The Lowest Threshold And The Hardest Section.
Online gaming intermediaries reach the Third Schedule's retention duty at fifty lakh users - a quarter of the trigger for e-commerce and social media. Then section 9 removes two things much of the sector is built on.
Covers: real money gaming, fantasy sports, mobile games, esports platforms.
Why this sector is treated differently
Two features of the framework land on online gaming harder than on anything else, and they compound.
The first is arithmetic. The Third Schedule names online gaming intermediaries at fifty lakh registered users in India, against two crore for e-commerce and social media. A gaming platform therefore inherits a class-specific erasure duty at one quarter of the scale, which for a growing studio can mean the obligation arrives years earlier than the compliance function does.
The second is section 9, and it is the one that changes product decisions rather than data-retention policy. Section 9(3) prohibits tracking, behavioural monitoring of children and targeted advertising directed at children - flatly, with no consent override. A parent cannot authorise it. Section 9(1) requires verifiable parental consent before processing a child's personal data at all, and section 9(2) prohibits processing likely to cause a detrimental effect on a child's well-being. Under the Act a child is anyone under eighteen, which is a materially different population from the thirteen-plus most global platforms are architected around.
There is a route out, and it is narrow. Section 9(5) lets the Central Government notify a higher exempt age for a specific Data Fiduciary that has satisfied it the processing is verifiably safe. That is a per-operator notification, not a class exemption, and it has to be earned before it can be relied on.
What you actually process
One row per activity, not per data type. Lawful basis and erasure attach to a purpose, so the same phone number can sit in three rows below with three different answers.
| Activity | Lawful basis | When it must go |
|---|---|---|
| Register a playerUsername, Email or phone, Date of birth, Device identifier | § 9(1)For a child, verifiable parental consent before any processing. For an adult, ordinary consent under section 6. Which one applies is decided by the age step, so nothing downstream is safe until that step is right. | § 8(7)Erase when the account closes and the purpose is served, subject to the Third Schedule clock for lapsed accounts. |
| Run a game sessionSession events, Progression, Latency and device telemetry, Chat | § 9(3)For children this is not a consent question. Tracking and behavioural monitoring are prohibited outright, so the question is what a child's session may emit at all, not what has been agreed. | § 8(7)Operational telemetry loses its purpose quickly. Set a period tied to that purpose rather than keeping it because storage is cheap. |
| Monetise the gamePurchase history, In-game behaviour, Advertising identifiers | § 9(3)Targeted advertising directed at children is prohibited. For adult players ordinary consent applies, so monetisation has to be able to tell the two populations apart. | § 8(7)Purchase records may be required by tax or consumer law; those periods sit outside this Act and should be confirmed against those statutes. |
| Hold a lapsed accountProfile, Progression, Purchase history, Chat history | § 8(7)No purpose survives a player who has stopped playing. The Third Schedule then adds a hard clock at fifty lakh registered users, the lowest of the three named classes. | Third ScheduleThree years after last approach or exercise of a right, at fifty lakh or more registered users in India. |
The data flow, and where it breaks
Each lane follows one activity through the actors and systems that touch the data. The failure mode sits on the hop where it happens, rather than in a list somewhere else on the page.
Register a player
Create an account and establish whether the player is a child
- Signup formCollects the account details§ 5Fails when: Notice written for an adult reader that a fourteen-year-old cannot act on
- Age assuranceEstablishes whether the player is under eighteen§ 9(1)Fails when: A self-declared birth date, which is an age gate rather than assurance
- Parent verificationObtains verifiable parental consent where the player is a child§ 9(1)Fails when: Treated as a checkbox the child ticks on the parent's behalf
- Account storeHolds the account and its age statusFails when: Age captured once and never revisited, so a player who turns eighteen keeps child restrictions and a wrong entry is never corrected
Run a game session
Operate the game and keep it fair and functional
- Game clientEmits session and progression eventsFails when: The same event stream emitted for adults and children alike
- Telemetry pipelineAggregates behaviour for balancing and anti-cheat§ 9(3)Fails when: Behavioural profiling of children, which no consent can authorise
- Analytics warehouseRetains per-player behavioural history§ 9(3)Fails when: Child sessions indistinguishable from adult ones once they land in the warehouse
Monetise the game
Sell items and show advertising
- Offer engineChooses which items to surface and when§ 9(3)Fails when: Offers timed against a child's engagement pattern, which is behavioural monitoring put to commercial use
- Ad mediationSelects and serves advertising§ 9(3)Fails when: Targeted advertising reaching a child through a partner you did not directly configure
- Payment processorTakes payment§ 8(2)Fails when: Engaged without a processing contract
Hold a lapsed account
None, once the player stops returning
- Account storeRetains the account indefinitely by defaultThird ScheduleFails when: No last-approached timestamp, so the erasure date cannot be computed
- Erasure jobComputes the due date and erasesrule 8(1)Fails when: Fifty lakh users arrives on one successful title, before anyone has built this
- Notice jobWarns before the period completesrule 8(2)Fails when: Sent to a child's account rather than the parent who gave consent
The provisions that apply
Fifty lakh registered users
Rule 8(1) sets the online gaming intermediary threshold at fifty lakh registered users in India - the lowest of the three named classes. Above it, personal data must be erased three years after the Data Principal last approached the platform or exercised a right, unless a law requires retention, with forty-eight hours' notice before the period completes.
