Online Gaming Rules 2026: A Comprehensive Guide to MeitY’s Light-Touch Framework for India

On Wednesday, 23 April 2026, the Ministry of Electronics and Information Technology (MeitY) notified the Promotion and Regulation of Online Gaming Rules, 2026, giving operational shape to India’s first dedicated statutory framework for the online gaming sector. Effective 1 May 2026, the Online Gaming Rules 2026 translate the Promotion and Regulation of Online Gaming Act, 2025 into concrete obligations for gaming companies, platforms, and users — and a concrete mandate for the newly created Online Gaming Authority of India. MeitY Secretary S. Krishnan has characterised the framework as a regulation-light approach that narrows the scope of mandatory scrutiny. This guide has been prepared by the Candour Legal Team as a comprehensive, practitioner-ready resource for founders, product teams, compliance officers, legal counsel, investors, and policy watchers navigating the new regime.

Key Takeaways

• MeitY notified the Promotion and Regulation of Online Gaming Rules, 2026 on 23 April 2026; they come into force from 1 May 2026.
• The Rules operationalise the Promotion and Regulation of Online Gaming Act, 2025, which received presidential assent in August 2025 after receiving approximately 3,500 stakeholder inputs during consultation.
• Most online social games will not require mandatory registration or classification with the Online Gaming Authority — Rule 8 adopts a self-determination framework, with Authority review triggered only in specific categories.
• Rule 17 of the October 2025 draft, which had proposed broad “material change” notification, has been narrowed in the final rules to payment-related, monetary, in-game monetisation, and specified external-asset changes.
• Registration validity has been extended from five years to ten years, reducing periodic renewal workload for registered providers.
• The Online Gaming Authority will be chaired by an additional secretary at MeitY, with joint secretaries from multiple ministries as members; the appellate authority is the MeitY Secretary.
• The parent Act’s ban on online money games is preserved — the Rules do not re-open real-money gaming, fantasy sports with monetary stakes, or pay-to-play formats that meet the Act’s definition of online money gaming.
• Non-compliance exposes gaming companies to suspension or cancellation of registration, grievance-redressal action, and statutory penalties under the parent Act.
• The Rules interface directly with the Digital Personal Data Protection Act, 2023 (DPDP Act) for user data, identity verification, and minors’ protection, and with the IT Rules, 2021 for intermediary due-diligence.
• A short compliance sprint to 1 May 2026 is recommended: map games to category definitions, build self-determination records, align DPDP Act workflows, set grievance-officer infrastructure, and calendar the first-year reporting cycle.

Rules at a Glance

Parameter	Position under Online Gaming Rules 2026
Notification date	23 April 2026
Effective date	1 May 2026
Parent statute	Promotion and Regulation of Online Gaming Act, 2025
Regulator	Online Gaming Authority of India
Authority chair	Additional Secretary, MeitY
Authority members	Joint Secretaries from relevant Ministries
Appellate authority	Secretary, MeitY
Registration regime	Self-determination under Rule 8; Authority review only in notified categories
Registration validity	10 years (up from 5 years in the October 2025 draft)
Material change notification	Limited to payment, monetary, in-game monetisation, and specified external-asset changes
Real-money gaming	Remains prohibited under the parent Act
Data protection interface	DPDP Act, 2023 applies in parallel
Intermediary due-diligence	IT Rules, 2021 continue to apply

Part I: The Parent Act — Promotion and Regulation of Online Gaming Act, 2025

The Promotion and Regulation of Online Gaming Act, 2025 is the parent statute that the Online Gaming Rules 2026 operationalise. The Act was introduced in Parliament in 2025, received presidential assent in August 2025, and was passed after a consultation process that drew approximately 3,500 inputs from stakeholders — industry, academics, parent and consumer groups, state governments, and sector-specific bodies. The statute marks a significant departure from the previous position, in which online gaming in India was governed by a patchwork of state Public Gambling enactments, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and sector-specific self-regulatory initiatives.

The Act creates three principal pillars. First, it defines online gaming, online social games, and online money games, drawing a statutory line between permitted and prohibited formats. Second, it establishes the Online Gaming Authority as the central regulator. Third, it prohibits online money games — games that involve monetary stakes or real-money prize outcomes — while allowing online social games to operate under a regulated framework. The prohibition on online money games is the single most consequential policy choice of the Act and is reflected, unchanged, in the Rules.

The distinction between online social games (permitted, subject to regulation) and online money games (prohibited) collapses the earlier judicial debate about “games of skill” versus “games of chance” for statutory purposes: whether skill-based or chance-based, a game that involves monetary stakes falls on the prohibited side of the Act’s line. That is a legislative choice, and it has reshaped the legal landscape even before the Rules were notified.

Part II: Scope and Applicability of the Online Gaming Rules 2026

The Rules apply to online social gaming intermediaries, platforms, publishers, and developers offering online games to users in India. They cover Indian entities and, to the extent the Act permits, foreign entities providing services to Indian users. The Rules cover the following principal subject-matter areas:

• Categorisation of online games and the self-determination process under Rule 8.
• Registration and classification procedure for games notified by the Authority for review.
• Safety features and user-protection obligations for in-scope platforms.
• Grievance redressal mechanism, including appointment of grievance officers and response timelines.
• Material change notification and ongoing disclosure obligations (including the narrowed Rule 17 regime).
• Oversight, cancellation, and suspension procedures against non-compliant providers.
• Interface with cognate statutes — the DPDP Act, IT Rules, consumer protection law, and anti-money-laundering rules.

Critically, the Rules do not touch the Act’s prohibition on online money games. Operators of fantasy sports products involving monetary stakes, rummy or poker platforms with cash buy-ins, casino-style apps, and similar pay-to-play-for-prize formats fall on the prohibited side and are not brought within a registration framework by these Rules. The Rules assume that compliant operators in the Indian market are offering online social games as defined under the parent Act.

Part III: Rule 8 — The Self-Determination Framework

Rule 8 is the most consequential operational feature of the Rules. Under the October 2025 draft, every online game was exposed to the possibility of mandatory pre-launch classification by the Authority, creating a significant bottleneck and prospective launch uncertainty for the industry. The final Rules reverse this default.

Under Rule 8, a provider makes its own determination of the category into which its game falls, based on the definitional criteria set out in the Rules read with the parent Act. The provider documents that determination, retains supporting records, and implements the compliance features applicable to that category. Mandatory registration with the Authority is triggered only in specific notified categories or where the Authority, upon initial review, raises a specific concern that requires formal review. For the significant majority of online social games — puzzle games, casual mobile games, strategy and simulation games, word and trivia games, most e-sports formats that do not involve monetary stakes — the provider will not need to approach the Authority for pre-launch approval.

The Rule 8 approach resembles, in design philosophy, the intermediary due-diligence regime under the IT Rules, 2021 and the accountability framework for significant social media intermediaries. The provider bears responsibility for getting the categorisation right. If it does so, it operates freely. If the categorisation is challenged — through a grievance, a complaint, or Authority-initiated review — the provider must be able to support its determination with documented reasoning and facts. This design is less bureaucratically intensive for operators and less operationally stretched for the regulator, but it places a higher premium on internal legal and product governance.

Industry commentators have welcomed this shift. The legal and gaming policy community has broadly described Rule 8 as a practical calibration that removes a significant barrier to product iteration while preserving the Authority’s ability to step in where genuine concerns arise. For a sector built on fast product cycles, A/B testing, and iterative feature launches, the pre-launch classification bottleneck in the October 2025 draft would have been operationally incompatible with product development norms. The final position restores that compatibility while maintaining regulatory reach over problem cases.

Part IV: The Rule 17 Rollback — Narrowing “Material Change”

The second major recalibration concerns Rule 17, the ongoing notification obligation. The October 2025 draft had proposed that providers notify the Authority of any “material change” to their games, with the term undefined and potentially extending to any significant product update — feature changes, user-interface redesigns, new game modes, content updates. The industry’s consultation response was that such a broad trigger would generate a constant stream of notifications and would be operationally unworkable for any modern live-ops game.

The final Rule 17 is materially narrower. The notification obligation is triggered only where changes occur in specified categories:

• Payment-related changes — introduction of new payment rails, changes in payment processor arrangements, or changes in the way payments are routed, received, or settled.
• Monetary changes — changes to fee structures, subscription pricing, or pricing of in-game items that qualify as monetary consideration.
• In-game monetisation changes — introduction or alteration of in-game monetisation mechanics, including loot boxes, battle passes, and paid cosmetic or functional items that cross defined thresholds.
• External-asset changes — changes to the handling of external assets linked to the game, including the introduction or removal of linkages to external wallets, NFTs, cryptocurrency, or similar items.

