This blog has been written by Mrunalini Mohapara, a 5th year student at National Law University Odisha

   I. Introduction

Artificial intelligence (“AI”) systems have lately pushed India’s online gaming industry to emerge as one of the most data-intensive sectors of the digital economy, with platforms like Dream11, WinZO, and MPL continuously ingesting user interaction data consisting of session durations, click-sequences, loss-chasing behaviour, and micro-transaction patterns with the help of AI systems that help target advertising to maximise user retention and spending for predictive behavioural profiles.

What renders this accumulation of data legally significant is not its volume alone, but its structural invisibility. The user does not actually disclose the data used for behavioural profiling; it is inferred by the AI systems deployed on those gaming platforms. The theory of surveillance capitalism accounts for this asymmetry preciselyby identifying the by-product of user activity as an extraction of behavioural surplus data, which is then repurposed without the user’s awareness to generate personalised products. The core economic logic of platforms operating at the digital frontier is based on such surveillance capitalism. In online gaming platforms, the behavioural surplus manifests through psychographic risk scores, addiction-susceptibility indices, and loss-aversion profiles that AI systems infer from gameplay interactions and subsequently deploy to monetise psychological vulnerability. These systems operate without substantially obtaining the user’s consent, since what is being processed is not the data consciously provided by users, but the behavioural residue of their engagement with the platform, which is then transformed into a commercial asset. The enactment of the Promotion and Regulation of Online Gaming Act, 2025 (“the PROG Act”) does not render this issue redundant. While it regulates harms arising from manipulative design and addictive algorithms, it does not specifically address the generation and use of AI-inferred attributes such as vulnerability or addiction-risk profiles. The regulatory gap therefore persists at the intersection of online gaming regulation and data protection, particularly concerning the inferential and algorithmic dimensions of behavioural profiling.

Data collection and processing in India is governed by the Digital Personal Data Protection Act, 2023 (“the DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“the DPDP Rules”), which establish a notice-and-consent framework as the primary protective mechanism, requiring consent to be “free, specific, informed, unconditional and unambiguous.” However, data derived algorithmically is not covered under this framework, nor is the consequential effect of such derivation. Automated decision-making, AI-generated inferences, and algorithmic profiling have not been addressed by the Indian data protection framework yet. The author anchors their arguments on this consent framework, which currently fails to account for AI-driven behavioural profiling on online gaming platforms.

This essay proceeds in four parts: Part II maps AI-driven behavioural profiling in online games through a technical-legal lens; Part III identifies four structural lacunae in the consent and data protection framework of the DPDP Act through doctrinal analysis; Part IV examines the General Data Protection Regulation (“GDPR”)and the European Union Artificial Intelligence Act 2024 (“EU AI Act”), and situates India’s framework through a comparative analysis; Part V advances policy recommendations; and Part VI concludes the essay with the finding that the lack of policy reformation would leave Indian users substantively open to harm caused by behavioural manipulation by AI systems in the digital economy.

 II. AI-Driven Behavioural Profiling: A Technical-Legal Mapping

The underlying technology of AI profiling can be mapped in three layers in the case of online gaming, which the author explains below by using the example of an online gaming platform like Dream11:

a. The Data Ingestion Layer

This layer is characterised by the collection of initial raw data, such as session initiation and termination intervals, keystroke patterns, micro-transaction decisions, and emotional response to losses, especially in gambling.

b.  The Inference Layer

Machine learning models like deep neural networks or ensemble classifiers process the raw data collected in the initial layer to generate inferred attributes, such as income brackets, social influence rankings, risk appetite scores, and addiction-susceptibility indices. The user does not disclose such attributes; they are inferred by the algorithm from behavioural patterns.

c. The Deployment Layer

The inferred data is fed to personalisation engines, which exploit cognitive biases such as sunk-cost fallacy and loss aversion, and psychological vulnerability windows are used to time promotions. The most critical legal insight arising from this AI profiling structure is that the data it infers is never directly provided to the system by the user. The data used in the deployment layer is created, and the gaming platform subsequently weaponises it commercially.

At the data ingestion layer, the AI system deployed on Dream11 collects click latency and session duration; at the inference layer, it produces a loss-aversion index; and times a limited offer notification to the user’s identified vulnerability window in the deployment layer.

III. Structural Lacunae of the DPDP Framework

The processing of personal data requires the user’s consent to be “free, specific, informed, unconditional and unambiguous” under Section 6 of the Act. This structure suits manually driven platforms efficiently; however, in the context of AI-driven profiling by online gaming platforms, the DPDP Act reveals four structural deficiencies.

a. The Bundled Consent

Platforms ask for consent at the point of registration through “Terms of Service”, which, if obtained, is bundled for primary gameplay, third-party data sharing, behavioural profiling, and targeted marketing. Though the Act requires consent to be specific, aggregation of multiple processing purposes within a single consent instrument obtained only once is not prohibited under the Act. India could take lessons from the GDPR, Article 7 and Recital 43 of which discourage bundled consent by recognising that consent is not freely given where separate consent cannot be provided for distinct processing operations.

b.  Real-Time Processing

Consent can be conceptualised as a prior, static authorisationfor defined processing purposeswithin Section 6 of the DPDP Act; however, AI profiling is neither prior nor static. Furthermore, the processing purposes of AI systems dynamically evolve to infer the user’s engagement with the platform, their nature being continuous and adaptive. A user who consented at registration to personalization has not meaningfully authorised the generation of a real-time addiction-risk score eighteen months later. When AI models process raw data for generating novel inferences, they do so beyond the original scope of the consent obtained at registration, and the DPDP Act provides no mechanism mandating a re-consent or changed-purpose notification from the online gaming platform.

