India notified amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021[1] (“Gaming Rules”), on April 6, 2023. This is a key step to regulate online gaming at a federal level in India.
Currently, gaming is regulated by states, with different states enacting their own state specific laws, most of which are dated and not designed for online models of business. Consequently, there is inconsistency in how different states view online skill based real money gaming, with some even banning them, despite jurisprudence that such games should not be considered as unlawful per se. This leads to business uncertainty especially since states have divergent views on what’s allowed and what’s not, within their states. Several petitions in different courts in India on such gaming related issues, add to the chaos.
The Gaming Rules are in response to a long-standing industry demand to have a centralised framework for regulating online skill based real money games in India. With the notification of Gaming Rules, the online gaming industry has come under the ambit of Ministry of Electronics and Information Technology (MEITY)[2].
The journey, which officially started in January, 2023, when the first draft of the proposed amendments to the Gaming Rules were released, has seen its logical conclusion after rounds of stakeholder consultations and feedback sessions organised by the government, before the notification of an updated version of the Gaming Rules.
The Gaming Rules are focused on regulating online real money skill-based games. They can be made applicable to free-to-play games under certain circumstances (discussed below). Chance based games played for money or moneys’ worth, with an expectation of winning, are expressly not allowed under the Indian law.
De-Coding the Gaming Rules
What’s a Game?
There are four key definitions relating to games, built into the Gaming Rules.
Online Games, i.e. games which are either free-to-play, or are Permissible Online Real Money Games (where there is a deposit made by a user with an expectation of winnings on that deposit itself), can be offered as per the Gaming Rules.
The term deposit has not been defined in the Gaming Rules. Since the definition of online real money games says that the user has to make a deposit with the expectation of winning on that deposit, it seems that the intent is to cover stakes being placed in a game. The line may, however, become thin if there are elements such as registration fee or subscription charges for the game, and a part of such payments may be used for playing the online game as well.
Who decides if a game is Permissible Online Real Money Game?
Online Gaming Self-Regulatory Bodies (“SRB”)[3], which will be eventually notified by the Government[4], have been given the ability to verify if an online real money game is a permissible online real money game under these Gaming Rules[5]. To do so, they need to ensure, inter alia, that:
(a) The online real money game does not involve wagering on any outcome; and
(b) Is in compliance with its due diligence obligations, and any framework that may be developed by the SRB in pursuance of the Gaming Rules. Such framework may include measures to safeguard against ‘User Harm’, safeguard children, including through age-rating mechanisms, safeguard against addiction risks, financial loss, fraud, issuance of warning messages at higher frequency beyond reasonable duration of gaming session, etc.
Once the verification is complete, the SRB has to publish a list of permissible online real money games on its website and mobile application, along with details such as applicant name, date, period of validity of verification, etc.[6].
While this is a good measure, there are some factors that may become a business hindrance.
First being that gaming companies currently seek views on their formats from self-regulatory bodies on a need basis. They may independently assess their formats, take external legal advisor’s view or the view of a person skilled in gaming to evaluate the skill versus chance elements of the game. Gaming Rules will place the power in the hands of the SRB alone to verify if a game can be offered for real money via the online mode in India.
Secondly, there are many gaming companies that have multiple formats, some of which are updated on a frequent basis to keep the user engaged. If each such update is considered a “new game”, then it will become cumbersome for gaming companies to get approvals every time.
Further, it appears that the SRB’s verification of online real money game formats comes with an expiry date, as they are required to publish details such as period of validity of the verification for each such online real money game. Since SRBs are required to publish the period of validity of the verification, it can be interpreted that the verification is time bound and would require re-verification periodically. If the game has no change, then there shouldn’t be any validity period requirement.
Due diligence obligations of Online Gaming Intermediaries
Online gaming intermediaries[7] are defined to mean an intermediary that enables users to access one or more online games through its computer resource. Online gaming intermediaries have been obligated to discharge due diligence obligations under the Gaming Rules.
