PROTECTION OF MINORS
by deeming that the parent or lawful guardian has consented to the minor’s access and engagement with the game (even in cases where they had not). The DPDP Act moves away from the deemed consent model and obligates all data fiduciaries to obtain verifiable parental consent (VPC) before processing any personal data of minors 4 . Game publishers (or the relevant data fiduciary) have two key obligations: first, to ensure that the person identifying as the parent / guardian are themselves an adult and second, that the person is identifiable against the details submitted by the person 5 . The standard under Indian laws may differ from what publishers are accustomed to in other jurisdictions. For example, the EU’s General Data Protection Regulation (GDPR) obligates data controllers offering information society services to minors to “verify” that the consent is provided by the parent and make “reasonable efforts to verify” that the parent or guardian did indeed give consent 6 , whereas the DPDP Act expects that consent is also “verifiable” or “identifiable” against a document or secondary source 7 . Mechanisms to achieve VPC are not codified currently under the DPDP Act. The Data Protection Board of India may provide guidance closer to the DPDP Act’s full enforcement in May 2027. Until then, publishers may benefit from establishing internal processes that demonstrate an effort to verify the identity of the parent / lawful guardian against the requirements of the DPDP Act. A good starting point is to rely on existing KYC solutions (e.g., DigiLocker, e-KYC, real-time video-based verification, etc.) that verify identity documents
against certain markers or government databases.
Zero-knowledge proofs 8 , maintaining auditable consent logs, and features disabling minors from changing privacy choices are some good practices that the industry is exploring 9 . Stakeholders may also seek guidance from measures such as providing a form for the parent to complete and mail back, maintaining a toll-free number for parents to call in their consent etc. 10 , that are acknowledged for compliance with the Children’s Online Privacy Protection Act (COPPA) in the US. In any case, with no codified standard under the DPDP Act, the obligation rests with the data fiduciary to demonstrate the sufficiency of the technological and organisational measures and ensure that their data processors follow suit. Like the COPPA or the GDPR, the DPDP Act provides certain exemptions. The VPC obligation is inapplicable when processing is undertaken by educational institutions, healthcare professionals, creche service providers, etc. or for purposes where processing is in the child’s interest or for their safety. 11 Publishers of educational games may thus experience an easier compliance journey if they process data within the statutory limits and with due regard to the applicability of the exemptions. Behavioural analytics and tracking of minors Behavioural analytics are routinely employed in online games to foster engagement 12 . Tracking and amassing multiple
4 Section 9(1) of the DPDP Act. 5 Rules 10(1) and 10(2) of the Digital Personal Data Protection Rules 2025. 6 Article 8 of GDPR 7 Section 9 of the DPDP Act read with Rule 10 of the Digital Personal Data Protection Rules 2025 8 A term coined for privacy-preserving verification measures that allow a platform to confirm a specific attribute about a user (e.g., age), without requiring the user to disclose the underlying personal data used to establish that attribute 9 Martin Sas et al., ‘Informing Children about Privacy: A Review and Assessment of Age-Appropriate Information Designs in Kids-Oriented F2P Video Games’ (ACM Digital Library, 2023). 10 Id ., Section 312.5(b). 11 Rule 12 of the Digital Personal Data Protection Rules 2025 read with its Fourth Schedule 12 Leon Xiao, ‘Failing to protect the Online Consumer: Poor Compliance with Dutch loot box and Video Game Consumer Protection Guidelines’ (2025) International Journal of Law and Information Technology 33
PAGE 24
IMGL MAGAZINE | SEPTEMBER 2026
Made with FlippingBook flipbook maker