Economics, Law and Policy ISSN 2576-2060 (Print) ISSN 2576-2052 (Online) Vol. 8, No. 1, 2025 www.scholink.org/ojs/index.php/elp 168 Original Paper Research on the Legal Protection of Consumers’ Personal Information in Online Shopping Xu Xinyi 1 1 Dalian Ocean University, Dalian City, Liaoning Province Received: April 28, 2025 Accepted: May 9, 2025 Online Published: May 10, 2025 doi:10.22158/elp.v8n1p168 URL: http://dx.doi.org/10.22158/elp.v8n1p168 Abstract In contemporary society, with the rapid development of the e-commerce economy, online shopping has become an essential part of people’s lives. Consumers’ personal information holds significant value, which leads to an increased risk of personal information leakage in online shopping. This paper clarifies the relevant concepts of consumers’ personal information in online shopping, analyzes the current protection situation, reveals a series of existing problems, and proposes corresponding improvement suggestions. The aim is to provide theoretical references for constructing a more sound legal protection system for consumers’ personal information in online shopping, making it more comprehensive and complete. Keywords Online Shopping, Consumers, Legal Protection, Personal Information Protection 1. General Theories on the Protection of Consumers’ Personal Information in Online Shopping 1.1 The Concept of Consumers’ Personal Information in Online Shopping In the specific context of online shopping, consumers’ personal information refers to various types of information provided by consumers to e-commerce platforms, merchants, and various third-party entities that support and serve online shopping during their participation in online shopping activities. These are recorded in electronic or other forms and can identify a specific consumer’s identity either alone or in combination with other information. This concept encompasses a wide range of contents, including but not limited to consumers’ names, genders, ages, ID numbers, home addresses, contact information (such as mobile phone numbers, email addresses), biometric information (fingerprints, facial recognition data, etc.), bank account information, consumption preferences, shopping history records, and browsing traces. www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 169 Published by SCHOLINK INC. 1.2 The Characteristics of Consumers’ Personal Information in Online Shopping In the special environment of online shopping, consumers’ personal information exhibits various characteristics. 1.2.1 Diversity In the transaction scenario of online shopping, with the continuous expansion of the user scale and the high-frequency occurrence of shopping activities, the quantity of consumers’ personal information has experienced explosive growth, forming a vast information set. E-commerce platforms process hundreds of millions of user transaction data daily, including a wide variety of information types, such as basic identity verification information, financial information, and information reflecting consumption behaviors and preferences. The diversity of this information reflects the all-round needs and behavior trajectories of consumers in the online shopping process and provides rich materials for e-commerce platforms and merchants to understand consumers in depth. 1.2.2 Easy Collection and Transmission In the digital age, online shopping platforms can easily collect personal information at every stage of consumers’ shopping through advanced information-technology-based acquisition means. When consumers register on a platform, basic information such as their names and phone numbers is already obtained by the platform. Moreover, once this information is collected, it can be rapidly transmitted over the Internet (Shen, X. J., 2022, pp. 148-150). Through network transmission, information can cross geographical boundaries and be shared and circulated among different servers, databases, and third-parties. Some e-commerce platforms share part of consumers’ personal information with cooperative advertisers or data-analysis companies for precise marketing, which significantly increases the risk of information leakage. 1.2.3 Property In the era of big data, consumers’ personal information has become a highly valuable asset (Chen, J. L., 2025, pp. 152-154). Information such as consumers’ purchase behaviors and preferences can assist merchants in analyzing consumers’ behaviors, enabling them to better understand consumer behavior and thus enhance sales and customer satisfaction. For example, online shopping platforms can accurately recommend products that consumers may be interested in based on their purchase history and browsing behaviors, promoting an increase in purchase volume. 