time to audit your platforms! Non-compliance could lead to penalties under the Legal Metrology Act, 2009. This amendment is a step forward in protecting consumer interests amid the booming e-commerce Quick Commerce sector. #LegalMetrology #ECommerce #ConsumerRights #MakeInIndia #RegulatoryUpdate #IndiaBusiness #techlaw #technology Amazon Blinkit Instamart (Attachment: Gazette Notification for reference)

Three states just activated new privacy laws on January 1st. Indiana. Kentucky. Rhode Island. These laws extend frameworks pioneered in California and Virginia, but carry nuances that sellers need to understand. Most DTC brands aren't paying attention. Here's why you should: If you collect email addresses for abandoned cart emails, you're affected. If you run retargeting ads, you're affected. If you use send emails.. you're affected. Rhode Island's law has a broad definition of "sale" that encompasses not only direct monetary transactions but also data sharing with analytics and advertising services. Translation: Sending customer data to Facebook for lookalike audiences might legally count as "selling" their information. A supplement brand got hit with this in Kentucky: They were syncing customer emails to Meta for custom audiences. Under the new law, that's a "sale" of personal data. Now they're required to: - Disclose it in their privacy policy - Offer an opt-out - Maintain records of who opted out - Respond to deletion requests within 45 days They had none of this. They got a notice. They have 30 days to comply or face fines. The fix: Update your privacy policy NOW to include these states. Add an opt-out link in your footer. Audit every tool that touches customer data (Google Analytics, Segment, Klaviyo, TikTok Pixel). For B2B eCommerce operators, even procurement officer profiles on portals or analytics from support chatbots could trigger compliance requirements. This isn't just a B2C problem. If you sell anything and collect any personal data, you're in scope. Most brands will ignore this until they get a letter. Don't be most brands.

DRAFT DPDP RULES, 2025 - SECTOR-WISE IMPACT ANALYSIS - PART 2 – E-COMMERCE SECTOR The e-commerce industry, handling vast amounts of user data for various purposes such as transactions, marketing, and analytics, faces significant compliance responsibilities under the Draft Digital Personal Data Protection (DPDP) Rules, 2025. These rules aim to bolster consumer privacy and data security while ensuring transparency and accountability in data processing practices. ## Key Obligations for E-Commerce Platforms: # Significant Data Fiduciaries Obligations: * E-commerce platforms that process data of over 2 crore users are designated as Significant Data Fiduciaries. * These platforms are required to conduct regular Data Protection Impact Assessments (DPIAs) and data audits (as per Rule 12) to ensure compliance and mitigate risks associated with the processing of sensitive personal data. * Enhanced obligations include the transparency of algorithmic processes, ensuring they do not infringe on consumer rights, particularly around targeted advertising and data usage. # Child Data Restrictions: * E-commerce platforms must not profile or target children for advertising or data collection (as per Rule 11). * The platform will need robust mechanisms to identify and segregate children's data. * Parental consent must be obtained before processing personal data of minors, demanding additional infrastructure and verification systems. # Data Retention Policies: * Platforms are required to delete user data within three years after a user becomes inactive, unless a longer retention period is stipulated by law (as per the Third Schedule). * This is aimed at minimizing the retention of unnecessary data, reducing the risk of misuse. # Transparency and User Rights: * Users will have clear rights to access, correct, and delete their personal data under the DPDP Rules. * E-commerce platforms must develop systems that enable users to easily exercise these rights. Clear and explicit consent mechanisms will be mandatory for data collection and processing, requiring platforms to enhance their current data-gathering processes. In summary, the DPDP Rules require e-commerce businesses to implement stronger data protection practices, increasing both compliance costs and operational complexity, but also offering an opportunity to build greater consumer trust. ANB Legal Lara Borges Sejal Mehta

