Quick Answer
Gaming companies operating in India collect personal data including account details, payment information, gameplay behaviour, and in some cases biometric or location data. Under the DPDP Act 2023, gaming platforms targeting Indian users — even if hosted abroad — must comply with consent, privacy notice, and data retention requirements. Processing data of players under 18 requires verifiable parental consent.
Quick AnswerOnline gaming companies must obtain verifiable parental consent for players under 18, restrict targeting of minors, and clearly disclose all data collected during gameplay. Non-compliance can attract penalties up to ₹200 crore.
DPDP Compliance Checklist
- Implement age-verification at onboarding — block under-18 accounts or route to parental consent flow
- Obtain explicit consent for gameplay analytics, behavioural profiling, and ad targeting
- Publish a clear privacy notice listing all third-party SDKs that collect data
- Allow players to delete accounts and all associated personal data on request
- Audit loot-box and in-app purchase flows for financial data compliance
- Review fantasy sports data use — restrict personal data use to platform purposes only
- Train customer support on DSAR (data subject access request) processing
- Implement geo-restriction for states where online gaming is banned — avoid data collection there
- Maintain a data processing register for all gameplay telemetry
- Conduct annual privacy impact assessment for new game features
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Does DPDP apply to free-to-play games?+
Yes. Any game that collects user data — even just a device ID or email — is subject to DPDP Act 2023. Free-to-play status is irrelevant.
How should gaming companies handle minor players?+
DPDP requires verifiable parental consent before processing data of users under 18. Gaming platforms must implement robust age verification — not just a checkbox.
What about cross-border data sharing with game publishers?+
Cross-border data transfers require the data principal's consent and must comply with any government-notified restrictions on transfer destinations.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