Feature updates, user-interface changes, content updates, new levels, new characters, and other ordinary product-development outputs that do not touch payments, monetary structures, monetisation design, or external assets fall outside the notification obligation. This is the correction that practitioners and product teams had specifically sought. The narrowed formulation aligns notification obligations with the risk areas the statute is actually concerned with — monetary flows, consumer harm, and external-asset exposure — rather than the routine mechanics of game development.

Operators should nonetheless maintain a change-log register internally, even for changes outside Rule 17 triggers. The register will support Rule 8 self-determination evidence, grievance responses, and future audits, and it is good corporate hygiene in a regulated sector.

Part V: Registration Regime — Ten-Year Validity

For games that do fall within the notified categories for Authority review, or where providers choose voluntary registration for strategic or commercial reasons, the Rules extend registration validity from the five-year window in the October 2025 draft to ten years in the final rules. This is a substantive reduction in ongoing compliance burden, particularly for larger operators with long-running titles in their portfolio. A ten-year registration horizon aligns more closely with typical gaming-product lifecycle economics, where flagship titles are supported through extended live-ops cycles of seven to ten years or longer.

Registration itself remains a procedural and documentary exercise — providers submit prescribed information about the game, the entity, safety features, payment flows, user-protection mechanisms, and grievance infrastructure. Once granted, the registration covers the specified game. Material changes within Rule 17 triggers must be notified during the registration’s currency; changes outside those triggers are not required to be notified but should be documented internally.

Part VI: The Online Gaming Authority — Composition, Powers, and Appeals

The Online Gaming Authority is a central regulatory body with a multi-ministry composition. Its design reflects the cross-cutting nature of gaming regulation — implicating consumer protection, youth welfare, financial integrity, information technology, and law and justice.

Role	Position
Chairperson	Additional Secretary, Ministry of Electronics and Information Technology (MeitY)
Member	Joint Secretary, Department of Financial Services, Ministry of Finance
Member	Joint Secretary, Ministry of Information and Broadcasting
Member	Joint Secretary, MeitY
Member	Joint Secretary, Ministry of Youth Affairs and Sports
Member	Joint Secretary, Department of Legal Affairs, Ministry of Law and Justice
Appellate Authority	Secretary, MeitY

The Authority’s statutory powers, as reflected in the Rules, include: (i) issuing directions or orders to registered gaming providers; (ii) seeking information, conducting reviews, and examining compliance; (iii) imposing conditions on registration; (iv) suspending or cancelling registration in cases of breach; (v) notifying categories of games for mandatory review; and (vi) issuing guidelines and codes of practice for safety and user protection. The appellate route runs to the Secretary, MeitY, for aggrieved providers.

A notable architectural feature of the Authority is that its chairperson (an Additional Secretary) is junior in rank to its appellate authority (the Secretary, MeitY). This creates a clean internal appellate hierarchy without requiring an external tribunal. While efficient, practitioners have flagged that further substantive appeal pathways — to a specialist tribunal or a High Court — may need to be articulated in due course, particularly for cases involving complex statutory interpretation or constitutional questions.

Part VII: Real-Money Gaming — What the Rules Do NOT Do

The single most important thing the Online Gaming Rules 2026 do not do is re-open real-money gaming. The parent Act prohibits online money games, and the Rules do not create a pathway for their registration, licensing, or operation. Operators of fantasy sports products involving monetary stakes, pay-to-play-for-prize tournaments, rummy and poker platforms with cash buy-ins, casino-style applications, and similar formats fall on the prohibited side of the Act’s line and cannot bring themselves within the Rules by compliance workarounds.

This position has substantial commercial consequences. A portion of the Indian online gaming market — particularly real-money fantasy sports, which had become a large revenue and marketing category over the past decade — was already substantially restricted following the enactment of the parent Act. The Rules confirm that this restriction is not being eased. Investors, operators, and their counsel should plan on the basis that the real-money gaming ban is a durable feature of the regime, subject only to future legislative change.

Enforcement of the real-money gaming ban against non-compliant operators is a separate thread that will continue to play out through intermediary due-diligence action under the IT Rules, 2021, app-store takedowns, blocking orders under Section 69A of the Information Technology Act, 2000, and, where facts warrant, PMLA and economic-offence proceedings.

