Missing Guards And Leaky Gates - The Case For Self-Regulation And Data Privacy In India’s Gaming Industry
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
MISSING GUARDS AND LEAKY GATES: THE CASE FOR
SELF-REGULATION AND DATA PRIVACY IN INDIA’S
GAMING INDUSTRY
Yash Jain, USLS, GGSIPU Introduction India’s gaming landscape has undergone a remarkable transformation from casual offline games to a digital ecosystem that now spans real-money contests, esports, and mobile first platforms. With affordable smartphones, low-cost internet, and increasing digital participation, gaming has become a frontfoot form of entertainment for millions. What was once a niche pastime has evolved into a fast-growing sector drawing interest from investors, startups, and policymakers alike. Mobile gaming alone dominates the space, driven by over 500 million smartphone users in India and contributing significantly to the overall market share. Realmoney games (RMGs), where players pay to compete for monetary rewards, have emerged as one of the most rapidly growing segments. These platforms now attract not only players but also regulatory attention due to their growing economic and legal impact. At the same time, the broader Animation, Visual Effects, Gaming and Comics (AVGC) sector is being recognised as a driver of innovation and employment, with strong potential for global expansion. As India aims to increase its stake in the global gaming economy, the focus must also shift from the tech oriented industry toward creating a clear legal framework and safeguarding user interests in this rapidly changing digital environment.
EVOLVING REGULATORY FRAMEWORKS IN INDIA’S GAMING SECTOR
As the Indian gaming industry has grown in size and complexity, so have the legal challenges surrounding it. In its early years, online gaming largely operated under the broader umbrella of the Information Technology Act, 2000, with oversight from the Ministry of Electronics and Information Technology (MeitY). However, the surge in real-money games and user engagement prompted the government to rethink its regulatory approach.
A significant shift occurred in April 2023 with the introduction of the Information Technology
(Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules1, commonly referred to as the Gaming Rules, 2023. These new rules marked the government's attempt to introduce a structured, co-regulatory model, one that sought to define which real-money games are legally permitted and proposed the creation of Self-Regulatory Bodies (SRBs) to certify them. However, this vision of industry-led regulation encountered hurdles. Concerns about industry neutrality and potential conflicts of interest led the government to take a more direct role in certification and oversight, causing delays in finalising the certification process and enforcement standards. In the absence of a clear and unified national framework, states have begun drafting their own gaming policies, resulting in a patchwork of inconsistent laws. Tamil Nadu, for instance, has proposed rules limiting daily gameplay duration and spending caps for users2. On the other hand, Telangana has opted for a complete ban on real-money online games through amendments to its state gaming laws.3 This regulatory fragmentation has created confusion among stakeholders of platforms and investors to players and legal professionals. The lack of uniformity4 across jurisdictions not only complicates compliance but also risks stalling innovation and user protection efforts in a sector that desperately needs both. With the introduction of the Digital Personal Data Protection (DPDP) Act, 20235, India has taken a significant step toward establishing a formal structure around data governance. For the gaming industry where user data is constantly being collected, analysed, and monetized this law marks a moment of reckoning. Until now, it was common for gaming platforms to bundle user consent into vague, one-sizefits all policies. These so-called "blanket consents" allowed operators to collect personal and 1 Vide G.S.R. 139(E), dated 25.2.2021, published in the Gazette of India, Extra., Pt. II, Sec. 3(i), dated 25.2.2021
2 W.P.Nos.6784, 6794, 6799, 6970, 8832 and 13158 of 2025
3 Section 2 in Telangana Gaming (Amendment) Act, 2017
4 Status Of Gambling In India: The Need For Uniformity
https://indialawjournal.org/status-of-gambling-in-india-the-need-for-uniformity.php
5 THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 (NO. 22 OF 2023)
gameplay data with minimal specificity or transparency. However, under the DPDP Act and IT Rules 20216, such practices will no longer be sufficient. The law requires that consent must now be explicit, informed, unambiguous, and purpose-driven leaving no room for vague permissions hidden deep within lengthy privacy policies. Gaming platforms typically collect a wide range of data: from personal details like name, age, contact information, and location, to financial data such as bank or card details, and behavioural data related to gameplay patterns and preferences. While some of this may fall outside the scope of the Act, most of it qualifies as “personal data7” and therefore demands clear legal justification for its collection and use. The Act also introduces the concept of “legitimate use,8” allowing data to be processed without consent under certain predefined circumstances such as compliance with legal obligations or court orders. However, the boundaries of what constitutes “legitimate” remain narrow, meaning that most data collection in gaming will still need to meet the consent standards. For platforms, this means a fundamental shift in how they approach data governance. They must begin by cataloguing and classifying all types of data they collect distinguishing between personal, non-personal, and publicly available data. This step is essential not only for compliance but also for building trust with users. Privacy policies must be rewritten in a way that is clear, accessible, and justified, explaining exactly why data is being collected and how it is being used. Moreover, platforms should reconsider collecting any data that is not essential to gameplay or user experience. This includes user information gathered for unrelated business purposes that may no longer be defensible under the DPDP framework. While the Act lays the groundwork for data protection, it does not yet provide a comprehensive regulatory structure tailored specifically to gaming. There are still gaps particularly in industry specific standards, ethical safeguards, and enforcement mechanisms. This is where the longstanding demand for self-regulatory bodies becomes relevant. A well-structured, neutral