Does your organization’s mobile app have location-based services? If so, here’s four steps to take based on the FTC’s newest location #privacy enforcement actions.⬇️ The Federal Trade Commission recently announced resolution of two separate enforcement actions against location data brokers, Gravy Analytics and Mobilewalla, for allegedly obtaining and selling precise location data without opt-in consent. The FTC's decision to issue the complaints and consent decrees was 5-0 and 4-1 respectively, which may preview continued bipartisan interest in location data privacy issues under the new administration. The proposed consent decrees with Gravy Analytics and Mobilewalla include extensive requirements for robust #compliance programs, including for location data that may reveal additional sensitive characteristics, like a person visiting a medical facility, military building, union office, school, day care, or religious organization. Mobilewalla's also has unique requirements prohibiting retention of data received in real-time bidding exchanges (commonly used for #digitaladvertising).    How did they get the location data? Gravy Analytics--a B2B company--allegedly obtained location data from third-party partnerships, including consumer-facing mobile apps that it partnered with. Mobilewalla allegedly obtained location data from real-time bidding exchanges and data aggregators, which upstream likely included data obtained from mobile apps that processed location data.    If your organization has an #ios or #android #mobileapp with location-based features, or that otherwise processes precise geolocation data, these actions suggest some steps to take to help keep customer trust in your organization's data practices and to stay ahead of where enforcement could go in this space. Here are four steps to consider:   1️⃣ Get Consent. Look at the opt-in consent language used in your mobile app, and confirm it covers both your organization's use and any use by third parties your organization shares that data with. The FTC and state privacy laws will require opt-in consent for uses of precise geolocation data. 2️⃣Identify Sharing. Validate what vendors and third parties geolocation data is being shared with, and for what purposes.  3️⃣Limit Use. Confirm your organization has binding contractual commitments limiting how vendors and third parties are using and sharing data. If there are none, your organization may be "selling" this sensitive data; state privacy laws will require notice and opt-in or opt-out procedures for sensitive data sales. 4️⃣Diligence and Monitoring. Review vendor and third party diligence and monitoring approaches, and consider tailoring them for the data sale considerations these and other actions raise. For example, will the vendors or third parties your organization works with be re-selling the location data your organization shares, and do they have sensitive location compliance programs in place?

Does your company's app have a working opt-out of selling/sharing mechanism? If not, and your company is subject to the #CCPA and sells personal information or shares it for cross-context behavioral advertising, your company should implement a compliant mechanism as soon as possible. A recent CCPA enforcement action against a mobile game developer stresses the importance of getting compliance right in the mobile app context. The California AG just announced a $1.4 million settlement to resolve claims that the defendant failed to offer players of its popular mobile games a mechanism to opt out of the selling and sharing of their personal information for cross-context behavioral advertising. The AG also claimed that the defendant misconfigured its games' age gates, and failed to obtain opt-in consent to sell and share children's personal information, as required by law. Selling/sharing in the mobile context often happens as a result of SDK integrations and incorporating AdTech APIs. Additional requirements apply if you're selling/sharing sensitive data (e.g., health, precise geolocation, and children's data). Publicly reported CCPA enforcement actions have largely focused on websites, but this case demonstrates that mobile apps are on regulators' radars too. And the recent amendments to the CCPA regulations (many of which take effect on Jan 1, 2026) show that regulators are thinking about other types of online platforms, including virtual, mixed, and augmented reality devices. Whatever the user interface, double-check your compliance, because California privacy regulators are active.

Happy Monday everyone!I want to talk to you about something incredibly important—SMS compliance. It's not just a best practice; it's a necessity. If you're not compliant, you're at risk, especially with the rise of TCPA litigation. We've all heard about TCPA "litigator phishing," where bad actors bait eCommerce brands into costly lawsuits with frivolous claims. They bank on brands settling out of fear, and unfortunately, it often works. Most brands can't afford protracted lawsuits, so they settle to avoid "playing with fire," even if the lawsuit is ultimately baseless. At Yotpo, we do everything we can to protect our brands from such lawsuits: - 🔒 We enforce compliance language on all subscriber growth tools. - 🕵️ We conduct regular audits to ensure proper compliance and arbitration language is included in privacy policies and terms of service. - 🧹 We perform routine "litigator scrubs," cross-referencing subscriber lists against public court records to remove known TCPA litigators. - 📅 Our Smart Send and Quiet Hours safeguards help merchants avoid texting subscribers at impermissible times. - 🛡️ n the event of a lawsuit, we provide comprehensive data and expert guidance from our in-house legal team and external TCPA consultants. But we didn’t stop there. We've stepped up our game even more this quarter: 1. Toll Free Number (TFN) Verification ✅   In January, a new regulation limited the number of messages that can be sent by an unverified TFN. We partnered with Bandwidth to build an auto-verification API, expediting the TFN verification process and ensuring brands stay within compliance limits. 2. Consolidated Compliance Settings⚙️   We've centralized all compliance-related settings in our Compliance tab, making it easier for merchants to find and configure everything related to running a compliant program. 3. Call Forwarding 📞   Although not required by regulations, we've added call forwarding to address frivolous claims that brands are non-compliant because their phone number isn't callable. This feature redirects calls from a TFN to a US phone number chosen by the client, with added protections against bot attacks and robocalls. 4. Business Details Landing Page🌐   We've closed another compliance gap with our Business Details Landing Page. This feature allows merchants to add their business information to SMS messages, reducing legal risks in Canada, Australia, and New Zealand. 5. Enforced Quiet Hours🌙   We now enforce Quiet Hours for both campaigns and flows, ensuring merchants can't text subscribers during regulation-defined quiet hours. Looking ahead, we have even more exciting compliance features in the pipeline: - 🔄Strict Double Opt-In - 🧼 Litigator Scrub Option - 🛡️ Anti-Arbitration Language Guidance - 📰 Compliance Newsfeed - 📊 Reassigned Numbers Database Scrubbing - 📢 In-Product Notifications If you have any questions what all of this means comment here or CC Gabe or Iftach. Don't drop the ball here, its crucial

📕ICAI Releases "Handbook on E-Commerce Operators under GST" A timely guide for compliance in India’s growing digital economy In a significant step towards strengthening GST compliance in the rapidly evolving digital economy, the Institute of Chartered Accountants of India (ICAI) has released a comprehensive publication titled “Handbook on E-Commerce Operators under GST”. The handbook has been issued by the GST & Indirect Taxes Committee of ICAI and is updated up to 15 December 2025, ensuring alignment with the latest legal and procedural developments. 🌐Why this handbook matters? The e-commerce sector has emerged as a major growth engine under GST. However, its: 🔹Complex business models 🔹Multi-State operations 🔹Special charging provisions 🔹Frequent amendments and evolving jurisprudence have created practical compliance and interpretational challenges for businesses and professionals alike. 📚Key areas covered in the handbook: ➡️Definition and scope of e-commerce and e-commerce operators under GST ➡️Statutory framework governing e-commerce transactions ➡️Special provisions under Section 9(5) of the CGST Act dealing with deemed supplier liability ➡️Tax Collection at Source (TCS) mechanism and related compliances ➡️Registration requirements and return-filing obligations ➡️Disclosure and reporting in GST returns ➡️Recent amendments, notifications, circulars and judicial developments impacting the sector 🧩Practical insights & business models The publication explains prevalent e-commerce models, including: ✔️Marketplace model ✔️Inventory-based model ✔️Aggregator model and clearly outlines their distinct GST implications, with special emphasis on: 🔸invoicing responsibility 🔸tax payment obligations 🔸Input Tax Credit (ITC) treatment 🔸compliance and reporting requirements 🎯Who will benefit? This handbook serves as a ready reckoner for: 👨💼Chartered Accountants & tax professionals 🏢E-commerce operators & start-ups 📊Corporates & compliance teams 🏛️Regulators and policy stakeholders 🗣️ICAI reiterated its commitment to nation-building by equipping professionals and businesses with timely, structured and practical knowledge tools to navigate GST with confidence. #ICAI #GST #ECommerce #DigitalEconomy #IndirectTax #GSTCompliance #TaxProfessionals #Startups #EaseOfDoingBusiness #TCS #Section95 #ITC