Part VIII: Interface with the DPDP Act, 2023 and IT Rules, 2021

The Online Gaming Rules 2026 do not exist in isolation. Three adjacent frameworks remain directly applicable and must be operationalised in parallel.

DPDP Act, 2023 interface. The Digital Personal Data Protection Act, 2023 governs processing of personal data by online gaming providers. Consent mechanics, purpose limitation, data retention, breach notification, the appointment of a Data Protection Officer where thresholds are met, verifiable parental consent for children’s data, and Data Principal rights all apply. The Rules’ user-protection obligations layer on top of, and must be integrated with, DPDP Act workflows. KYC and identity-verification mechanisms that gaming providers implement under the Rules must be DPDP-compliant — in particular, the categories and retention of identity data, and the contracting architecture with verification vendors as Data Processors.

IT Rules, 2021 interface. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 apply to intermediaries that publish or host user-generated content. Gaming platforms with user-generated content layers, multiplayer chat, user-generated items, or community features remain subject to the IT Rules’ due-diligence obligations, grievance officer appointments, and content-moderation expectations. For platforms that qualify as significant social media intermediaries, the enhanced obligations apply in parallel with the Online Gaming Rules.

Consumer Protection Act, 2019 interface. The Consumer Protection Act, 2019 and the E-Commerce Rules framework apply to gaming products sold to consumers, including subscription and in-game purchase transactions. Unfair trade practices, misleading advertisement standards, and consumer redress remedies remain live for gaming products.

For compliance design, this means gaming operators should think of the Rules as one layer in a stack. Internal policies, privacy notices, grievance frameworks, and user agreements must be cross-referenced across all applicable frameworks. A change in one framework — say, when DPDP Rules under Section 40 are fully notified and operationalised — may require a corresponding update in gaming-specific policies.

Part IX: State Law Interface and the Skill-vs-Chance Doctrine

Under the Constitution of India, “betting and gambling” fall under Entry 34 of List II (State List). Several states — including Tamil Nadu, Karnataka, Andhra Pradesh, and Telangana — had enacted or attempted to enact legislation banning or regulating online gaming independent of Central action. The judicial response had created a distinctive doctrine: games predominantly of skill were treated as protected commercial activity under Article 19(1)(g), while games predominantly of chance could be more extensively regulated as gambling. The Supreme Court’s decision in K.R. Lakshmanan v. State of Tamil Nadu (1996), and subsequent High Court decisions including those concerning the Tamil Nadu and Karnataka online gaming statutes, had developed the skill-versus-chance doctrine over decades.

The parent Online Gaming Act, 2025 — and the Rules through it — operates through a different statutory vocabulary. The Act focuses on the presence or absence of monetary stakes rather than on the skill-chance distinction. This legislative choice carries two implications for state-law interface. First, state laws that target online money games in the domain covered by the central framework will have to be assessed against the doctrine of repugnancy under Article 254 and the federal distribution of legislative competence. Second, the skill-versus-chance doctrine, while still doctrinally relevant in adjacent contexts (including traditional physical gaming, state lotteries, and some residual gaming activities), has a reduced operational role for online formats covered by the central Act and Rules.

Constitutional challenges to the Act and Rules — both by parties adversely affected by the real-money gaming ban and by states asserting legislative competence — are to be expected and will play out in the High Courts and potentially the Supreme Court in the months ahead. Practitioners should monitor this docket closely.

Part X: Compliance Checklist — What to Do Before 1 May 2026

The compliance sprint to 1 May 2026 is short. The following checklist is structured as an action list for gaming operators preparing for the commencement of the Rules. This is the core of the compliance pack intended for the sector.

A. Product and Category Mapping

• Inventory all live and near-launch games in the India catalogue.
• For each game, apply the Act’s definitional criteria and determine whether it is an online social game (permitted) or an online money game (prohibited).
• For games with monetary mechanics, test carefully against the definitions — in-app purchases for cosmetic items, battle passes, subscription tiers, and skill-based micro-transactions need granular assessment.
• Document the determination with reasoning and supporting product facts. This is the Rule 8 self-determination record.

B. Registration Decisions

• Identify whether any of your games fall within categories the Authority has notified for review or is likely to notify.
• For in-scope games, prepare registration applications with all required information, including safety features, monetary flows, user-protection design, and grievance architecture.
• For voluntarily-registered games (where strategic value justifies registration even if not mandatory), prepare analogous documentation.

