Co-reported with Sarvesh Mathi
India’s IT Ministry on April 6 notified new rules to regulate the online gaming industry, including online real money gaming.
These rules, which come as an amendment to the IT Rules, 2021, largely leave the industry to self-regulate through self-regulatory bodies that the IT Ministry will approve. Online gaming platforms can also only host real money games verified by a self-regulatory body and cannot host any game (real money or not) that causes “harm.”
Online gaming platforms are also subject to many of the same requirements applicable to social media platforms under the IT Rules, 2021, such as setting up grievance redressal, following due diligence requirements etc.
The contours of the rules remain substantively similar to the rules proposed in January this year, which we have summarised in detail.
STAY ON TOP OF TECH POLICY: Our daily newsletter with top stories from MediaNama and around the world, delivered to your inbox before 9 AM. Click here to sign up today!
Are gaming companies still being treated as intermediaries?
New definitions for online games and online gaming intermediaries are on the cards. Online games are defined as “a game that is offered on the Internet and is accessible by a user through a computer resource or an intermediary”. An online gaming intermediary is “any intermediary that enables the users of its computer resource to access one or more online games”. New categories of online games are introduced too:
- Online real money game: A game where “a user makes a deposit in cash or kind with the expectation of earning winnings on that deposit”. Winnings mean any cash or kind prize that is distributed or intended to be distributed to online game users based on their performance in the game, and the game’s rules.
- Permissible online game: An online real money game or any other online game that isn’t an online real money game.
- Permissible online real money game: Online real money games verified by an online gaming self-regulatory body.
What the January version said: They proposed what was then a new class of intermediaries—”online gaming intermediaries”. These were defined as intermediaries offering one or more online games. Online games were defined as “a game that is offered on the Internet and is accessible by a user through a computer resource if he makes a deposit with the expectation of earning winnings”.
What people said on January’s proposal: Some argued that gaming companies are publishers of content, and can’t be regulated as intermediaries, which act as mere conduits of online interactions. This distinction hasn’t been explicitly clarified—instead more types of online games that intermediaries could host have been added to the mix, rather than just games involving deposits and winnings.
“I think it is very clear they are trying to regulate publishers under the garb of intermediaries,” said gaming lawyer Jay Sayta at our January event on the rules. “They want to bypass the parliamentary statute and they want to fit something which is currently not fitting under the existing law…These rules try to apply the intermediary definition to a publisher which travels beyond the scope of the IT Act.”
In February, the Indian government clarified that publishers are not considered intermediaries under the IT Act.
Read Nikhil’s quick take on the rules here.
Is RBI-level KYC verification required for players now? Does an individual have to be verified at the time of creating an account?
What’s new: Before accepting deposits in cash or kind from any user for a permissible online real-money game, online gaming intermediaries should identify such users and verify their identities. Procedures followed by Reserve Bank Of India-regulated entities when verifying and identifying a customer at the beginning of an account-based relationship shall apply here.
What the January version said: Online gaming platforms must verify the identity of a user when they create an account with the platform. Identity should be verified according to know-your-customer norms laid out by the Reserve Bank of India. The platform’s verification procedure should be conveyed to the user. Gaming platforms should also allow Indian users to “voluntarily verify their accounts by using any appropriate mechanism, including the active Indian mobile number of such users”. They should provide these users with a demonstrable mark of verification visible to all users.
Past expert comments: RBI-level KYC requirements may hinder users simply testing out online gaming platforms, said experts speaking at MediaNama’s January event on the rules.
“It will not be ideal at the time of registration because you may play the game for free to test it out whether you like it then you can put in some money,” said Dhruv Garg then, a lawyer affiliated with the All India Gaming Federation. “Why do you want KYC data when someone just wants to test it out? There should be no KYC when they deposit within Rs. 10, 000. It might be a good threshold, if you deposit more than Rs. 10,000 or withdraw more than Rs. 10,000, then KYC is good.”
MediaNama’s Editor Nikhil Pahwa added that KYC requirements can add privacy risks too. “The places where your KYC data is going to get stored are going to become honey pots which is a personal safety, security risk,” argued Pahwa. “Your information can get leaked, it can get scammed. KYC seems to be an integral part of government regulations now. KYC has not helped prevent spam. So what is KYC solving for? KYC is an abdication of responsibility.”
How will online gaming self-regulatory bodies function?
The rules allow self-regulation of online gaming through self-regulatory bodies (SRBs). These SRBs are responsible for verifying an online real money game as a permissible online real money game.
Who can be an SRB and how many SRBs can be there: The IT Ministry has the power to designate as many online gaming self-regulatory bodies as it may consider necessary. Entities that fulfill the following criteria can apply with the Ministry to become an SRB:
- Must be a Section 8 (non-profit) company
- Its members are representative of the the gaming industry
- Its members have been offering and promoting online games in a responsible manner
- Its Board of Directors consist of reputable individuals who do not have any conflict of interest and possess the necessary knowledge and experience. The Board should include members from various fields such as education, psychology, child rights, public policy, information, and communications technology, etc.