c. Inferential Data

The definition of personal data under Section 2(t) of the DPDP Act covers data by which or in relation to which a data principal is identifiable. However, data processed by AI models to generate inferential data, such as addiction indices, psychographic profiles, or risk scores, are neither addressed by the Act nor its rules. A delay in purposively interpreting personal data to include inferred data by AI models may leave the most commercially valuable and privacy-invasive outputs of AI systems outside the ambit of regulation.

d. Quantifying Harm

Adjudicatory jurisdiction of the Data Protection Board under Chapter VII of the DPDP Act is triggered when the data principal is harmed, which is characterised as a discrete and identifiable event, such as physical harm, financial loss, or reputational damage. However, harm caused by AI models on online gaming platforms does not remain confined to its traditional characteristics; it is longitudinal and diffuse, usually in the form of sustained algorithmically engineered interface nudges that cause the gradual erosion of financial autonomy. The current statutory language of the DPDP Act does not address such harm, rendering users unable to bring claims under the DPDP Act.

IV. Comparative Analysis: Meeting the European Standard

The current Indian framework lacks the normative ambition that has been materialised by European authorities. Article 22 of the GDPR entails an algorithmic due process guarantee by establishing a right not to be subject to decisions based solely on automated processing that produce legal or ‘similarly significant’ effects. This safeguard applies to certain forms of behavioural profiling where automated decision-making produces legal or similarly significant effects on the data subject. Taking lessons from this safeguard, the DPDP Act could work on recognising that a gaming platform’s AI system generating an addiction-susceptibility score or a psychographic risk index, produces ‘similarly significant’ effects by re-routing promotional content, adjusting loss-recovery nudges, and monetising psychological vulnerability. With the current DPDP framework lacking such a provision, Indian users cannot contest such automated processing after clicking once on “I Agree” at registration.

Article 5 of the EU AI Act 2024 strengthens this framework by prohibiting the deployment of AI systems that use subliminal techniques to distort behaviour beyond the user’s conscious awareness. AI systems can impair autonomous decision-making by exploiting psychological vulnerabilities of the user, which is prohibited under Article 5. Such systems deployed by gaming platforms algorithmically identify a user’s loss-aversion window and time their promotional triggers to coincide with such loss to monetise the user’s vulnerability. The EU treats such deployment as a per se prohibited practice, but the Indian framework leaves this practice entirely unaddressed.

The EU’s framework recognises that certain deployments of AI profiling pose a structural threat to decisional autonomy, and addresses them through categorical prohibition under Article 5, rather than relying solely on reactive consent mechanisms. Contrastingly, India’s framework is premised on informed consent being a sufficient protective mechanism. The EU framework enforces its data protection laws by creating a layered and specialised accountability; it delegates oversight powers across Data Protection Authorities, national AI market surveillance authorities, and the European AI Office. India, on the other hand, has its Data Protection Board, a regulatory body without surveillance powers over algorithmic systems. Empowering the Board with supervisory and surveillance powers over AI systems would bring India’s data protection standard closer to the European one.

  V. Policy Recommendations

The author advances three recommendations through this essay to fill regulatory gaps;

Firstly, personal data has to be expressly expanded to include AI-inferred data and AI-derived attributes. This would extend the protection to outputs of algorithmic processing, such as profiles, indices and scores that violate or invade the privacy of a user. Unlike the DPDP framework, the GDPR’s broad conception of profiling and personal data allows inferential outputs linked to identifiable individuals to fall within regulatory scrutiny.

Secondly, consent has to be obtained by un-bundling and un-layering the purposes of obtaining such consent, along with notifying the user of addiction-proximate and psychological vulnerability profiling as sensitive processing categories. Information flows must adhere to the contextual integrity framework given by Helen Nissenbaum, which states that information is appropriate to flow where it matches the contextual norms under which data was originally shared. A reasonable contextual expectation may allow a gaming user’s interaction data to be used for gameplay improvement; however, using that data for psychographic profiling falls outside the purview of reasonable expectation. A mandatory, standalone consent requirement for vulnerability-profiling uses, non-bundleable with general terms of service, would operationalise this normative constraint.

Thirdly, modelled on the Data Protection Impact Assessment framework under Article 35 of the GDPR, empowering the Data Protection Board in India to mandate Algorithmic Impact Assessments for high-risk AI systems deployed in gaming platforms would assess and disclose their nature, purpose, and risk profile used for behavioural profiling before deployment. This assessment would provide an ex-ante remedy through an accountability mechanism to prevent any potential harm even before it manifests.

VI. Conclusion

India’s position in data protection architecture has been strengthened by the DPDP Act, 2023. However, there exists an underlying assumption in its notice-and-consent framework that the nature of data collection is transactional, purposively bound, and disclosed, all of which AI-driven behavioural profiling violates on gaming platforms. The Act’s structural regulatory failure in terms of the bundled consent problem, the real-time processing gap, and the inferential data lacuna is not merely an implementation oversight, but a certification of the data manipulation infrastructure caused by AI systems in India’s online gaming industry. The issue at hand is not just protecting user data; it has extended to the integrity of user autonomy in a space designed to defeat it.