1.3 The Difference between Personal Information and Consumers’ Personal Information in Online Shopping Personal information, as a broad concept, has a rich connotation. It includes various types of information generated by natural persons in daily life, work, social interaction, and other scenarios, which can identify their identities or reflect their specific activities either alone or in combination with other information. Consumers’ personal information in online shopping is a subset of personal information in the specific scenario of online shopping, with distinct scenario-specific limitations. It mainly consists of the information provided by consumers when participating in online shopping www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 170 Published by SCHOLINK INC. activities, which is closely related to the online-shopping process, including information generated in links such as registering an account, browsing products, placing an order, payment and settlement, logistics and distribution, and after-sales evaluation. Compared with general personal information, the main collectors of consumers’ personal information in online shopping are e-commerce platforms, merchants, and third-parties providing services for online shopping, such as payment institutions and logistics enterprises. 2. The Current Situation of the Protection of Consumers’ Personal Information in Online Shopping in China 2.1 The Legislative Situation China has gradually established a legal system for personal information protection, and relevant laws and regulations have regulated the protection of consumers’ personal information in online shopping. The Personal Information Protection Law of the People’s Republic of China, as the fundamental law in the field of personal information protection in China, clarifies the basic principles of personal information processing and stipulates the obligations of personal information processors and the rights of individuals in personal information processing activities. The Law of the People’s Republic of China on the Protection of Consumers’ Rights and Interests focuses on protecting consumers’ rights and interests and specifically regulates the collection and use of consumers’ personal information by operators. It requires operators to follow the principles of legality, justness, and necessity, clearly inform the purpose, method, and scope of information collection, obtain consumers’ explicit authorization, and assume the responsibilities of confidentiality and security protection. The Cybersecurity Law of the People’s Republic of China, in the context of network operation, clearly requires network operators to adopt technical means and other necessary measures to fully guarantee the security of users’ personal information, effectively prevent the risks of information leakage, damage, and loss, and comprehensively safeguard the personal-information-security defense line. However, there are still deficiencies in China’s personal-information-protection legal system. On the one hand, the legal provisions are relatively scattered. There are intersections and overlaps among different laws and regulations, and there is a lack of a unified coordination mechanism, resulting in difficulties in legal application. On the other hand, some legal provisions are too principle-based, lacking specific implementation rules, which makes it difficult to effectively implement them in practice. In addition, considering the particularity of the online-shopping scenario, such as the protection of personal information in emerging business forms like live-streaming e-commerce and social e-commerce, legal norms are still lagging behind. 2.2 The Judicial Situation According to the latest data, personal-infringement cases in online shopping in China occur frequently, and judicial practice plays an indispensable role. However, there are still many problems in judicial practice. First, the burden-of-proof allocation is unreasonable. Due to the complexity and technicality www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 171 Published by SCHOLINK INC. of the network environment, consumers often find it difficult to collect and preserve infringement evidence. Existing laws usually require consumers to bear the main burden of proof, which makes it extremely difficult for consumers to protect their rights. Second, the standards for damage compensation are vague and chaotic, frequently leading to the phenomenon of different judgments in similar cases. In addition, there are disputes over legal application. The connection and coordination between different legal provisions are not smooth enough, affecting the unity and authority of judicial judgments. 2.3 The Law-Enforcement Situation In China, multiple departments, including the Cyberspace Administration of China, the market-supervision department, and the public-security department, are responsible for the supervision of the protection of consumers’ personal information. In recent years, various departments have actively carried out special rectification actions and increased the intensity of cracking down on personal-information infringement. However, the current supervision work still faces many challenges. There are problems of overlapping responsibilities and insufficient coordination among various supervision departments. Since personal-information protection involves multiple fields and links, different departments have poor communication during the supervision process, resulting in low supervision efficiency. 