These obligations will trigger after three months from the date on which atleast three SRBs have been formed, unless the government notifies applicability of the obligations in relation to any online game from an earlier date[8]. There are many due diligence obligations.
One such obligation is to publish rules and regulations, privacy policy, user agreement (on their website and gaming application)[9] of the online gaming intermediary, and to inform users about any changes to these documents within 24 hours of such a change being effected[10].
An intermediary also has to make reasonable efforts by itself (as well as require it users) to not host, display, publish, modify, transmit, store, update or share information that may inter alia[11]
(a) Relate to an online game that causes user harm. Harm has been defined under the Gaming Rules to mean any effect which is detrimental to a user or child
(b) Relate to a Central Government business, and has been identified as fake or misleading by a fact checking unit of the Central Government (to be notified)[12]
(c) Be in the nature of online games that is not verified as a permissible online game
(d) Be an advertisement or surrogate advertisement or promotion of an online game that is not a permissible online game, or of any online gaming intermediary offering such an online game
(e) Violate any law for the time being in force.
Intermediaries are also obligated to remove or disable access to such information within 36 hours[13] from the receipt of a court order or notification from an appropriate Government or its agency, as the case maybe.
In addition, an online gaming intermediary, which provides users with access to permissible online real money games, is required to provide information and assistance to government authorities for investigation purposes, including any cyber security incidents, within 24 hours of a request being made in this regard[14].
Before hosting or publishing any online game for consideration, intermediaries[15] are also required to ascertain from an online gaming intermediary and verify from SRB that the online game is registered with such SRB and this fact is displayed on its website and mobile application. This requirement will, however, only come into effect from July 6, 2023[16].
In addition, online gaming intermediaries are required to:
(a) Display a demonstrable and visible mark of verification on such online game by the SRB
(b) Implement appropriate mechanisms for receipt of user complaints, complaint tracking mechanisms (by providing ticket number)
(c) Ensure users who register for their services from India or use their services in India voluntarily, verify their accounts using appropriate mechanisms, including through mobile phones. Verified users will be provided with a visible mark of verification, which shall be visible to all users of the service
(d) Retain user information for 180 days after withdrawal or cancellation of registration
(e) Take reasonable security measures to secure its computer resources and information in the manner prescribed under law
(f) Not knowingly do any act (i.e. deploy, install or modify technical configuration of computer resources) to change the natural course of operation of computer resource, thereby circumventing any law
(g) Publish monthly reports proactively with details of complaints received, actions taken, links removed or disabled, etc.
Gaming platforms will now have to review their existing user terms and policies to update them as per the requirements of the Gaming Amendments.
Officers to be appointed by Online Gaming Intermediaries
An online gaming intermediary, which provides access to users of permissible online real money games, is required to appoint:
(h) Grievance Officer[17], who is required to resolve user grievances in a time bound manner (discussed below). Grievance Officer has to be an employee of the online gaming intermediary, and an Indian resident.
(i) Chief compliance officer[18] who will be responsible for compliance with law, and is liable for proceedings related to third-party information, data or communication link hosted by an intermediary. Chief Compliance Officer has to be a key managerial person or senior employee of the online gaming intermediary, and has to be an Indian resident.
(j) Nodal Contact Person[19] who is responsible for 24*7 coordination with law enforcement agencies. Nodal contact person has to be an employee of the online gaming intermediary, and an Indian resident.
What is clear from the above is that the Government wants accountability in India, and hence insists that key officers be Indian residents. This is a good step, as it will help in time bound assistance, especially in safety and security related matters.
As a balancing act, the Gaming Rules now require the government to consider the details published by SRBs with respect to permissible online real money games before issuing any blocking or take down order. While this provision is non-obligatory, it is still a good measure as there is some publicly available data, which the government should ideally consider, before banning apps.
What are the norms prescribed for user verification, deposits and KYC?
