May 21, 2026
Balance between innovation and data protection in e-commerce
Mariana Catharina de Souza; Jeffson Veríssimo de Oliveira
Summary prepared by the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege focused on synthesis and writing.
E-commerce has consolidated itself as a transformative force in the global economic landscape since its emergence in the late 1990s, driven by the expansion of connectivity and the democratization of access to the World Wide Web (E-Commerce Brasil, 2022). This evolution has redefined consumer relations by eliminating geographical barriers and allowing products and services to reach diverse audiences in real-time. However, the acceleration of digital transformation has brought complex challenges, especially regarding information security and user privacy. The constant need for innovation to generate profit and notoriety in the market requires organizations to adopt advanced data collection and analysis strategies, often creating an ethical and operational dilemma between commercial efficiency and consumer protection. Trust emerges as a fundamental element for encouraging transactions in virtual environments, as the perception of risk can inhibit the adoption of new technologies and harm brand image (Corbitt et al., 2003).
The protection of personal data in Brazil gained an essential regulatory framework with the enactment of the General Data Protection Law, Law No. 13,709/2018, which establishes rigorous guidelines for the processing of information by public and private entities (Brasil, 2018). The central objective of this legislation is to ensure that the data subject maintains control over their information, requiring transparency and informed consent. Despite the legal advancement, daily practice reveals that many consumers still accept terms of use and privacy policies without proper understanding, motivated by haste or the complexity of the legal language used by platforms. This scenario of vulnerability is aggravated by the sophistication of cybercrimes, which exploit technical and behavioral flaws to carry out large-scale fraud and leaks. Therefore, the search for a balance between digital innovation and security becomes imperative for the sustainability of the online sales ecosystem.
Technological development allows companies to build detailed customer profiles, using this information for targeted advertising, personalized product design, and dynamic pricing strategies. While these practices can improve the user experience, they also raise concerns about constant surveillance and the misuse of sensitive data. The integration of privacy and security must be seen not only as a legal obligation but as a strategic value that strengthens the relationship between brand and customer (Bioni, 2019). Research into how developers, managers, and consumers perceive these risks is fundamental to proposing models that guide the creation of procedures capable of protecting privacy without compromising technological advancement and business competitiveness in cyberspace.
To conduct this research, an exploratory and qualitative methodological approach was adopted, aiming to understand the phenomenon in its multiple perspectives and identify patterns of behavior and perception (Borges, 2000). The theoretical foundation was built through a systematic literature review, consulting scientific articles, theses, and technical documents on open-access portals. Primary data collection was structured in three distinct stages, using the Google Forms platform to ensure the agility and organization of responses. All participants were informed about the nature of the study and provided free and informed consent, ensuring the anonymity and confidentiality of the information provided during the research process.
The first stage consisted of applying a structured questionnaire to consumers of online stores, with the aim of mapping the sociodemographic profile and perceptions about the sharing of personal data. The collection instrument comprised 14 multiple-choice questions and four open-ended questions, covering dimensions such as the level of distrust, knowledge about privacy policies, and digital security habits. The analysis of this data followed the proposed thematic categorization, allowing us to identify how variables such as gender, age, and education influence the user’s willingness to provide information in exchange for commercial benefits (Bardin, 2016). The focus was on understanding the motives that lead to the acceptance of terms of use and the identification of previous negative experiences, such as financial losses or undue exposure of data.
Simultaneously, a survey was conducted with developers of e-commerce systems and applications to obtain a technical and operational perspective on the topic. The script included 10 semi-structured questions that explored the security culture in organizations, data collection methods, and ethical dilemmas faced during the development of new functionalities. We sought to understand how security is integrated into the software lifecycle and what the main obstacles are to aligning the agility required by the market with the demands of current legislation. This stage was crucial for confronting the user’s perspective with the technical possibilities and limitations of the sector, providing input for the discussion on the viability of more robust protection solutions.
