Age is not a checkbox anymore.
Gaming sits at the intersection of the two hardest parts of the DPDP Act: a young user base and a business model built on behavioural data. Section 9 makes tracking and targeted advertising to children unlawful, which is a product constraint before it is a compliance one.
Built for: Real-money gaming platforms, fantasy sports, casual gaming studios and gaming intermediaries.
The pressure points, specifically
Section 9 bites hardest here
Behavioural tracking and targeted advertising directed at children are prohibited, not merely consent-gated. If your acquisition funnel depends on either, the obligation reaches the product, not just the privacy policy.
Age assurance has to be real
A self-declared date of birth is not verification. Establishing that a user is an adult, and obtaining verifiable parental consent where they are not, is now a first-order engineering problem.
KYC and self-exclusion generate their own records
Identity documents held for KYC, and exclusion lists held to keep a user out, are retained for reasons other than consent. Both need a lawful basis stated and a retention position that survives a deletion request.
Two rulebooks at once
The MeitY online-gaming amendments and the DPDP Act arrived close together and overlap on minors, verification and grievance handling. Compliance work that treats them separately does the same job twice and still leaves gaps.
The parts that matter here
A real-money gaming purpose pack
Purposes drawn from the MeitY 2023 amendment covering age verification, KYC, self-exclusion and minor protection, with DPDP-aligned lawful bases already assigned. A starting position rather than a blank document.
Verifiable parental consent as a real flow
Where a user is identified as a child, a guardian consent path with the relationship recorded, and the §9 restrictions applied to that account rather than left to a policy nobody enforces at runtime.
Purpose-level control over behavioural data
Analytics, personalisation and advertising held as separate purposes so you can switch behavioural processing off for an account without switching the account off. That granularity is what makes §9 implementable.
Grievance handling that satisfies both regimes
A grievance officer route with statutory clocks and an audit trail, which the DPDP Act requires and the gaming rules expect, running as one workflow instead of two inboxes.
Consent from the app, at play volume
A mobile SDK and a server-side API fast enough to sit in a signup path, because a consent check in front of a first game is a conversion surface as much as a compliance one.
This sector has a ready-made purpose pack. See what is in it.
Online gaming and the DPDP Act
No. Section 9 of the DPDP Act prohibits behavioural monitoring of children and advertising targeted at them, and unlike most obligations in the Act this cannot be cured by obtaining consent. For a gaming platform this means the ad and personalisation stack has to be switchable off per account, which is a product requirement rather than a policy one.
It is unlikely to be defensible on its own. The Act requires verifiable consent from a parent or guardian before processing a child's data, which presupposes knowing that the user is a child with some reliability. Platforms are expected to take reasonable measures appropriate to the risk, and a risk profile involving money and minors sits at the higher end.
They overlap rather than conflict, and both apply. The MeitY amendments govern permissible games, verification and grievance redressal for online gaming intermediaries; the DPDP Act governs personal data across all of it. The efficient approach is one set of purposes, notices and grievance workflows built to satisfy both, which is how the gaming purpose pack is structured.
They can ask, and the platform can lawfully retain what it must. Data held to enforce a self-exclusion or to meet a KYC obligation is retained under a legal basis other than consent, so an erasure request is answered by erasing what is not covered and explaining what is. The reasoning needs to be recorded at the time, not reconstructed later.
General information about the DPDP Act, 2023, not legal advice. For a position specific to your organisation, talk to us.
Find out where you actually stand.
The free self-assessment takes a few minutes and gives you a written position on your own setup, not a generic checklist.