3. Problems Existing in the Protection of Consumers’ Personal Information in Online Shopping in China 3.1 Imperfect Legal System 3.1.1 Scattered and Illogical Legal Provisions The legal provisions on personal-information protection in China are widely distributed in multiple laws and regulations, showing a scattered state and have not yet formed a unified legal system with strict logic and a complete structure. Although the Personal Information Protection Law of the People’s Republic of China provides a relatively comprehensive framework for personal-information protection, in the specific implementation process, it still needs to be coordinated and cooperated with other relevant laws. In the online-shopping scenario, the protection of consumers’ personal information involves multiple laws such as the Law on the Protection of Consumers’ Rights and Interests, the Cybersecurity Law, and the E-commerce Law. These laws have made provisions on personal-information protection from different angles, resulting in conflicts and contradictions in legal application. This scattered legislative model lacks a unified legislative concept and system, and there is a lack of effective coordination and integration among various laws and regulations. Different laws have differences in the definition of personal information, protection scope, liability for infringement, etc., making it difficult to accurately grasp and apply in practice. The scatter of legal provisions also leads to legal loopholes. Due to the lack of comprehensive overall planning and coordination among www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 172 Published by SCHOLINK INC. various laws and regulations, there may be situations where the protection of personal information in certain fields lacks clear provisions. 3.1.2 Poor Operability of Some Legal Provisions In China’s current laws, some provisions on personal-information protection are vague and uncertain in practice, resulting in poor operability. In terms of the definition of personal information, although laws such as the Personal Information Protection Law have defined the concept of personal information, in practical applications, there are still disputes over whether some special information belongs to personal information. For some information that indirectly reflects personal characteristics, whether it should be included in the category of personal information is not clearly defined by law. Although this information cannot directly identify a person’s identity, it may be able to identify an individual in combination with other information. In practice, there is a lack of clear legal basis for the collection, use, and protection of such information, which is likely to trigger infringement disputes. In addition, some legal provisions lack specific implementation rules and operation procedures, making it difficult for law-enforcement departments to carry out their work. This also leaves a large operating space for personal-information processors, who may evade legal responsibilities on various pretexts. 3.2 Incomplete Regulatory Mechanism 3.2.1 Insufficient Coordination and Cooperation among Regulatory Departments In the supervision of the protection of consumers’ personal information in online shopping, multiple departments, including the Cyberspace Administration of China, the market-supervision department, and the public-security department, play important roles. In the actual supervision process, there are problems of insufficient coordination and cooperation among these departments, resulting in low supervision efficiency and it being difficult to form an effective supervision synergy. These problems lead to the existence of supervision loopholes and duplicate supervision in the supervision process. Some illegal acts may not be promptly and effectively investigated and punished due to insufficient coordination and cooperation among departments, forming supervision loopholes. 3.2.2 Backward Regulatory Technical Means With the rapid development of network technology, the business models and technical applications of online shopping are constantly innovating, which poses great challenges to the supervision of the protection of consumers’ personal information. The existing regulatory technical means are relatively backward and difficult to meet the regulatory needs in the new situation, resulting in many difficulties and deficiencies in the supervision work. Personal-information-security incidents in online shopping are often sudden and covert, requiring regulatory departments to have the ability to respond quickly and handle emergencies. The existing regulatory technical means are insufficient in emergency handling and it is difficult to take effective measures in a timely manner to reduce the losses caused by personal-information-security incidents. www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 173 Published by SCHOLINK INC. 3.3 Difficulties in Consumers’ Rights Protection 3.3.1 Difficulties in Burden of Proof When consumers’ personal information is infringed in online shopping, it is often very difficult for consumers to provide evidence. In China, the principle of liability for infringement generally follows the fault-liability principle, that is, “whoever claims, whoever proves”. Consumers must bear the obligation and responsibility of providing evidence if they want to protect their rights. However, in the actual process of providing evidence, consumers always encounter various problems. In many cases, consumers also find it difficult to obtain relevant infringement evidence. Online shopping involves many subjects and complex information-processing processes. The collection, storage, and use of personal information are mainly controlled by e-commerce platforms, merchants, and third-party service providers. These subjects have absolute advantages in technology, resources, and information control, while consumers are in a weak position, which greatly limits consumers’ ability to prove. 