The third stage of the methodology involved the application of the adapted Delphi Technique, conducted in two rounds with industry experts, including the owner of a digital marketing company and a senior developer. The objective was to reach a consensus on the most critical risks and the most effective mitigation strategies for the current e-commerce scenario. In the first round, the experts listed and classified the main security risks, describing their impacts on consumers and businesses. In the second round, participants brainstormed solutions, evaluating the implementation feasibility of each proposal on a scale of one to five, considering factors such as cost, technical complexity, and legal compliance. The systematization of these responses allowed for the construction of a model of practical recommendations for the sector (Asana, 2025).
The analysis of sociodemographic data revealed that the consumer sample profile is predominantly female, representing 66.7% of respondents, while the male demographic comprises 33.3%. Regarding age distribution, there is a significant concentration of young adults, with 75% of participants aged between 25 and 34 years. The education level is high, as 75% have completed higher education or postgraduate studies, suggesting an audience with access to information but who still face barriers in understanding digital security technicalities. As for platform usage time, 33.3% spend between 30 minutes and one hour per day on shopping websites, evidencing a deep integration of e-commerce into the daily routine of these individuals.
The results indicate a clear willingness of consumers to share personal data in exchange for immediate financial advantages. Approximately 54.2% of respondents stated that they provide information to obtain discounts and low prices, while 29.2% do so to participate in loyalty programs or receive personalized recommendations. This trend reflects how convenience and economic benefit often outweigh privacy concerns. However, distrust remains a determining factor in purchasing behavior: 91.7% of participants admitted to having abandoned a transaction due to a lack of trust in the platform. The main reasons for this abandonment include suspicious website design (70.8%), negative social media reviews (54.2%), and a lack of clarity in privacy policies (45.8%).
Experience with security incidents is a reality for part of the sample, with 16.7% reporting financial losses due to data breaches or unauthorized purchases. This data reinforces the perception of risk, which is the biggest concern for 87.5% of people when providing information online. Despite this apprehension, there is a critical gap in digital literacy: 58.3% of respondents admit to accepting terms of use without prior reading to expedite access, and 45.8% have only a superficial understanding of how cookies work and the destination of their data. The lack of knowledge about the rights guaranteed by legislation is evident, which shows that the existence of the law does not, in itself, guarantee effective protection if there is no user education (PROCON, 2021).
On the technical level, developers reported that data collection is a fundamental pillar for innovation, enabling the creation of intelligent and personalized solutions that increase commercial efficiency. The data collected ranges from basic contact and financial information to technical navigation data, such as IP address and location. However, professionals recognize that the balance between innovation and compliance is a constant challenge. The rush to launch new products to the market and the high costs of implementing robust security systems are pointed out as the main obstacles. The adoption of practices such as “Privacy by Design” and the integration of security into the software development lifecycle are seen as necessary paths, but they still face cultural resistance within organizations.
The application of the Delphi Technique allowed for the identification of three categories of priority risks: digital fraud and scams, data breaches, and cyberattacks. For experts, the impacts of these risks are multidimensional, affecting consumers’ financial health, privacy, and psychological well-being, in addition to causing severe reputational damage and legal sanctions for companies. As consensual solutions, the adoption of constant multi-factor authentication (MFA), the use of behavioral biometrics, and the implementation of real-time transaction analysis supported by artificial intelligence stood out. The feasibility of these solutions was positively evaluated, with a score of 4.50 out of five, indicating that the technology is available, but its effectiveness depends on a change in business mindset that ceases to view security as an expense and begins to see it as an essential investment.
The discussion of the results points to the need for “invisible security,” which protects the user without creating bureaucratic barriers that harm the shopping experience. The strategic use of advanced technologies, such as device monitoring and end-to-end encryption, can offer proactive defense layers against automated threats that grow annually in the sector (Axur Platform [AXUR], 2025). Furthermore, vulnerability management and strict access control, based on the concept of least privilege, are fundamental measures to mitigate the risk of internal and external leaks (International Business Machines Corporation [IBM], 2024). Transparency in customer communication should be prioritized, transforming complex privacy policies into didactic and accessible information.