- The SRB’s memorandum of association (MoA) and articles of association (AoA) should contain provisions relating to its functions, information about grievance redressal mechanism, the criteria for acceptance of members, and safeguards that the body functions “in a manner free from conflict of interest and at arm‟s length from its members.” Additionally, some parts of MoA and AoA can only be amended with prior approval of the IT Ministry.
- The SRB should have “sufficient capacity, including financial capacity, to perform its functions as an online gaming self-regulatory body under these rules.”
Process for verification and approval of real money games: Any member of an SRB can file an application seeking approval for an online real money game. The SRB can declare such a game a permissible online real money game after taking into account that:
- The online real money game does not involve wagering on any outcome; and
- The online gaming intermediary and such online game is in compliance with the due diligence requirements under Rule 3 and 4 of the IT Rules
- The game and intermediary follow all “the provisions of any law relating to the age at which an individual is competent to enter into a contract”; currently this is 18 years old
- The game and the intermediary follow the framework made by SRB
The SRB may initially rely on the information provided by the online gaming intermediary and declare the game as a permissible online real money game for a maximum period of 3 months. Within this time, the SRB is required to complete its full inquiry and declare whether the game is permissible or not. If not, the applicant needs to be informed—in writing—the reasons why the game doesn’t meet the requirements under the rules.
Revoking approval of games: An SRB can suspend or revoke the verification of any game after giving the applicant member an opportunity of being heard, if it is satisfied that the game is not in compliance with these rules.
Framework for verification of games: An SRB must publish its framework for verifying an online real money game, which must include the following:
- Game should not be “against the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States and public order”
- There should be “safeguards against user harm, including self-harm and psychological harm”
- There should be “measures to safeguard children, including measures for parental or access control and classifying online games through age-rating mechanism, based on the nature and type of content”
- There should be “measures to safeguard users against the risk of gaming addiction, financial loss and financial fraud, including repeated warning messages at higher frequency beyond a reasonable duration for a gaming session and provision to enable a user to exclude himself upon user-defined limits being reached for time or money spent.”
List of permissible games must be published: An SRB must publish and maintain an updated list of all permissible online real money games that are verified, “along with the details of such online games including the details of the applicant, the dates and period of validity of the verification, the reasons of such verification and the details of the suspension or revocation, if any, of verification of any online real money game.”
- Section 69A orders: When issuing a blocking order under Section 69A of the IT Act, the Central Government will consider the details published in this list.
List of members: An SRB must publish and maintain an updated list of all its members, “whether present or former, the dates of their acceptance as member, their corporate or business-related identity number and other details, and the details of suspension or revocation of membership of any member.”
Verification marks provided by SRBs must be displayed by gaming platforms: An online gaming intermediary which enables access to a verified online real money game should display a demonstrable and visible mark of verification.
Grievance redressal framework must be published: SRBs must publish on their website or app the framework for redressal of grievances and the contact details of the Grievance Officer to whom a user can file a complaint. The complaint must be acknowledged within 24 hours and addressed within 15 days.
Opportunity to rectify: If the IT Ministry finds that an online real money game verified by an SRB is not in conformity with the Rules, it will give the SRB an opportunity of being heard and direct it to take measures to rectify the same.
Suspending or revoking the designation of an SRB: If the IT Ministry is satisfied that it is necessary to suspend or revoke the designation of an SRB, it may do so after giving the SRB an opportunity of being heard and recording its reasons in writing. The Ministry may give interim direction to allow games verified by the SRB to continue being permissible.
What the old rules said: Section 8 companies or societies registered under the Societies Registration Act, 1860, can apply to the IT Ministry to be a self-regulatory body. These bodies should function independently from gaming platforms. They can grant membership to gaming platforms. These bodies are responsible for “verifying” and registering online games according to their own framework—only these games can be hosted by gaming platforms. This framework should also “secure conformity with the interests referred to in section 69A of the [IT] Act”. The body should communicate the list of registered games to the government. If the self-regulatory body is not compliant with the IT Rules, the IT Ministry may direct it to take measures to rectify the situation, or even suspend its registration.
Past expert comments: “When a body is a caged parrot, how does it expect to hold its masters accountable? How do we solve this inherent contradiction between funding and the structure of the body [which the rules haven’t solved for]?” asked gaming lawyer Jay Sayta on the proposed self-regulatory body mechanism in January.
How will children’s access to online gaming be regulated under the rules?
Platforms are not to host games that relate or encourage money laundering or gambling, or online games that cause user harm. User harm and harm mean “any effect which is detrimental to a user or child”.
Self-regulatory bodies should publicise frameworks for verifying online games, which include assessing “the measures to safeguard children, including measures for parental or access control and classifying online games through age-rating mechanism, based on the nature and type of content.”
Multiple mentions of harm, outside of harms to children: In a separate section on intermediary due diligence obligations for non-online real money games, the government defines user harm as “any effect which is detrimental to users”
Another factor for self-regulatory bodies’ verification frameworks to consider: the game’s safeguards against user harm. Here, harm includes self harm and psychological harm.