3.3.2 High Cost of Rights Protection Consumers often have to pay high costs of time, energy, and money in the process of safeguarding their personal-information rights, which seriously dampens consumers’ enthusiasm for rights protection and makes them choose to give up protecting their rights when facing infringement. The rights-protection process for consumers’ personal-information-infringement cases often takes a lot of time. From the discovery of personal-information infringement by consumers to the final result of rights-protection, the whole process is cumbersome and complex. It also consumes a lot of energy. Consumers need to constantly communicate and negotiate with the infringing party and relevant departments, collect evidence, and understand relevant laws, regulations, and policies during the rights-protection process. In addition, in the litigation process, consumers may need to pay litigation fees, lawyer fees, appraisal fees, and other expenses. These additional payments are a large expense for ordinary consumers, resulting in consumers giving up rights-protection because they cannot afford these costs. 4. Suggestions for Improving the Legal Protection of Consumers’ Personal Information in Online Shopping 4.1 Improve the Legal System 4.1.1 Formulate a Unified Personal-Information-Protection Law From an international perspective, many developed countries and regions have formulated perfect personal-information-protection laws, providing useful references for China. The General Data Protection Regulation (GDPR) of the European Union is a model in the global field of personal-information protection. The implementation of GDPR has greatly strengthened the protection of personal information within the EU, expanded the scope of information-subject rights, enhanced www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 174 Published by SCHOLINK INC. citizens’ trust in personal-information security (Hong, F., & Chen, Y., 2021, pp. 63-65), and had a profound impact on global personal-information-protection legislation. In the United States, there is no unified legislation for the protection of consumers’ personal information in online shopping. Instead, it adopts a decentralized-legislation approach in different professional fields to protect consumers’ personal information (Li, X. R., 2023). At the federal level, the United States has formulated multiple laws related to personal-information protection. In terms of industry self-regulation, various industry associations in the United States have developed a series of self-regulatory norms to guide enterprises to abide by relevant personal-information-protection regulations. This protection model in the United States not only gives full play to the role of the market but also ensures the security of personal information through legal constraints. Combined with China’s actual situation, when formulating a unified personal-information-protection law, the right attribute of personal information should be clearly defined as an independent personality right, and individuals should be granted a series of rights such as the right to control and the right to know about their personal information. In the collection of personal information, it should be stipulated that information collectors must follow the principles of legality, justness, and necessity, clearly inform the purpose, method, and scope of personal-information collection, and obtain the clear consent of individuals. For the collection of sensitive personal information, stricter provisions should be set. It is also necessary to establish and improve the regulatory mechanism and relief channels for personal-information protection, clarify the responsibilities and authorities of regulatory departments, and strengthen the supervision and inspection of personal-information-processing activities. Additionally, punitive damages can be introduced by referring to relevant regulations (Li, X., 2019). 4.1.2 Improve the Legal Norms Related to Online Shopping Online shopping, as a unique business model, has special ways of collecting, using, storing, and transmitting personal information, and requires specific legal norms to adjust and regulate. In online shopping, the collection link of consumers’ personal information involves many subjects and complex processes, and it is easy to have infringement behaviors. Special legal norms should be formulated to clarify the rights and obligations of e-commerce platforms, merchants, and third-party service providers in personal-information collection. It should be stipulated that when e-commerce platforms collect consumers’ personal information, they must provide consumers with clear and understandable privacy policies. The scope of information collection should be restricted, and personal information irrelevant to online-shopping business should not be collected. There are also many problems in the use and sharing of personal information in online shopping. In order to standardize the use and sharing of personal information, the conditions, procedures, and