The future scenario of e-commerce requires companies to invest in more robust budgets for cyber defense, following the global trend of increased spending on information security (Gartner, 2025). The resilience of businesses in the digital economy will depend on organizations’ ability to anticipate threats and educate their consumers, creating an environment of mutual trust. The integration of protection practices from the conception of digital products not only ensures compliance with legislation but also consolidates itself as a competitive differentiator in a market increasingly attentive to privacy risks. The challenge lies in converting security from an operational cost into a central strategic value for the sustainability and growth of online sales platforms.
It is concluded that the objective was achieved by identifying that the balance between digital transformation and data security in e-commerce depends on an integrated approach involving technology, legislation, and education. The investigation showed that, although consumers value immediate benefits, the lack of trust is the main obstacle to loyalty and purchase completion, highlighting that security is an inseparable component of the user experience. At the macro level, the effectiveness of data protection requires a robust regulatory framework and incentives for companies to adopt high standards of governance. At the micro level, it is fundamental to promote an organizational culture of security that prioritizes privacy from the development of systems, combined with awareness campaigns that empower consumers to act proactively in the digital environment. The integration of these pillars allows technological innovation to continue driving the market without compromising the fundamental rights of citizens, transforming data protection into a pillar of sustainability for the contemporary digital economy.
Bibliographic References:
ASANA. 2025. O que é um fluxograma? Aprenda os símbolos, tipos e como interpretá-los. Disponível em: <https://asana.com/pt/resources/what-is-a-flowchart>. Acesso em: 3 jun. 2025.
AXUR. 2024. Threat Landscape 2024/2025: Relatório de Ameaças Cibernéticas. Disponível em: <https://cmsb.nortonlifelock.com/sites/default/files/2025-02/Q4%20Gen%20Threat%20labs%20Whitepaper%20%283%29.pdf>. Acesso em: 12 jun. 2025.
Bardin, L. 2016. Análise de Conteúdo. Edições 70, São Paulo, SP, Brasil.
Bioni, B.R. 2019. Proteção de Dados Pessoais: A Função e os Limites do Consentimento. Forense, Rio de Janeiro, RJ, Brasil.
Borges, N.B. 2000. Métodos e técnicas de pesquisa em psicologia. Revista Estudos de Psicologia (PUC-Campinas) 17(2): 80-81.
Brasil. 2018. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados (LGPD). Diário Oficial da União, Brasília, 15 ago. 2018. Seção 1, p. 1.
Corbitt, B.J.; Thanasankit, T.; Yi, H. 2003. Trust and E-Commerce: A Study of Consumer Perceptions. Electronic Commerce Research and Applications 2: 203-215.
E-Commerce Brasil. 2022. Evolução do e-commerce. Disponível em: <https://www.ecommercebrasil.com.br/artigos/evolucao-do-e-commerce>. Acesso em: 12 jun. 2025.
Fundação de Proteção e Defesa do Consumidor de São Paulo [PROCON-SP]. n.d. Proteção de Dados e LGPD. Disponível em: <https://www.procon.sp.gov.br/protecao-da-dados-e-lgpd/>. Acesso em: 19 mar. 2025.
Gartner. 2025. Gartner Forecasts Worldwide End-User Spending on Information Security to Total $213 Billion Dollars in 2025. Disponível em: <https://www.gartner.com/en/newsroom/press-releases/2025-07-29-gartner-forecasts-worldwide-end-user-spending-on-information-security-to-total-213-billion-us-dollars-in-2025>. Acesso em: 28 set. 2025.
International Business Machines Corporation [IBM]. 2024. Segurança da Informação. Disponível em: <https://www.ibm.com/br-pt/think/topics/information-security>. Acesso em: 28 set. 2025.
Executive summary from the Final Course Work of the Specialization in Project Management of the MBA USP/Esalq
To learn more about the course, click here and access the MBX Academy platform