C. Safety Features and User Protection

• Implement or update age-verification and parental-consent mechanisms aligned with the DPDP Act, 2023 for users below 18.
• Build self-exclusion, time-limit, and spending-limit features where applicable to the category.
• Audit in-game monetisation design for loot box and probability disclosure requirements; ensure disclosures are clear and accessible.
• Review advertising and marketing material for alignment with the Act and the Advertising Standards Council of India (ASCI) Code.

D. Grievance Redressal Infrastructure

• Designate and publish a Grievance Officer for each in-scope platform.
• Build a grievance-tracking workflow with statutory response timelines.
• Integrate DPDP Act, 2023 Data Protection Officer (where applicable) and IT Rules, 2021 grievance officer roles where the same platform has cross-framework obligations.

E. Documentation and Governance

• Update Terms of Service, Privacy Policy, and in-app notices to reflect Rule 8 self-determination and Rule 17 change-notification architecture.
• Build an internal Rule 17 change-log register covering payment, monetary, in-game monetisation, and external-asset changes.
• Brief the board and senior management on the Rules, and record key decisions in board and management minutes.
• Update internal policies, standard operating procedures, and launch-gate checklists to embed the Rules into product development cycles.

F. Investor, M&A, and Disclosure Hygiene

• Update due-diligence questionnaires and representations and warranties in transaction documents to capture the Rules framework.
• Review investor reporting templates to include Rules-compliance status.
• For listed entities, review materiality policies under SEBI (LODR) Regulations, 2015 for registration suspension or cancellation events.

Part XI: Industry Reception and Flagged Concerns

The industry response to the final Rules has been largely positive, with some specific concerns flagged for continuing attention. Representatives from leading gaming companies and industry associations — including Nazara Technologies, Bitkraft Ventures, King Kasiva, JetSynthesys, and the Indian Digital Gaming Society — have broadly described the final Rules as a practical and forward-looking calibration compared with the October 2025 draft, crediting the Rule 8 self-determination and Rule 17 rollback for reducing the compliance overhead on live-ops product development.

At the same time, three concerns have been articulated by industry executives and associations:

First, the absence of a formal public consultation process on the codes of practice and safety guidelines that the Authority is expected to issue under the Rules. Industry has asked for a structured consultation window before the codes are operationalised, to allow time for product and operational adaptation.

Second, the appellate architecture, in which the appellate authority is the Secretary, MeitY. Practitioners have flagged that for significant statutory and constitutional questions, a specialist tribunal or High Court pathway may be preferable — both for the depth of legal reasoning and for the separation of adjudicatory and administrative functions.

Third, clarity on transitional arrangements for games already live in the Indian market on 1 May 2026. The Rules apply from commencement, but the precise mechanics of how existing games will be brought within the regime — particularly whether a grace period or a phased compliance window applies — will need clear articulation by the Authority in early guidance.

Part XII: Cross-Practice Impact

For gaming companies and startups, the Rules reduce pre-launch regulatory friction while raising the bar for internal legal and compliance function. The Rule 8 self-determination framework needs genuine legal substance behind it — not a tick-box exercise — because the Authority and courts will expect to see reasoned determinations when disputes arise.

For investors and venture capital funds, the Rules restore greater predictability for the online gaming thesis, with the caveat that the real-money gaming ban remains firmly in place. Diligence frameworks should now distinguish between online social gaming targets (regulated, operable) and real-money gaming exposure (prohibited). Investment documents should capture representations on category classification and compliance with Rule 8, Rule 17, and the parent Act’s prohibitions.

For fintech and payments partners, the Rule 17 focus on payment-related and monetary changes means that payment processor relationships, merchant onboarding, and payment rail changes for gaming merchants will carry a regulatory-notification dimension. Payment aggregators and payment gateways onboarding gaming merchants should build diligence that confirms the merchant’s own Rule 8 position and Rule 17 notification status.

For advertising, media, and influencer partners, the parent Act’s restriction on promotion of prohibited real-money gaming extends through the advertising supply chain. Brands, agencies, celebrities, influencers, and sports properties that partner with gaming products must ensure the underlying product is an online social game, not an online money game, and that the promotional content does not carry prohibited gaming associations.

