The platform's analytics showed a spike of users born on 1 January 2001. They played after school, bought skins with gift cards and chatted in slang no adult uses.
Where the thinking breaks
The unclear thought What it breaks The clearer thought
Self-declaration is industry standard.
The Rules require reasonable due diligence for verifiable parental consent.
Design age assurance proportionate to risk.
We don't target children.
If children are likely users, Section 9 obligations are engaged.
Assume children are present, and design for it.
Signals and escalation
Combine declared age with behavioural signals, payment method and device context. Escalate to verified parental consent where signals suggest a child.
Monday morning
01 Chart declared birth years. Look for spikes.
02 Estimate the true share of under-18 players.
03 Design the escalation path to parental consent.
Questions, answered plainly
Do gaming platforms need age verification under DPDPA? +
Where children are likely users, platforms must obtain verifiable parental consent before processing their data, which requires reasonable steps to establish age and parental identity.
Is a self-declared age gate compliant with DPDPA? +
A self-declared birth year alone is unlikely to be sufficient where children are likely users, given the Rules' requirement for due diligence in verifying parental consent.
Sector · Gaming Your fastest-growing segment may legally be children. Read →
Gaming · Deep dive Engagement is the product. For children, it is the risk. Read →
Gaming · Deep dive Dormant players are not future revenue. Read →
Tell us where your data sits. We'll show you where the exposure is.
A partner replies within one working day, with a first view on your penalty exposure.
Speak to a partner →
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