6 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
7 Section 2(t) “personal data” means any data about an individual who is identifiable by or in relation to such data.
8 Section 7 of THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
industry body could help gaming platforms interpret and implement the DPDP’s provisions more effectively, while also encouraging responsible innovation. A Pause in Self-Regulation, A Push for State Control
In the hope of fostering responsible growth, India’s gaming sector was set to benefit from selfregulatory bodies (SRBs) independent entities meant to certify permissible online games and distinguish them from illegal betting services. This framework was designed to create clarity, legitimacy, and safety for both users and operators, especially in the realm of real-money gaming. But what began as a promising initiative has quietly hit a pause. Despite the government's plan to establish at least three SRBs under the amended IT Rules9, the process has been delayed. Concerns around industry bias and the challenge of finding truly independent bodies have slowed the progress. In the meantime, uncertainty looms largely leaving gaming platforms unsure about how to operate and advertise within the boundaries of the law. With the vacuum growing, the Ministry of Electronics and Information Technology (MeitY) has started to consider stepping in directly10. Instead of waiting for SRBs to take shape, the government may assume control over the approval of games and platforms itself, a move that signals both urgency and caution. This shift wasn’t the original plan, but it reflects a broader reality: the gaming industry is expanding faster than the regulatory mechanisms built to guide it. While the intent behind selfregulation was to let the industry drive responsibly, the current situation suggests that without a reliable structure, the government has little choice but to take the reins. As the conversation continues, one thing is clear: the future of online gaming in India hinges not just on innovation and user growth, but on the strength and clarity of the systems that govern it.
9 The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
10 https://www.livemint.com/industry/online-gaming-self-regulation-hits-roadblock-meity-weighs-directcontrol- 11704104343456.html
Strengthening Safeguards Without Stalling Progress Lessons from countries like South Korea, China, and Vietnam show that overly restrictive approaches such as hard limits on gaming time or spending often fall short of their intended goals. These measures, though well-intended, may not yield the desired impact without thoughtful, evidence-based design. While India navigates its own regulatory challenges, particularly the absence of a functional self-regulatory body (SRB), the introduction of basic protective standards must not be delayed. One such step could be the adoption of a robust age-based game rating system, akin to those successfully used in the UK and US. Frameworks like PEGI and the ESRB have empowered parents to make informed choices by clearly indicating age-appropriate content. In India, a precedent already exists in MeitY’s classification of OTT content into graded categories under the IT Rules, 2021, which has balanced consumer protection with creative freedom. Applying a similar model to the gaming sector could help flag adult content and set up guardrails to limit access for underage users. Practical Solutions for Immediate Implementation Given the interactive and often high-stakes nature of gaming, stronger age verification mechanisms would be essential. A practical starting point could be linking A-rated games to Aadhaar-based OTP verification, ensuring that access to mature content is diligently controlled. Clear procedural standards (SOPs) can be discussed within the industry to support consistent and transparent enforcement. It’s important to avoid viewing online gaming through an all-or-nothing lens. Rather than waiting for a complete regulatory framework to emerge, immediate steps like age ratings and parental guidance tools can offer tangible protections especially for minors without hampering innovation. If India is to maintain its leadership in the digital space, then fostering a gaming environment that is both safe and sustainable must be part of that journey.