For tax and transfer-pricing teams, the characterisation of gaming revenue streams has tax and GST consequences. Subscription, in-app purchase, and in-game monetisation revenues need to be characterised correctly for both income tax and GST. The GST treatment of online gaming underwent significant change over 2022-2024; the Rules’ category distinctions will need to be mapped onto the GST framework in consultation with tax counsel.

For gaming hubs across India, including Ahmedabad and the broader Gujarat ecosystem, the Rules provide clarity for a growing set of gaming studios, indie developers, and e-sports platforms. Gujarat has seen emergent gaming activity in Ahmedabad and Gandhinagar, and the Rules’ light-touch framework is well-suited to the early-stage studios and content creators in this ecosystem. Operators availing the IFSC regime at GIFT City for international-facing gaming or e-sports content businesses should also review the IFSC-specific regulatory interface.

Part XIII: Open Questions and Risk Areas

Categorisation ambiguity. The Act’s definitional line between online social games and online money games is not always crystal-clear at the edges. Games with skill-based prize tournaments funded by entry fees, peer-to-peer betting-adjacent features, and hybrid e-sports-with-stakes formats will continue to generate categorisation disputes. Providers operating in ambiguous zones should seek legal opinion and document their reasoning carefully.

External-asset triggers. The Rule 17 trigger for “external-asset changes” — covering linkages to external wallets, NFTs, and cryptocurrency — will interact with the broader Indian policy position on virtual digital assets. Gaming products incorporating Web3 features face layered regulatory exposure across the Online Gaming Rules, the Income-tax Act (for VDA taxation), FEMA and cross-border rules, and PMLA.

Enforcement against offshore operators. The enforcement of the real-money gaming ban against offshore operators serving Indian users remains a practical challenge. Blocking orders, app-store takedowns, and payment-channel disruption are the principal levers; individual enforcement action against offshore operators is resource-intensive.

Codes of practice. The Authority is expected to issue codes of practice covering safety, user-protection, and content-moderation expectations. The content of these codes — and the process by which they are developed — will significantly shape day-to-day compliance for operators.

Constitutional and jurisdictional challenges. The Act and Rules are likely to face constitutional challenge on grounds including Article 19(1)(g) (freedom of trade for operators adversely affected) and federal-competence questions on state-law interface. The outcome of these challenges will materially affect the regime’s trajectory.

Part XIV: Looking Ahead

The Online Gaming Rules 2026 complete the core architecture of India’s first dedicated statutory framework for online gaming. The framework rests on three load-bearing choices: the prohibition of online money games, the self-determination framework for online social games under Rule 8, and the narrowed change-notification regime under Rule 17. The combination represents a workable calibration for an industry that had been navigating regulatory uncertainty for more than a decade.

Over the twelve to eighteen months following 1 May 2026, four developments should be tracked closely. First, the Authority’s first notifications of categories requiring mandatory review — these will define where the self-determination framework ends and the registration pipeline begins. Second, the codes of practice and safety guidelines the Authority issues, which will set the operational expectation baseline. Third, the resolution of constitutional challenges likely to be mounted against the Act and Rules. Fourth, the first Authority orders against non-compliant providers, which will clarify the enforcement posture and case-by-case expectations.

For gaming companies with operations in India, the practical message is: use the light-touch framework to move product development forward confidently, but build genuine compliance substance behind the Rule 8 self-determination and align across the DPDP Act, IT Rules, and consumer law frameworks. For investors, advisers, and counsel, the Rules restore predictability for investment theses in online social gaming while confirming that the real-money gaming window remains closed. The analytical challenges will move from “whether to comply” to “how to comply well”.

Frequently Asked Questions

When do the Online Gaming Rules 2026 come into effect?

The Online Gaming Rules 2026, notified by the Ministry of Electronics and Information Technology (MeitY) on 23 April 2026, come into force on 1 May 2026. The Rules operationalise the Promotion and Regulation of Online Gaming Act, 2025, which received presidential assent in August 2025.

Do I need to register my game with the Online Gaming Authority?

Not in most cases. Under Rule 8, the default position is self-determination — the provider assesses its own game against the definitional criteria in the parent Act and Rules and implements the applicable compliance features. Mandatory registration is triggered only where the Authority notifies a specific category for review, or where the Authority raises a specific concern requiring formal review. Most online social games — casual, puzzle, strategy, simulation, word, trivia, and e-sports formats without monetary stakes — will not need pre-launch Authority approval. Providers should nonetheless document their self-determination carefully.

