Online Gaming and E-Sports: A DPDP Act Impact Study

Executive summary

Indian gaming changed shape on 1 May 2026. The Promotion and Regulation of Online Gaming Act, 2025 came into force, s.5 banned online money games, and the Online Gaming Rules, 2026 took effect, administered by a newly constituted Online Gaming Authority of India. Platforms that offered money games had to stop; what remains lawful is social gaming and e-sports.

The gaming law regulates games, not data. Data is governed by the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025, whose main duties apply from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor acts on a fiduciary's behalf. A game studio is the fiduciary for its players; its analytics, anti-cheat and voice-chat vendors are usually processors.

Headline rating: Overall impact High. Five of the twelve areas in the Trayambic scorecard below are rated High for a typical game publisher, social gaming platform or e-sports operator.

The three biggest changes:

• Players under 18. Verifiable parental consent is required, and s.9(3) bars tracking and behavioural monitoring of children. That collides with engagement analytics, personalised offers and some anti-cheat designs.
• Legacy money-game data. Identity documents, PAN, bank details and wallet histories collected for real-money play lost their purpose on 1 May 2026. What the law does not require to be kept must go.
• Two authorities on retention. The DPDP Rules require large gaming intermediaries to erase dormant users' data after three years, while the Online Gaming Rules let the Authority direct retention of traffic data and metadata in India.

The Act's constitutional challenge is pending in the Supreme Court, with no stay recorded. Plan on the law as it stands.

Background

The sector now has four main models:

• Game publishers and studios making mobile, PC and console games, mostly free-to-play and paid for through in-app purchases and advertising.
• Social gaming platforms, including former money-game operators now running stake-free card, quiz or strategy games.
• E-sports organisers, teams and tournament platforms, which run leagues, pay prizes and manage professional players.
• Distribution and community layers: app stores, streaming creators and community servers.

The data principals are players, many of them under 18; parents; professional players and streamers; other people heard in voice chat; and former money-game users whose records remain on file.

The data includes account and device identifiers, social logins, declared age, gameplay telemetry and inputs, text and voice chat, purchase histories and payment tokens, approximate location for matchmaking, anti-cheat signals from the device, prize-payout details, and, for former money-game operators, identity documents, PAN and bank records. Typical vendors are cloud hosts, engine analytics, ad mediation and attribution SDKs, anti-cheat providers, voice-chat services, payment aggregators and outsourced moderation.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Section 7(a) covers data a player "has voluntarily provided" for a specified purpose, which fits running the account and the game. There is no "legitimate interests" ground, so ads, analytics and personalised offers need consent.
• Notice and consent (ss.5, 6; Rule 3). "Free, specific, informed, unconditional and unambiguous" consent, an itemised notice, and withdrawal as easy as giving.
• Children (s.9; Rules 10 and 12). A child is anyone under 18. Section 9(1) requires verifiable parental consent; s.9(2) bars processing likely to harm a child's well-being; s.9(3) bars "tracking or behavioural monitoring of children or targeted advertising directed at children". Rule 10 lets a fiduciary verify the parent through reliable details it holds or a virtual token from an authorised entity such as DigiLocker. The Fourth Schedule permits processing to verify that a user is not a child, to keep harmful content and ads away from a child, and to perform a duty under law in a child's interest.
• Security and breach (s.8(5), (6); Rules 6, 7). Encryption or tokenisation, access control, a year of logs; notice to each affected person and the Data Protection Board without delay, and a detailed report within 72 hours.
• Retention (s.8(7), (8); Rule 8; Third Schedule). Erase when the purpose ends, unless law requires retention. An online gaming intermediary with at least 50 lakh registered users in India must erase a user's data after three years without engagement, on 48 hours' notice.
• Significant Data Fiduciaries (s.10; Rule 13). The Centre may designate a Significant Data Fiduciary (SDF) based on volume and sensitivity of data and risk to rights; an SDF needs an India-based DPO, an independent data auditor and an annual Data Protection Impact Assessment (DPIA).
• Penalties. Up to ₹200 crore for the children's duties and ₹250 crore for failed security safeguards.

