Do personal data rules apply to an online marketplace?
Short answer
Yes. A marketplace holds buyer and seller records in its own right, so it is a controller for those records under the GDPR and a handler under PIPL, in addition to whatever the seller holds.
Read against the registers 2026-08-26.
Who the role is
A platform where a third party sells to a buyer: the platform carries duties of its own, next to the seller's.
What the topic covers
The three main personal data regimes cover the same records but start from different premises. The GDPR asks for a legal basis before processing. California gives the consumer rights after the fact. PIPL asks for separate consent for named categories.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Requires a legal basis per purpose, information to the person, and rights of access, correction and erasure.
- ePrivacy Directive — Directive 2002/58/EC: Covers terminal equipment: cookies and similar reading of a device need consent unless strictly necessary.
United States
- California Consumer Privacy Act, as amended by the CPRA: Applies above stated thresholds. Consumers can know, delete, correct and opt out of sale or sharing.
- FTC Act Section 5, unfair or deceptive practices in AI and data: Data claims in a privacy notice are enforceable as representations under Section 5.
China
- Personal Information Protection Law of the People's Republic of China: Requires a lawful ground, separate consent for sensitive categories and a named person responsible.
Where companies usually start
- List the purposes first, then the data each purpose needs, and not the other way round.
- Check which of the three regimes the same record falls under at the same time.
- Keep one written record of purposes that all three notices are generated from.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for online marketplace
- Do ai governance rules apply to an online marketplace?
- Do cross-border data rules apply to an online marketplace?
- Do cybersecurity rules apply to an online marketplace?
- Do health data rules apply to an online marketplace?
- Do online platforms rules apply to an online marketplace?
- Do consumer rights rules apply to an online marketplace?
- Do product safety rules apply to an online marketplace?
- Do climate disclosure rules apply to an online marketplace?
- Do export controls rules apply to an online marketplace?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