Can real-money fantasy sports, rummy, and poker platforms operate under the Rules?

No. The parent Online Gaming Act, 2025 prohibits online money games, and the Online Gaming Rules 2026 do not re-open this category. Fantasy sports products involving monetary stakes, rummy and poker platforms with cash buy-ins, casino-style apps, and pay-to-play-for-prize tournaments fall on the prohibited side of the statutory line. These cannot be brought within the Rules by compliance design. The position is subject only to future legislative change.

What is Rule 8 of the Online Gaming Rules 2026?

Rule 8 is the self-determination provision. It allows a gaming provider to categorise its own game based on the definitional criteria in the parent Act and Rules, and to implement the applicable compliance features without prior approval from the Authority. Mandatory registration or Authority review applies only in notified categories or where the Authority raises specific concerns. Rule 8 replaces the October 2025 draft’s broader mandatory-classification default and is the operational centrepiece of the light-touch framework.

What triggers a notification obligation under Rule 17?

Under the final Rule 17, notification to the Authority is required only for changes in four specified categories: (i) payment-related changes, (ii) monetary changes affecting fees, pricing, or monetary consideration structures, (iii) in-game monetisation changes including loot box, battle pass, and paid-item mechanics that cross defined thresholds, and (iv) external-asset changes covering linkages to external wallets, NFTs, cryptocurrencies, and similar items. Ordinary product-development changes — feature updates, user-interface redesigns, new content, new levels — fall outside Rule 17 triggers.

How long is a registration under the Rules valid?

Registration validity has been extended from the five years proposed in the October 2025 draft to ten years in the final Rules. This ten-year window aligns with typical gaming-product lifecycle economics and reduces periodic renewal burden for registered providers.

Who sits on the Online Gaming Authority, and what is the appellate route?

The Online Gaming Authority is chaired by an Additional Secretary at MeitY, with Joint Secretaries from the Department of Financial Services (Ministry of Finance), the Ministry of Information and Broadcasting, MeitY, the Ministry of Youth Affairs and Sports, and the Department of Legal Affairs (Ministry of Law and Justice) as members. The appellate authority is the Secretary, MeitY. Aggrieved providers appeal Authority orders to the MeitY Secretary; subsequent substantive appeals, where available, would lie to appropriate courts depending on the subject-matter.

How do the Rules interact with the DPDP Act, 2023?

The Digital Personal Data Protection Act, 2023 applies to processing of personal data by online gaming providers in parallel with the Rules. Consent mechanics, purpose limitation, retention, breach notification, Data Protection Officer appointment, verifiable parental consent for children’s data, and Data Principal rights must all be implemented. The Rules’ user-protection obligations and the DPDP Act’s data-protection obligations must be integrated in a single compliance workflow, with KYC and identity-verification mechanisms designed to be DPDP-compliant.

What are the penalties for non-compliance with the Rules?

Non-compliance exposes providers to suspension or cancellation of registration by the Authority, grievance-redressal action, and statutory penalties under the parent Act. Where non-compliance crosses into operation of prohibited online money games, exposure extends to enforcement under the parent Act, intermediary-liability action under the IT Rules, 2021, blocking orders under Section 69A of the Information Technology Act, 2000, and, where facts warrant, PMLA or economic-offence proceedings. Directors and key personnel may also face individual exposure in some cases.

Do state-level gaming laws still apply?

State laws on gambling and online gaming retain relevance to the extent they cover areas not occupied by the central framework, and to the extent they are not in repugnancy with the central Act. For online gaming formats covered by the Online Gaming Act, 2025 and the Rules, central law will prevail in cases of inconsistency. The interface between central and state legislation is likely to be tested in court in the period ahead, particularly for state laws targeting online money gaming or online gaming advertisements.

About This Analysis

This analysis has been prepared by the Candour Legal Team. Candour Legal is an analytical commercial law practice based in Ahmedabad, Gujarat, with a focus on technology, media and gaming law, intellectual property, direct tax, corporate and commercial law, competition law, and regulatory advisory. Views expressed are general in nature and for informational purposes only; they are not legal advice and should not be relied upon in any specific matter without advice on the facts. A dedicated Candour Legal Compliance Pack PDF covering the Online Gaming Rules 2026 is being prepared and will be linked at the top of this article on release.