Online gaming intermediaries are required to provide the following information to users of any permissible online real money game:
(a) Policy for withdrawal or refunds of deposits made with the expectations of earnings, manner of determination and distribution of winnings, and fee and other charges payable by users
(b) KYC process followed by it to verify users (KYC process is the same as the one that needs to be followed by entities regulated by the RBI for identification and verification of a customer at the commencement of an account-based relationship)
(c) Measures taken to protect user deposits
(d) Framework for verification of online real money games
Since the draft rules were released, gaming platforms have time and again mentioned that it would be to be difficult to comply with the KYC obligations. While the Gaming Rules have limited the above obligations to the time before acceptance of deposit, an opportunity for staged KYC obligations (as is the case with prepaid instruments) may have been lost.
On the positive side, online gaming intermediaries have been strictly prohibited from financing players (by way of credit or enable financing to be offered by third parties), for playing such online games.
What is the Grievance Redressal Mechanism for complaints against the Game?
Tier 1 – At the Online Gaming Intermediary Level
(a) Intermediaries must prominently publish the name of the grievance officer on its website and mobile application. They must acknowledge complaints within 24 hours and resolve them within 15 days.
(b) Request to remove information or links relating to information mentioned in specific rules under Gaming Rules must be resolved within 72 hours.
(c) Request to remove or disable access to content which is obscene, or depicts nudity or sexual acts, including artificially morphed images, must be acted upon within 24 hours.
Tier 2- Grievance Appellate Committees[20]
(a) Central Government has the power to establish one or more Grievance Appellate Committees (“GAC”) vide notification dated January 28, 2023.
(b) Any person aggrieved by the decision of the grievance officer of the intermediary, or whose grievance is not resolved within the prescribed time period can appeal to the GAC within 30 days.
(c) GAC must ideally resolve the appeal within 30 days.
(d) The entire dispute resolution process, including filings, etc., before the GAC shall be via the digital mode only.
(e) GAC orders must be complied with by the intermediary as well as SRBs.
The grievance redressal framework is well-tiered, time bound, and looks at quick resolution. Although, one would have hoped for a three tiered grievance redressal mechanism, just like the OTT, i.e. after the gaming intermediary, an appeal would lie to SRB, before the GAC stage so that GACs aren’t burdened (especially when they have non-gaming matters to deal with as well). We are hopeful that there will be lesser complaints, thereby making the two stage mechanism suffice.
What are the obligations for Online Games other than Online Real Money Games?
The Centre has the power (by notification in official gazette and for reasons to be recorded in writing) to direct an intermediary (which could be wide, to cover Google Play Store, App Store, ISP, etc.) to observe certain obligations in respect of an online game, as if it is a permissible online real money game. Such provisions include:
(a) not to offer any online game which is not verified by SRB (which means the online game will need to be examined and verified by the SRB)[21];
(b) not to put up any information in the nature of advertisement, surrogate advertisement or promotion of an online game that is not a permissible online game, or of an online gaming intermediary[22] (i.e. gaming platform in this case, as it enables users to access the game) offering such an online game;
Further, online gaming intermediaries, in such cases, could be directed to have a physical contact address in India (published on its website and mobile app), implement grievance redressal mechanism as required under the Gaming Rules, follow process for user verification as required under the Gaming Rules, display demonstrable visible registration mark of online game with SRB. The verification process for permissible online real money games will also become applicable to such online games if such provision is invoked by the Central Government. The Government has to specify the period within which the online gaming intermediary has to observe these obligations.
The grounds on which the provision can be invoked vis-à-vis online game are those impacting the interest of the sovereignty and the integrity of India or security of the State or friendly relations with foreign States or public order or for preventing ‘User Harm’.
Since ‘User Harm’ has been defined vaguely under the Gaming Rules to mean any effect, which is detrimental to a user or child, what will constitute as ‘User Harm’ is still open ended, giving wide powers in the hands of the government to invoke this provision. A definition similar to that provided in the proposed data protection legislation[23] could have been included for the purpose of Gaming Rules as well. Since the Gaming Rules are only a few days old, there is no precedence for such provisions getting invoked. It appears that the intent is to consider online free to play games at par with permissible online real money games in exceptional and limited circumstance only. Like in the case of Blue Whale game[24], where the government stepped in and directed the platform to stop making it available in India, due to its harmful and dangerous effect on users. However, this provision could cause worry to online free-to-play gaming operators.
