Personal data protection in e-commerce platforms: Legal challenges, regulatory frameworks, and the path toward digital consumer trust

The proliferation of e-commerce platforms has fundamentally transformed how individuals engage in commercial transactions, generating immense volumes of personal data in the process. While this digital shift offers considerable economic benefits, it simultaneously exposes consumers to escalating risks of data misuse, unauthorized access, and identity theft. This article examines the legal and regulatory landscape governing personal data protection within e-commerce environments, drawing upon a qualitative literature review methodology. The study traces the evolution of global data protection frameworks—most notably the European Union's General Data Protection Regulation (GDPR)—and situates Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) within this international context. Key findings indicate that while comprehensive legislation has been enacted in many jurisdictions, enforcement gaps, low organizational compliance, and technological complexity continue to undermine consumer data security. Empirical evidence from major data breaches between 2018 and 2024 illustrates the severity and frequency of vulnerabilities inherent in e-commerce ecosystems. Expert commentary and scholarly analysis further underscore the need for harmonized, principle-based regulation supported by robust institutional architecture. This article argues that effective personal data protection in e-commerce requires not merely legislative enactment but a sustained commitment to enforcement, digital literacy, and cross-border regulatory cooperation. Recommendations are directed at policymakers, platform operators, and legal scholars engaged in the evolving field of digital consumer rights.