The Third Schedule defines an online gaming intermediary as an intermediary that enables users of its computer resource "to access one or more online games". It carves out data needed for the user's account and for any virtual token the platform issued that can be used to obtain goods or services.

Gaming and platform law alongside

The Act defines an online social game as one that involves no stake or expectation of monetary winnings, may charge a subscription or one-time access fee that is not a stake, and is offered "solely for entertainment, recreation or skill-development purposes". An e-sport must be played as part of multi-sports events, be recognised under the National Sports Governance Act, 2025 and be registered with the Authority. Its long title refers to protecting "youth and vulnerable populations" from "privacy-related impacts", but no operative section deals with personal data, age or KYC.

The Rules make registration the exception: only games the Centre notifies, intended e-sports, or games the Authority decides need it (r.12). In assessing whether a game is a money game, the Authority looks at how rewards or in-game assets can be transferred, redeemed or monetised outside it (r.9(e)).

The 2023 IT Rules framework for real-money games depended on self-regulatory bodies; rule 4B deferred most online-game obligations until three months after at least three were designated. In our view the framework has been overtaken in practice by the s.5 ban, although it has not been formally omitted.

The constitutional challenge

Challenges filed in several High Courts were transferred to the Supreme Court and are heard together as Head Digital Works Pvt Ltd v Union of India, T.C.(C) No. 133 of 2025. The Court's office report for the 5 August 2026 listing records the Union's counter affidavit, incomplete pleadings in connected matters and no interim stay. The Act and Rules are in force.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; s.38(2) makes it prevail in a conflict. A retention direction under Rule 17 is, in our view, a legal requirement within the s.8(7) exception, so data a direction requires to be kept survives both purpose-based erasure and the Third Schedule clock. Section 16(2) preserves stricter laws on transfers abroad: once the Authority directs storage on computer resources in India, that direction binds even though no country is restricted under s.16(1).

The dates

• 13 November 2026: consent manager provisions commence.
• 13 May 2027: the main DPDP duties, rights, Rules 3 and 5 to 16, and penalties.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Players under 18: age, consent and the monitoring bar

A gaming service open to teenagers needs three things it may not have today.

An age signal. The Fourth Schedule allows processing to verify that a user is not a child, limited to what that check needs. The Online Gaming Rules list age verification and age-gating as user safety features, and applications to the Authority must state intended age groups. A self-declared date of birth, backed by checks where accounts behave younger than declared, is a defensible start.

A parent flow. Rule 10's first illustration fits a gaming sign-up: a user says she is a child, the platform asks her parent to identify herself, and verifies the parent's identity and age before the child's account opens. A DigiLocker-style token avoids the platform collecting the parent's documents.

A different product for children. Section 9(3) cannot be unlocked by parental consent. For child accounts, in our view, the following must go:

• behavioural ad SDKs and any targeted advertising;
• engagement and churn models that profile the individual child;
• personalised pricing or offers based on the child's play or spending;
• cross-game or cross-device tracking.

Contextual advertising using no personal data, aggregate analytics and safety filtering remain possible. Section 9(2) adds a well-being test that, in our view, loot mechanics, streak pressure and spending nudges aimed at children are unlikely to pass. Trayambic's dark patterns blog covers the screen-level tests.

Anti-cheat, chat and the monitoring problem

Anti-cheat ranges from checking that the game files are untampered to scanning device processes and modelling how a player moves and aims. For adults, in our view, consent limited to what fair competitive play requires satisfies s.6(1), which confines consent to data "necessary for such specified purpose".

For children, behaviour-based anti-cheat is, in our view, behavioural monitoring, and s.9(3) bars it. The only plausible route is the Fourth Schedule exemption for performing a duty under law "in the interest of a child". Rule 6(4)(g) lets the Authority issue fair-play directions, but anti-cheat mainly protects other players, so the fit is weak. Until the Board says otherwise, limit child accounts to software-integrity checks that do not profile behaviour, and keep any session-level signals short-lived.

Chat raises a related tension. Text and voice logs are personal data of everyone in the conversation. A game that hosts player communications is, in our view, an intermediary, owing grievance resolution within seven days and 180 days' retention of registration information after closure. The Fourth Schedule permits processing to keep harmful content away from a child, so filtering what reaches a child is allowed; building a behavioural profile of the child from chat is not. Voice chat off by default for child accounts, short retention for moderation clips, and a clear notice cover most of the risk.

