The development of technology in the commercial sector is always faced with various problems. One of them concerns buying and selling using a network-based technology system or what is called e-commerce. Problems that often occur in the community are when customers argue with online shops that lead to the dissemination of personal data to be accompanied by defamation carried out by online shops. So that legal conflicts like this need to be seen from various related regulations. This research aims to describe and analyze the regulation of legal protection against customers for the act of spreading personal data and defamation committed by online shops in legislation. The results show that the regulation of the dissemination of consumer personal data that has defamation content and is carried out by online shops can be seen from three interrelated regulations, namely Law Number 11 of 2008 as amended by Law 19 of 2016 and last amended by Law Number 1 of 2024 concerning Electronic Information and Transactions, Law Number 23 of 2006 as amended by Law Number 24 of 2013 concerning Population Administration, and Law Number 8 of 1999 concerning Consumer Protection. The weakness of the Electronic Information and Transaction Law, both in 2008, 2016 and 2024, is that it does not contain criminal provisions on the protection of personal data, especially with regard to the dissemination of personal data accompanied by defamation of the customer. The weakness of Law Number 23 of 2006 as amended by Law Number 24 of 2013 concerning Population Administration is that it does not provide protection against the misuse and dissemination of personal data in the form of images, photographs, mention of a person's name and place of residence. Meanwhile, the weakness of Law Number 8 Year 1999 on Consumer Protection is the existence of a vacuum of norms regarding the conception of consumer/customer personal data.