Your fastest-growing segmentmay legally be children.

Gaming measures behaviour better than any other industry. Section 9 limits exactly that for anyone under eighteen.

In one line: Gaming platforms must obtain verifiable parental consent for users under 18, avoid tracking, behavioural monitoring and targeted advertising directed at children, and, for large gaming intermediaries, erase data of users inactive for three years under the Rules.

The estate · GamingHover to inspect

Engagement is the product. For children, it is the risk.

The scene

The age gate asked players to type a year of birth. Twelve-year-olds learned to type 2001 in their first week. The platform's retention team built its best campaigns on their play patterns.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
An age gate solves it. A self-declared year is not verification. Design age assurance that a regulator would call reasonable.
Behavioural data is anonymous. Data linked to an account or device identifier is personal data. Treat player telemetry as personal data by default.
Dormant players are future revenue. The Rules set a three-year erasure window for large gaming intermediaries. Plan erasure into the lifecycle, with notice.

Advertising in games

In-game ads that target on behaviour are targeted advertising. Directed at children, Section 9(3) restricts it.

The full Gaming briefing

3 deep dives
Deep dive 01→

Twelve-year-olds learn to type 2001 in a week.

If the gate is easy to lie to, it is not a gate.
Deep dive 02→

Engagement is the product. For children, it is the risk.

Every event you log is a sentence in a file about a person.
Deep dive 03→

Dormant players are not future revenue.

The player logged off. The clock started.

Monday morning

  1. 01Estimate the share of players under 18. Assume it is higher.
  2. 02List every behavioural event you log.
  3. 03Review which campaigns use them for players who may be children.

Questions, answered plainly

How does DPDPA affect online gaming companies?

Gaming platforms must obtain verifiable parental consent for users under 18, avoid tracking, behavioural monitoring and targeted advertising directed at children, and, for large gaming intermediaries, erase data of users inactive for three years under the Rules.

Is a self-declared age gate enough under DPDPA?

The Rules require Data Fiduciaries to adopt appropriate measures to ensure verifiable parental consent. A self-declared birth year alone is unlikely to be seen as sufficient where children are likely users.

Sector · Government vendorsThe State's exemption is not your exemption.Read → Sector · Banking & BFSIBanks keep everything. The law now asks why.Read → Sector · Fintech & NBFCYour onboarding takes ninety seconds. Your liability lasts years.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner