Twelve-year-olds learnto type 2001 in a week.
An age gate that anyone can pass is a sign, not a gate.
In one line: Where children are likely users, platforms must obtain verifiable parental consent before processing their data, which requires reasonable steps to establish age and parental identity.
If the gate is easy to lie to, it is not a gate.
The scene
The platform's analytics showed a spike of users born on 1 January 2001. They played after school, bought skins with gift cards and chatted in slang no adult uses.
Where the thinking breaks
Signals and escalation
Combine declared age with behavioural signals, payment method and device context. Escalate to verified parental consent where signals suggest a child.
Monday morning
- 01Chart declared birth years. Look for spikes.
- 02Estimate the true share of under-18 players.
- 03Design the escalation path to parental consent.
Questions, answered plainly
Do gaming platforms need age verification under DPDPA?
Where children are likely users, platforms must obtain verifiable parental consent before processing their data, which requires reasonable steps to establish age and parental identity.
Is a self-declared age gate compliant with DPDPA?
A self-declared birth year alone is unlikely to be sufficient where children are likely users, given the Rules' requirement for due diligence in verifying parental consent.
Tell us where your data sits.We'll show you where the exposure is.
A partner replies within one working day, with a first view on your penalty exposure.
Speak to a partner