the rights and obligations of all parties should be clearly defined. The use of personal information must be carried out within the purpose and scope clearly defined at the time of collection, and the purpose should not be changed without permission. Moreover, e-commerce platforms and related merchants should conduct limited collection of consumers’ personal information based on the principle of www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 175 Published by SCHOLINK INC. necessity and strictly follow the minimum-data-volume standard when collecting personal information (Zhong, H. Y., Wang, Q. R., Peng, H. Y. et al., 2018, pp. 92-95). In terms of personal-information sharing, the clear consent of consumers must be obtained, and relevant agreements should be signed to clarify the rights and obligations of all sharing parties. 4.2 Strengthen the Regulatory Mechanism 4.2.1 Strengthen the Coordination and Cooperation among Regulatory Departments In order to effectively solve the problem of insufficient coordination and cooperation among departments in the supervision of the protection of consumers’ personal information in online shopping, it is necessary to start from multiple aspects and establish a long-term and effective coordination and cooperation mechanism. Establishing a unified information-sharing platform is one of the key measures. This platform should integrate the data and information obtained by various departments in the supervision of personal-information protection and realize the real-time sharing and interaction of information. Through the information-sharing platform, various departments can break down information barriers and avoid supervision loopholes and duplicate supervision caused by information asymmetry. It is also crucial to clarify the division of responsibilities of each regulatory department. A detailed supervision-responsibility list should be formulated to clarify the work of each department. By clarifying the division of responsibilities, each department can perform its own duties, avoid the phenomenon of shirking responsibility caused by unclear responsibilities, and improve supervision efficiency. Regular communication and coordination meetings can also be held to strengthen the communication and cooperation among various departments and form a supervision synergy. 4.2.2 Improve the Regulatory Technology Level Facing the technical challenges in the supervision of the protection of consumers’ personal information in online shopping, active measures should be taken to increase investment in the research and development of regulatory technologies, improve the regulatory technology level, and adapt to the changing network environment and personal-information-protection needs. Increasing the capital investment in the research and development of regulatory technologies is the primary task. The government should set up special funds to encourage scientific-research institutions and enterprises to carry out the research and development of regulatory technologies. The government can also guide enterprises to increase investment in the research and development of regulatory technologies through policies such as tax preferences and financial subsidies and improve the enthusiasm of enterprises to participate in regulatory technology innovation. Cultivating a professional regulatory technology talent team is also of great significance. Universities and vocational colleges should strengthen the construction of relevant majors to cultivate and transport professional talents for regulatory departments. Regulatory departments should regularly organize internal personnel to participate in technical training and learning and communication activities to improve the technical level and business capabilities of regulators. www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 176 Published by SCHOLINK INC. 4.3 Reduce the Cost of Consumers’ Rights Protection 4.3.1 Reasonably Allocate the Burden of Proof In personal information infringement cases, the burden of proof on consumers should be appropriately reduced. The burden of proof can be reversed, and the defendant should be required to prove that they have no infringement (Xu, Y., 2017). Personal information processors should prove that they have followed the principles of legality, justness, and necessity in the process of collecting, using, storing, and transmitting consumers’ personal information, and have taken reasonable security measures and there is no infringement. If personal information processors cannot prove that they are not at fault, they should bear the liability for infringement. An evidence preservation system can also be established. After consumers discover that their personal information has been infringed, they can apply to relevant departments for evidence preservation in a timely manner to ensure the authenticity and integrity of the evidence and provide strong support for subsequent rights protection. 4.3.2 Establish a Diversified Dispute Resolution Mechanism Improving diversified dispute resolution mechanisms such as litigation, arbitration, and mediation can provide consumers with more convenient and efficient rights protection channels, reduce the cost of rights protection, and effectively resolve personal information infringement disputes in a timely manner. Firstly, the litigation process can be optimized to improve litigation efficiency. Special tribunals or collegial panels for personal information infringement cases can be established, and judges with professional knowledge and rich experience can be selected to hear such cases. Secondly, the role of arbitration institutions in resolving personal information infringement disputes should be strengthened, and consumers and personal information processors should be encouraged to resolve disputes through arbitration. Arbitration can quickly resolve disputes and reduce the cost of consumers’ rights protection. Finally, the mediation mechanism should be improved, and diversified mediation organizations should be established. During the mediation process, mediation organizations should adhere to the principles of fairness and impartiality, fully listen to the opinions of the parties, and help the parties reach a settlement agreement. Mediation agreements have legal effect, and the parties should perform them. If one party fails to perform, the other party can apply to the court for compulsory enforcement. 4.3.3 Strengthen Consumers’ Rights Protection Education By carrying out diversified publicity activities and holding targeted training lectures, strengthening the education of consumers’ legal knowledge and rights protection awareness can effectively improve consumers’ self-protection ability, enhance their rights protection awareness, and enable consumers to take timely and effective measures to safeguard their legitimate rights and interests when facing personal information infringement. Carrying out publicity activities is an important way to improve consumers’ legal knowledge and rights protection awareness. Various media platforms can be fully utilized to widely publicize the laws, regulations, and policies on personal information protection. Public service advertisements on personal information protection can be broadcast on TV, special columns on personal information protection can www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 177 Published by SCHOLINK INC. be set up in newspapers, and publicity materials and videos on personal information protection can be released on network platforms for consumers to consult and learn at any time. Offline publicity activities can also be carried out to publicize personal information protection knowledge face-to-face with consumers and answer consumers’ questions. 5. Conclusion With the rapid development and continuous progress of e-commerce, the value of consumers in online shopping is constantly increasing. At the same time, although relevant laws in China provide a legal basis for its protection, cases of infringement of consumers’ personal information still occur frequently, indicating that we still need to strengthen the legal protection of consumers’ rights. Facing the growing situation of online shopping infringing on consumers’ personal information, it is urgent to strengthen the protection of consumers’ personal information, safeguard consumers’ legitimate rights and interests, and construct a perfect legal protection system for consumers’ personal information. In the future, with the continuous development of network technology and online shopping models, the protection of consumers’ personal information will face more complex challenges and also new development opportunities. We need to keep up with the development of the industry, continuously optimize the legal system, improve the long-term regulatory mechanism, vigorously promote the research, development, and application of technological innovation, and actively carry out publicity and education to effectively enhance consumers’ awareness and prevention ability of personal information protection. Only by making joint efforts from multiple aspects can we build a safe, stable, standardized, and orderly online shopping ecological environment and promote the healthy and orderly development of the online shopping industry. References Chen, J. L. (2025). Research on the Protection of Consumers’ Personal Information in the E-commerce Environment. Modern Marketing (Early Edition), 2025(03), 152-154. Hong, F., & Chen, Y. (2021). Enlightenment and Reference of Foreign Personal Information Protection Legislation to China. Northern Finance Journal, 2021(11), 63-65. Li, X. (2019). Research on the Tort Liability of Personal Information in the Network Environment. Beijing Jiaotong University. Li, X. R. (2023). Research on the Legal Issues of the Protection of Consumers’ Personal Information in Online Shopping. Qingdao University. https://doi.org/10.31839/ibt.2023.01.40.153 Shen, X. J. (2022). Protection of Consumers’ Personal Information in Online Shopping. Heilongjiang Human Resources and Social Security, 2022(10), 148-150. Xu, Y. (2017). Legal Protection of Consumers’ Personal Information in Online Shopping. Capital University of Economics and Business. https://doi.org/10.31839/ibt.2023.01.40.153 www.scholink.org/ojs/index.php/elp Economics, Law and Policy Vol. 8, No. 1, 2025 178 Published by SCHOLINK INC. Zhong, H. Y., Wang, Q. R., Peng, H. Y. et al. (2018). Analysis of the Principles of Collection, Custody, and Utilization of Consumers’ Personal Information—Taking E-commerce Platforms as an Example. Legal System and Economy, 2018(05), 92-95.