DPDP Act for Online Gaming & Social Media Platforms
Online games, social networks, messaging apps and creator platforms have huge user bases, many of them teenagers, and they run on profiles, behaviour data and engagement algorithms. The DPDP Act and Rules single these platforms out in two ways: the children's-data rules and the dormant-account erasure rule for large platforms.
Three things matter most. First, a user under 18 is a child: you need verifiable parental consent and cannot track, monitor behaviour or target ads at them, unless an exemption applies. Second, platforms above the user thresholds in the Third Schedule must erase accounts inactive for the set period, after a 48-hour warning. Third, very large platforms are strong candidates for Significant Data Fiduciary status. Most duties take effect on 13 May 2027.
Who this covers
Online game publishers and platforms are Data Fiduciaries for player accounts, chat, purchases and behaviour data.
Social networks, messaging and community apps are fiduciaries for profiles, content, contacts and activity logs.
Creator, streaming and short-video platforms hold audience data, creator payouts and viewing behaviour.
Ad, analytics, payment and moderation vendors are usually Data Processors.
Parents and young users are Data Principals whose consent and rights are central to the design.
Personal data you are likely to hold
Key provisions for Gaming & Social Media
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Verifiable parental consent for children, and no tracking, behavioural monitoring or targeted advertising aimed at them.
Itemised notice and consent that is specific, free and as easy to withdraw as to give.
Security safeguards, breach intimation, erasure when the purpose ends and processor contracts.
Large platforms are likely candidates for Significant Data Fiduciary status.
Foreign platforms with users in India are covered.
Hosting and processing abroad are allowed unless a country is restricted.
Failing to protect children's data can attract penalties up to ₹200 crore.
01Children, age checks and parental consent
Anyone under 18 is a child. For a gaming or social platform this is the central compliance question, because many users are teenagers. Section 9 requires verifiable consent of a parent or lawful guardian and bars tracking, behavioural monitoring and targeted advertising directed at children.
- Decide your position. Either exclude under-18s with a real age gate, or build a child-safe experience with parental consent.
- Verify the parent. Rule 10 explains how to check the person consenting is an adult and the child's parent.
- Switch off the engagement machine for children. No behavioural advertising, no profiling for targeting, and no features designed to exploit a child's attention in ways that harm well-being.
- Do not rely on the exemptions. Rule 12 exempts health, education and a few other classes. Entertainment platforms are not among them.
02Dormant accounts and the 48-hour warning
Rule 8 and the Third Schedule set a retention clock for large platforms in listed classes, which include online gaming intermediaries and e-commerce entities above user thresholds. Check the Third Schedule for exact classes, thresholds and periods, and whether social media intermediaries are listed when you read it. Where a class applies, personal data must be erased after the specified period from the user's last interaction, unless law requires you to keep it. At least 48 hours before erasure you must tell the user; if they log in or contact you in that window, the clock resets.
Build it as a proper workflow: a dormancy flag, a notice by email or SMS, a reversal when the user returns, and erasure across backups, analytics stores and vendors. Keep legally required records such as financial transactions. Separately, every fiduciary must keep processing logs for at least one year.
03Profiling, recommendations and advertising
Recommendation feeds, matchmaking and ad targeting are central to how these platforms work. For adults they are allowed, but each use must be covered by the notice and, for optional uses such as personalised ads, consent that can be refused or withdrawn without losing the core service.
- Separate consent for personalised advertising from consent to use the service.
- Tell users which partners receive their data, including ad networks and analytics SDKs.
- If notified as a Significant Data Fiduciary, Rule 13 adds a duty to check that algorithmic tools do not put users' rights at risk.
- Explain, in plain language, the main signals your feed uses.
04User content, messages and moderation
Users upload content containing other people's personal data: photos, names, phone numbers, chats. You are a Data Fiduciary for what you do with it, such as storing, analysing and showing it to others.
- Provide a way to report and remove personal data posted about someone else.
- Limit staff access to private messages and content, and log every access.
- Treat moderation and abuse data as sensitive, keep it only as long as needed and protect it.
- The IT Act and intermediary rules continue, including takedown and traceability duties. Section 38 makes the Act work alongside them.
05Security, breaches and scale
Account takeovers, credential stuffing, leaked chat logs and exposed databases are the typical incidents. Rule 6 sets the baseline. After a breach you must tell each affected user and the Board, with a detailed report within 72 hours under Rule 7. With millions of users, prepare templates and in-app notification ahead of time. Security failures carry the highest penalty ceiling, up to ₹250 crore.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Without verifiable parental consent you cannot process their data lawfully. Block the account or route it to a parental-consent flow, and turn off ads and behavioural tracking.
If they log in during the 48-hour window the clock resets and the data stays. If not, erase it, except records the law requires.
Review it against the child-protection duties. Behavioural monitoring and targeting aimed at children are barred, and the practice may harm well-being.
Provide a route to request removal, check the request, and act promptly where the data should not be shown.
Contain, investigate, tell affected users and the Board, and file the detailed report within 72 hours.
Compliance checklist
Common mistakes to avoid
Relying on a date-of-birth box that a 12-year-old can bypass in two seconds.
Running behavioural ads on accounts that may belong to children.
Treating dormant-account erasure as a database clean-up with no warning to the user.
Letting every moderator or support agent read any private message.
Assuming a foreign-based platform is outside the Act.
Common questions
Is a teenager a child under the DPDP Act?
Yes. A child is any person under 18, so teenagers need parental consent unless an exemption applies.
Do games and social platforms get an exemption for children's data?
Not by default. The exemptions in Rule 12 and the Fourth Schedule cover classes such as healthcare and education and specific purposes. Entertainment platforms should not assume they are covered.
Do we have to delete inactive accounts?
If you are in a Third Schedule class and above its user threshold, yes, after the specified period and a 48-hour warning. Everyone else must still erase data once its purpose ends.
Is a foreign social network covered?
Yes, if it processes personal data in connection with offering services to people in India.
Can we keep using user data to personalise the feed?
For adults, yes, within the purposes in your notice. Optional uses such as personalised ads need consent. For children, behavioural monitoring and targeting are barred.
Will we be a Significant Data Fiduciary?
Only if the Central Government notifies you, based on factors such as volume and sensitivity of data and risk to users. Large platforms should prepare for annual audits and impact assessments.