A lot of Indian D2C brands sell through both a marketplace listing and their own Shopify store, and treat the two channels as roughly the same business with two storefronts. Under the DPDP Act, they are not the same exposure at all. Who sets up the consent and notice layer, and who is answerable for it, depends heavily on which channel a shopper came through.
The marketplace channel
When a shopper buys through a large marketplace, that platform typically runs its own account system, its own privacy notice, and often its own consent and preference layer covering how it collects and shares data across every seller on it. The seller is still a data fiduciary for whatever data actually reaches them, such as the shipping details needed to fulfil the order, but a meaningful share of the shopper-facing consent and disclosure work is already being carried by the marketplace's own infrastructure, because the marketplace is the one that owns the checkout, the account, and the customer relationship at the point of sale.
That does not make a marketplace seller automatically exempt from anything. It means the notice-and-consent surface a shopper actually sees, the banner, the privacy policy link, the preference centre, is substantially the marketplace's to build and maintain, not the seller's.
The direct Shopify channel
A direct Shopify store is a different arrangement entirely. The merchant owns the checkout, owns the customer account system if one exists, and chooses every third-party tool in the stack: the ad pixel, the email platform, the WhatsApp provider, the reviews app, the logistics integration. There is no marketplace sitting in front of the shopper absorbing the notice-and-consent obligation. The merchant is the data fiduciary and the merchant is also the one who has to build the privacy notice, put up the consent banner, and keep the record of what each shopper agreed to.
This is the practical difference that matters for exposure: on a marketplace, a seller inherits a consent layer someone else built. On a direct store, nobody else is building it. If the merchant does not set it up, it does not exist.
Why this catches brands off guard
Brands that started on a marketplace and later launched a Shopify store sometimes carry the marketplace mindset over, assuming the website will somehow be covered the same way the marketplace listing is. It will not be. A hypothetical example: a skincare brand that has sold on a large marketplace for two years and just launched its own Shopify store has, overnight, taken on the full notice-and-consent job that the marketplace had been quietly doing for it. The store's checkout, its Meta Pixel, its abandoned-cart WhatsApp flow, its reviews app, all of that is now the brand's own responsibility to disclose and manage, with no platform standing between the brand and the shopper.
The reverse mistake also happens: a founder who has done the work properly on their Shopify store sometimes assumes the same diligence automatically extends to their marketplace listings, when in fact the marketplace relationship runs on different terms entirely, set by the marketplace's own policies rather than the merchant's.
The practical takeaway
If your D2C business runs both channels, treat them as two separate exposure profiles rather than one brand with two shopfronts. The marketplace channel's consent layer belongs mostly to the marketplace. The direct Shopify channel's consent layer belongs entirely to you, because you are the one who installed every tool sending customer data out of it.
Consent Jet is built for that second channel specifically: it scans your own Shopify store's tools, builds the privacy notice and consent banner your direct storefront needs, and keeps the record of shopper consent that only you, not a marketplace, are in a position to maintain.