Legacy money-game data, balances and the token exception

Former real-money operators hold the most sensitive data in the sector. The purpose for which it was collected, offering money games, ended on 1 May 2026, so s.8(7) requires erasure except where law requires retention. Tax records stay for their statutory periods; processing needed to enforce a legal right or claim falls under s.17(1)(a), though security duties still apply. A win-back campaign that picks former money-game players by their deposit size, to invite them into a new social game, starts a new purpose and needs fresh consent under s.6.

User balances are the awkward remainder. The final Rules contain no transitional provision on them. Platforms still returning money need bank details only until the refund is made and evidenced; after that they should be erased.

The Third Schedule's virtual-token exception matters for social games. In-game currency that a player bought and can spend on the platform is, in our view, a virtual token, so a dormant account holding a balance is not erased merely for inactivity. Designing currencies that cannot be cashed out also keeps the game clear of the Rule 9(e) money-game factor.

Worked example: a fantasy platform turned social-game studio

All figures are illustrative. A Bengaluru company ran paid fantasy cricket contests until April 2026. It now offers a free-to-play cricket strategy game with ads, purchasable coins, weekly leagues and voice chat. It has 90 lakh registered accounts, many dormant, and ages for older accounts are unknown.

1. 1.Classification. The game hosts player profiles and chat, so the company treats itself as an online gaming intermediary above the 50 lakh threshold. The three-year dormancy clock runs from the later of last contact or commencement of the Rules; Trayambic's dark patterns blog explains the two readings of that date.
2. 2.Legacy KYC. It returns remaining balances, keeps GST and tax records in a restricted archive for their statutory periods, and erases PAN images, bank details and identity documents once refunds are evidenced.
3. 3.Age reset. Every account passes an age gate at next login. Accounts under 18 move to a child mode: parental consent under Rule 10, no ad SDKs except contextual, no personalised coin offers, voice chat off by default.
4. 4.Leagues. If the leagues are to become an e-sport, the game needs recognition under the National Sports Governance Act, 2025 and registration with the Authority, with an application stating age groups and safety features. Prizes funded by sponsors rather than entry fees keep the leagues on the right side of the money-game factors.
5. 5.Anti-cheat. Behavioural detection runs only on adult accounts, with notice; child accounts get file-integrity checks.
6. 6.Breach readiness. A leak of the legacy KYC archive would require notice to every affected user and the Board, a 72-hour report and a CERT-In report within six hours, so the archive is encrypted and access-logged.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map; legacy money-game clean-up plan; decide intermediary status and threshold.
• January to March 2027: age assurance, parent flow and child mode; consent-gated SDKs; chat rules.
• April to May 2027: anti-cheat scoping, dormancy clock, rights and breach drills.
• Ongoing: Authority directions, the Supreme Court challenge, and any Board guidance on children.

Recommendations

1. 1.Build a separate child mode now; s.9(3) cannot be solved with a consent screen.
2. 2.Clean out legacy money-game data, keeping only what a law or a live dispute requires.
3. 3.Limit anti-cheat for minors to integrity checks that do not profile behaviour.
4. 4.Treat in-game currency as a virtual token and make sure it cannot be cashed out.
5. 5.Put every SDK behind consent and audit what each one sends.
6. 6.Keep a register of Authority directions and map each to its DPDP effect.

Key takeaways

• The Online Gaming Act regulates games, not data; player data is governed by the DPDP Act from 13 May 2027.
• Section 9(3) bars tracking and behavioural monitoring of children, so child accounts need a separate mode without behavioural ads, profiling or behaviour-based anti-cheat.
• Data collected for online money games lost its purpose on 1 May 2026 and must be erased unless a law or a live dispute requires it.
• Online gaming intermediaries with 50 lakh or more users face a three-year dormancy erasure rule, with an exception for account access and virtual tokens.
• The Online Gaming Authority can direct retention of traffic data and metadata in India; such directions operate alongside the DPDP Act.