What can be Advertised?
The Gaming Rules emphasise on the roles of (non-gaming) intermediaries, including the likes of social media platforms, App Stores and advertisers. As part of their due diligence obligations, they are required to check with SRBs whether the online game is a permissible online real money game or not, before hosting or publishing or advertising an online game for consideration. Such intermediaries are also required to display on the website, mobile based application or both, such registration.
Further, intermediaries are also restricted from advertising (including surrogate advertising) non-permissible online real money games. The restriction on advertising also applies to advertisements of real money online gaming intermediaries. This is a good step, especially since there have been certain real money gaming platforms that have been aggressively advertising in India despite government warnings[25]. However, it also places a significant burden on non-gaming intermediaries to screen content hosted on their platform, and to check with SRBs if a game, online gaming intermediary or its advertisement can be hosted on their platform.
Conclusion
Sometimes less is more. True to this principle, the Gaming Rules are light touch, placing responsibility on the industry to regulate themselves within the parameters of government prescribed framework. Such a co-regulatory approach, where the government and the industry have joined hands to regulate the eco-system could propel growth of the industry in the long run.
For further information, please contact:
Aarushi Jain, Partner, Cyril Amarchand Mangaldas
aarushi.j@cyrilshroff.com
[1] IT(Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 English.pdf (mib.gov.in) Last updated on: April 7, 2023
[2] Press Information Bureau (pib.gov.in)
[3] Rule 4A (1) of the Gaming Rules.
[4] As per news report dated April 20, 2023 (three) collectives representing 200 Indian online gaming companies were set to reach out to MEITY for recognition as self- regulatory organisations.
Three gaming self-regulatory bodies to seek govt nod | Mint (livemint.com)
[5] Rule 4A (3) of the Gaming Rules
[6] Rule 4A (4) of the Gaming Rules
[7] Rule 2 (qb) of the Gaming Rules
[8] Rule 4B of the Gaming Rules
[9] Rule 3(1)(a) of the Gaming Rules
[10] Rule 3 (f) of the Gaming Rules
[11] Rule 3 (b) of the Gaming Rules
[12] Rule 3 (1)(b) (v) of the IT(Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 English.pdf (mib.gov.in)
[13] Rule 3(1) (d) of the Gaming Rules
[14] Rule 3(1) (l) of the Gaming Rules
[15] Section 2 (1) (w) of the Information Technology Act, 2000 defines intermediary as – “with respect to any particular electronic message means any person who on behalf of another person receives, stores or transmits that message or provides any service with respect to that message”
[16] Rule 3 (1) (ma) of the Gaming Rules
[17] Rule 4 (1) (c) of the Gaming Rules
[18] Rule 4 (1) (a) of the Gaming Rules
[19] Rule 4 (1) (b) of the Gaming Rules
[20] Press Information Bureau (pib.gov.in)
[21] Rule 3 (1) (b) (ix) of the Gaming Rules
[22] Rule 3 (1) (b) (x) of the Gaming Rules
[23] The Digital Personal Data Protection Bill, 2022.pdf (meity.gov.in) defines “Harm” in relation to a Data Principal, means (a) any bodily harm; or (b) distortion or theft of identity; or (c) harassment; or (d) prevention of lawful gain or causation or significant loss. “Data Principal” means the individual to whom the personal data relates and where such individual is a child includes the parents or lawful guardian of such a child.
[24] Ban Blue Whale game: Government asks Google, Facebook, WhatsApp to remove online suicide dare | The Financial Express
[25] 117 complaints against online gaming ads processed since January 2021: Govt | India News – Times of India (indiatimes.com)
