Proposed Amendment to IT Intermediary Rules

Please click here to download the Prism as PDF.

On January 2, 2023 the Ministry of Electronics and Information Technology (“MeitY”) issued a public notice inviting feedback on its proposed amendment (“Proposed Amendment”) to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules”) in relation to online gaming. Feedback must be submitted by January 17, 2023.

Summary and analysis of the Proposed Amendment

Regulation of ‘online games’: The Proposed Amendment seeks to regulate intermediaries which offer ‘online games’ (defined as games which involve deposits by users with the expectation of earning winnings). However, the Proposed Amendment enables the MeitY to classify other games (which do not involve deposits) as ‘online games’ for the purpose of the IT Rules, if it believes such games pose a risk of harm (a) to the sovereignty and integrity of India; (b) to the security of the State; (c) to India’s friendly relations with foreign States; (d) to public order; or (e) in relation to addiction or other harm among children (“Harmful Games”).

JSA Comment: The definition of ‘online game’ is broad and could potentially include pay-to-play games without a cash-out element. Additionally, it is unclear why the MeitY would seek to regulate Harmful Games which pose a threat to the security of State, public order etc. as ‘online games’, rather than an outright prohibition.

Obligations on intermediaries: Intermediaries must make reasonable efforts to ensure that ‘online games’ on their platforms are in conformity with law – including laws relating to gambling, betting and the age at which individuals are competent to contract. Additionally, subject to a 3 (three) month transition period, intermediaries (such as app-stores, cloud service providers, advertisers etc.) under the Proposed Amendment will have an active obligation to ensure that ‘online games’ hosted, published or advertised on their platforms are registered with a self-regulatory body (discussed below).

JSA Comment: The Supreme Court has held that intermediaries cannot be reasonably expected to monitor/police the content on their platforms and only have a legal obligation to take content down upon receiving ‘actual knowledge’ in the form of a court order or notice from authorities. It is unclear what mechanisms intermediaries will be required to implement in order to filter out online games which are not registered; and whether this obligation will stand judicial scrutiny.

Obligations on ‘online gaming intermediaries’: The Proposed Amendment defines ‘online gaming intermediaries’ as intermediaries which offer one or more ‘online games’. In addition to complying with the general obligations on intermediaries under the IT Rules, ‘online gaming intermediaries’ will be required to comply with the following requirements (subject to a 3 (three) month transition period).
- Visible mark: Display a visible mark of registration on all ‘online games’.
- Certification: Publish on their websites and mobile applications – a random number generation certificate and no bot certificate from a reputed certifying body for each online game offered.
- Know your customer (“KYC”): Conduct KYC of users in accordance with the procedure specified by the Reserve Bank of India (“RBI”) for RBI regulated entities.
- Account verification: Ensure that users can voluntarily verify their accounts by any appropriate mechanism to obtain a visible mark of verification. Verification methods must include verification through an Indian phone number.
- Grievance officer: Appointment of a grievance officer (“GO”) who is an employee of the ‘online gaming intermediary’ and resident in India.
- Chief compliance officer (“CCO”): Appointment of a CCO who is a key-managerial person/senior employee of the ‘online gaming intermediary’ and is resident in India. The CCO will be held directly liable for non-compliances of the ‘online gaming intermediary’.
- Nodal person: Appointment of a nodal contact person (other than the CCO) for 24×7 coordination with law enforcement agencies and officers.
- Physical Indian address: A physical address in India which is published on their websites and mobile applications.
- Grievance redressal mechanism: An appropriate grievance redressal mechanism which enables complainants to track the status of their complaints using unique ticket numbers. ‘Online gaming intermediaries’ must (to the extent reasonable) provide complainants with reasons for any action taken or not taken pursuant to a complaint.
- User intimation of changes in ToS: Inform users in (English or any language specified in the Eight Schedule of the Constitution of India) immediately upon any change in their terms of service/privacy policy (“ToS”).
- Specifications for ToS: The ToS of an ‘online gaming intermediary’ must specify the following:

- - Details of the ‘online games’ offered – along with (a) information relating to withdrawal or refund of deposits; (b) the manner of determination and distribution of winnings; and (c) fees or other charges payable.
  - Disclosure that there is risk of financial loss and addiction associated with ‘online games’.
  - The KYC procedure followed for users to register their accounts.
  - The measures taken to protect users’ deposits.
  - The framework of the self-regulatory body with whom the ‘online gaming intermediary’ is a member.

JSA Comment

While gaming companies are intermediaries to the extent that they permit third party users to use their platforms to play online games with other users – gaming companies would not be entitled to safe harbour under Section 79 of the Information Technology Act, 2000 (“IT Act”) for violation of law (including laws relating to gambling, betting etc.) by the gaming company itself.

Notably, there is no penalty for non-compliance with the IT Rules (including the obligations inserted by the Proposed Amendment); and any non-compliance (a) will result in loss of intermediary status; and (b) could result in blocking of the gaming company’s online game platform under Section 69A of the IT Act. From a risk-perspective, the Proposed Amendment will have no impact on gaming companies for non-compliance with existing laws on betting or gambling.

Nevertheless, this is not the first instance of non-intermediaries being regulated under the IT Rules. OTT platforms have been regulated by the IT Rules since their inception despite not being intermediaries.

Self-regulatory body: The Proposed Amendment enables the registration of one or more self-regulatory bodies with the MeitY to regulate ‘online games’ and ‘online gaming intermediaries’. Such self-regulatory bodies must operate independently and at arm’s length from its member ‘online gaming intermediaries’.
- Verification of ‘online games’: Self-regulatory bodies will be responsible for ensuring that the ‘online games’ of their members are in compliance with law; and thereby allow members offering such games to display a demonstrable and visible mark of registration.
- Framework for testing: Self-regulatory bodies will be required to develop a framework for testing and verification of ‘online games’ which are prominently published on their websites and applications. Such framework must include criteria relating to the following:
  - Safeguarding users from harm – including self-harm.
  - Measures to safeguard children.
  - Measures to safeguard users against the risk of gaming addiction and financial loss – including repeated warnings at high frequency in case of gaming beyond a reasonable duration. This would also include a provision to enable users to exclude themselves from a game upon reaching user-defined limits for time and money spent.
  - Measures to safeguard against the risk of financial fraud.
- Communication with Central Government: Self-regulatory bodies will be required to communicate the fact of registration of every registered online game with the Central Government, along with a report of the basis of such recognition.
- Grievance redressal mechanism: Self-regulatory bodies will be required to establish a grievance redressal mechanism to resolve complaints of users which have not been resolved by GOs.