DPDP for Online Gaming

Does an online gaming platform have to delete my data if I stop playing?

If it is a gaming intermediary with at least fifty lakh registered users in India, yes. It has to delete three years after whichever came last: your last interaction, the last time you exercised a right, or the day the Rules commenced. Anything a law requires it to keep still stays, and keeping your account reachable, or a stored token, is carved out.

Smaller platforms are on the ordinary rule instead. Delete once the reason for holding it has gone, unless a law requires otherwise.

ACT + RULES · Section 8(7); Rule 8(1), Third Schedule item 2.

Can a gaming platform keep my gameplay and payment data after I delete the account?

The test is whether the reason for holding it is still being served, not the act of deleting. Closing the account is strong evidence that it is not.

So holding on to it after that only works where a law requires it, or where some other stated reason genuinely remains, such as settling a payment dispute that is still open.

ACT · Section 8(7).

Can they use my data to show me ads for other games or products?

Only if you agreed to that specifically. Signing up to play does not carry over into being advertised to across other games and products.

ACT · Section 6.

Are there special rules if children play on the platform?

Yes, and they are strict. A parent's verifiable consent is needed before a child's information is handled at all. Advertising aimed at children is banned outright, and so is tracking or behavioural monitoring of them.

The narrow exceptions in the Rules cover things like education, health and safety. An ordinary gaming platform is not among them.

ACT · Section 9; RULES · Fourth Schedule.

Can a gaming platform share my data with advertisers or other companies?

Not on the strength of your having signed up. Passing your details to an advertiser, an analytics firm or another company for their own purposes is a separate purpose, and it needs its own reason, normally you agreeing to it specifically.

Where the other company is working for the platform rather than for itself, the platform has to have a proper contract in place. And the platform stays answerable for what that company does, whatever the contract between them says.

ACT · Sections 6, 8(1) and 8(2).

The game asked for my date of birth. Why does that matter so much?

Because everything changes if you are under eighteen. Below that, a parent's verifiable consent is needed before the platform handles your information at all, advertising aimed at you is banned outright, and so is tracking or behavioural monitoring.

Which is why the platform has to make a real effort to know. Taking a typed date at face value, when the duties that follow from it are that strict, is a thin basis on which to conclude that a player is an adult.

ACT · Sections 9(1), 9(3) and 2(f).

A tick box saying you are over 18 is enough for us to treat you as an adult.

It is not. Where someone is consenting as a parent, the platform has to do real checking that the person is an identifiable adult, against reliable identity and age details or a virtual token. A self declaration box is not verifiable consent.

We must keep your data for three years under the law.

The three year period applies only to gaming intermediaries with fifty lakh or more registered users in India, and it is the point at which they have to erase. Below that, the ordinary duty to delete once the reason has gone applies instead.

In game offers shown to under 18 players are not advertising.

Advertising aimed at children is barred outright. What the offer is called does not change what it is.