No behavioural monitoring, no targeted ads
A Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. There is no consent gate on this - it is a prohibition, not a permission that can be unlocked. For a sector that monetises engagement telemetry and personalises offers, this is a design constraint rather than a compliance control.
Verifiable parental consent, under eighteen
Before processing any personal data of a child, or of a person with a disability who has a lawful guardian, the Data Fiduciary must obtain verifiable consent of the parent or guardian in the manner prescribed. Rule 10 prescribes that manner. The Act's definition of child is anyone who has not completed eighteen years.
The verifiably safe route
If the Central Government is satisfied that a Data Fiduciary processes children's data in a verifiably safe manner, it may notify an age above which that Data Fiduciary is exempt from some or all of the section 9(1) and 9(3) obligations. It is granted to a named operator on evidence, and until it is granted the full obligation applies.
What to do about it
Establish age before you establish anything else
Every other decision on this page depends on knowing whether a player is under eighteen. Age assurance has to sit at the front of the funnel, not as a profile field a player can edit later, because a wrong answer retrospectively invalidates the consent you relied on.
Audit telemetry against section 9(3), not against consent
The usual compliance question is "do we have consent for this?". Here the question is "does this constitute tracking or behavioural monitoring of a child?" - because if it does, consent is irrelevant. Inventory every event you collect and every model you feed, then decide what a minor's session may emit at all.
Split the ad stack by age
Targeted advertising directed at children is prohibited outright. If your monetisation cannot distinguish a minor's session, it cannot comply - so contextual-only inventory for under-eighteens is usually the smallest change that works, and it needs to hold across your mediation partners too.
Plan the fifty-lakh crossing early
Retention duties and the forty-eight-hour notice job arrive at fifty lakh registered users. That is reachable on a single successful title, so the engineering should exist before the marketing does.
Sequence the work
The same controls as above, in the order they are worth doing. Each names the evidence you would put in front of an auditor, because a control you cannot evidence is a control you cannot prove you had.
Build the foundation
Get the lawful basis and the roles right. Everything else assumes these are settled.
- Register a playerPut age assurance at the front of the funnel, before any gameplay telemetry is collected, and make the result a property of the session rather than an editable profile field.Evidence: The parental consent record, the method used to verify it, and the age status attached to each session.
Operationalise it
Turn the basis into systems that run without anyone remembering to run them.
- Run a game sessionDecide per event whether it is necessary to operate the game or whether it builds a behavioural profile, and stop the second category at the client for child sessions rather than filtering it downstream.Evidence: An event inventory marking each event as operational or behavioural, and proof that behavioural events are absent from child sessions.
- Monetise the gameContextual-only inventory for under-eighteen sessions, verified across every mediation partner rather than assumed from a flag you pass downstream.Evidence: Mediation configuration per age band, and a test that a child session never receives a targeted creative.
- Hold a lapsed accountRecord last approach as a first-class event from launch, because the threshold is reachable on a single hit title.Evidence: Erasure job logs with the computed date per player and the notice actually sent.
Section and Schedule references above point at the statute itself. Read them in context in the full text of the Act, or against the MeitY publication. This is an educational summary, not legal advice for your organisation.
Online gaming: common questions
Is a child under the DPDP Act anyone under 18?
Yes. The Act defines a child as an individual who has not completed eighteen years of age. This is higher than the thirteen-plus threshold most international platforms are built to, and it is the single assumption most likely to be wrong in a codebase ported from a COPPA or GDPR design.
Can a parent consent to behavioural monitoring of their child?
No. Section 9(1) and section 9(3) do different work. Section 9(1) makes parental consent the gateway to processing a child's data at all. Section 9(3) is a prohibition on specific activities, and it is not drafted as a default that consent can displace. The only route to relief is a section 9(5) notification, granted by the Central Government to a specific Data Fiduciary.
Do the children's rules apply to us if we do not target children?
The obligations attach to processing a child's personal data, not to whether children are your intended audience. If under-eighteens are in fact using the service, the duties engage. That is why age assurance, rather than a terms-of-service age limit, is the operative control.
Know this well enough to prove it
The certification is a free, graded 15-question exam covering the Act end to end, not just this sector. Pass mark is 70%.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against Online gaming implementation guide. Educational information, not legal advice.