Online real money games should satisfy contract laws: Self-regulatory bodies may declare online real money games as permissible if it is satisfied that the game is in compliance with the Rules’ provision, its own self-regulatory framework, and “the provisions of any law relating to the age at which an individual is competent to enter into a contract”.
What the old rules said: On certain conditions, self-regulatory bodies may “register any online game targeted at those above the age of 18”. When verifying online games, self-regulatory bodies should take into account any “appropriate measures to be undertaken to safeguard children”. On a separate note, users are not allowed to promote online games that are illegal under some of India’s laws (like gambling or betting games), or targeted at children under the age of 18. The government also has powers to regulate any other game as an online game, as long as the IT Ministry is satisfied that it may cause addiction or other harm among children, among other factors.
Past expert comments: Speaking to MediaNama on the January rules, IndusLaw’s Ranjana Adhikari noted that the threshold for harm hadn’t been specified. “By including grounds like addiction and harms to children here, they’ve automatically given them statutory power without providing a threshold that gaming companies need to meet,” Adhikari argued. “This provision could be used to pull the plug on games without having a strong basis for that decision. That would really worry the industry.”
How are large casual games covered under the rules?
Due diligence obligations under Rule 3 apply to online gaming intermediaries—which enable user access to one or more “online games”, which may include casual games. However, additional due diligence obligations under Rule 4A only apply to online gaming intermediaries hosting online real money games.
Obligations for non-online real money games: The government may direct intermediaries to observe online real money game obligations for online games if it considers “it necessary to do so in the interest of the sovereignty and integrity of India or security of the State or friendly relations with foreign States or public order, or preventing user harm”. Here, user harm means “any effect which is detrimental to users”.
What the old rules said: Online games were simply defined as “a game that is offered on the Internet and is accessible by a user through a computer resource if he makes a deposit with the expectation of earning winnings”.
Past expert comments: There’s a fine line between real-money and casual online games, noted MediaNama’s Editor Nikhil Pahwa in February.
“The proposed rules say that if you put money into a game with the expectation of a reward – whether it is monetary reward or in kind, then it is a real money game. Now, this is a little bit tricky. Let’s say if I’m playing Clash of Clans, I will buy coins that I can basically use to get rewards – like an upgrade or speed-up some timers. And If I’m playing e-football, I might buy coins which I can use for a lucky draw – to get (win) players (like Messi or Ronaldo). And that’s why a lot of casual games could also be covered by real money gaming, which is a problem.”
Other significant changes
Misinformation clause: Platforms cannot host misinformation, now including “in respect of any business of the Central Government, [which] is identified as fake or false or misleading by such fact check unit of the Central Government as the Ministry may, by notification published in the Official Gazette, specify”.
Sharing information for government investigations: Online gaming intermediaries enabling user access to any permissible online real money game should share requested information not later than twenty-four hours from receiving the order.
No financing players to play real money online games: “An online gaming intermediary who enables the users to access any permissible online real money game shall not itself finance by way of credit or enable financing to be offered by third party for the purpose of playing such online game,” the rules add.
Applicability of due diligence and additional due diligence obligations: Obligations under Rules 3 and 4 shall not apply “until the expiry of a period of three months from the date on which at least three online gaming self-regulatory bodies have been designated”. However, the Central government may “direct that the obligations under rules 3 and 4 shall apply in relation to an online game from such date as may be specified” in the gazette before three months are up.
What next?
Different types of platforms may be regulated under separate and specific rules under the forthcoming Digital India Act—which will replace the Information and Technology Act, 2000. Gaming platforms were one of the nine platform types tentatively highlighted by the IT Ministry for separate regulation at a consultation on the law last month.
Whether gaming companies will receive safe harbour protections under these Digital India Act rules remains to be seen:
“If there is a need for safe harbour, who should be entitled to it? The whole logic of safe harbour is that platforms have absolutely no power or control over the content that some other consumer creates on the platform. But, in this day and age, is that really necessary? Is that safe harbour required?” — Rajeev Chandrasekhar, MoS for Electronics and IT
This post is released under a CC-BY-SA 4.0 license. Please feel free to republish on your site, with attribution and a link. Adaptation and rewriting, though allowed, should be true to the original.
Read more
- Reading List: The Impact Of The Draft Online Gaming Rules
- The More Things Seem To Change, The More They Stay The Same: The Impact Of India’s Proposed Online Gaming Rules
- How Will India’s Proposed Self-Regulators Protect Online Gamers And Ensure Responsible Gaming?
- Summary: What Are India’s Proposed Rules For Online Gaming Platforms?
- Eight Major Issues With India’s Proposed Online Gaming Rules
- “A Farrago Of Confusing And Contradictory Provisions”: Jay Sayta’s 5 Concerns With India’s Online Gaming Rules
- Ongoing Saga Of “Disappointing Amendments”: Internet Freedom Foundation On Proposed IT Rules On Gaming
- Quick Take: Is It A Bird, Is It A Plane, Is It A Game?
- India’s Unclear Gaming And Gambling Regulations Are ‘Playing’ With Lives
Note: this piece was updated at 7/4/23 at 10:22 am following editorial inputs.
