- Home
- Industries
- DPDP for gaming and apps
Industry
DPDP for gaming and apps
Games collect device IDs, chat, purchases and gameplay telemetry from players who are often under 18. Ad SDKs pass some of it on. DPDP puts limits on each step.
Short answer
Players under 18 are children under DPDP, so their data needs verifiable parental consent (s.9(1), Rule 10), and tracking, behavioural monitoring and targeted advertising directed at them are barred (s.9(3)). Online gaming intermediaries with at least 50 lakh registered users in India fall in the Rule 8 Third Schedule: personal data is erased three years after the player last approached the platform or exercised rights, with at least 48 hours' notice. These duties begin on 13 May 2027.
Where personal data sits in a game
- Accounts: name, email or phone, date of birth and linked social logins.
- Device data: advertising IDs, device model, IP address and location.
- Gameplay telemetry: sessions, levels, spend and crash logs tied to a player ID.
- Social features: chat, voice, friend lists and user-generated content.
- Payments: in-app purchase records from app stores and payment partners.
- Ad and analytics SDKs: third-party code that collects device identifiers and behaviour, often for targeted ads.
- Support and moderation: tickets, player reports and ban records.
Much of this flows through code you did not write. An SDK added for ads, attribution or crash reports runs inside your app, so what it collects is part of your processing. Keep a list per build and review it at every release.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Parental consent | s.9(1), Rule 10 | If players may be under 18, check a parent is an identifiable adult and get the parent's consent before processing the child's data. |
| No tracking or targeted ads at children | s.9(3) | Turn off behavioural ads and tracking for under-18 players, including what runs inside third-party SDKs. |
| No detrimental effect | s.9(2) | No processing likely to harm a child's well-being. Review features such as open chat with strangers against this test. |
| Exemptions | Rule 12, Fourth Schedule Part B | Part B lists purposes such as age verification, each only within its stated conditions. Read them with counsel. |
| Purpose limits on telemetry | s.6 | Consent covers only data necessary for the specified purpose. Telemetry collected to run the game does not cover ad targeting. |
| Third Schedule erasure | Rule 8 | Online gaming intermediaries with at least 50 lakh registered users in India erase three years after the player last approached them or exercised rights, with at least 48 hours' notice first. |
| Breach intimation | Rule 7 | Intimate affected players, which for a child includes the parent, and the Board without delay, with a detailed report within 72 hours. |
Roles: fiduciary or processor
The publisher is the fiduciary for its players. Hosting, analytics and support tools acting on its instructions are processors under contract (s.8(2)).
Ad networks are harder. An ad partner that uses player data to build profiles for its own purposes is deciding a purpose and is a fiduciary for that use. Either way, you chose to embed its SDK, so you need to know what it collects and switch off what s.9(3) bars.
A self-declared birthday tells you a player may be a child. Rule 10 then asks you to check the parent is an identifiable adult before processing. Plan both steps.
A 90-day starting plan
- 01Days 1 to 30: inventory SDKs and telemetry
List every SDK in each build, what it collects and where it sends data. Map each telemetry event to a purpose.
- 02Days 31 to 60: age and parental flows
Add age assurance at account creation, a parental consent flow for under-18s, and a child experience with tracking and targeted ads switched off.
- 03Days 61 to 90: retention and rights
Set retention rules for inactive accounts, add in-app requests and consent withdrawal, and publish the Rule 9 contact.
How TruePrivacy helps
- Consent management records each player's consent per purpose, with SDKs for iOS, Android and React Native and an event log of every withdrawal.
- Parental consent sends the guardian a request by email, records the decision with a timeline and evidence, and lets it be revoked.
- Cookie consent scans your website and web game pages for trackers and categorises them.
- Retention rules keep data for N days from a date field such as last login, then act on expiry, optionally after approval.
- The privacy center lets players and parents submit requests and download their data through a secure link.
Can a game show targeted ads to under-18 players?
No. s.9(3) bars targeted advertising directed at children, along with tracking and behavioural monitoring.
Does Rule 8's three-year erasure apply to every game?
It applies to online gaming intermediaries with at least 50 lakh registered users in India. Other games still erase once the purpose is served (s.8(7)).
Is a birthday prompt enough?
It helps identify children. Rule 10 also requires verifiable consent of a parent, which means checking the parent is an identifiable adult.
Are ad networks our processors?
Only for processing they do on your instructions. A network that uses player data for its own profiling decides its own purpose.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin