In the space of two weeks in April, the central government published new IT Rules, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2023, while the Tamil Nadu government banned all online gambling, including poker and rummy, with the Tamil Nadu Prohibition of Online Gambling and Regulation of Online Games Act, 2022. 

While clearly taking divergent approaches, both offer clarification and are welcome steps toward protecting consumers from the harms of unlimited access to the black market of unregulated online gaming operators.

One of the most notable features of the Tamil Nadu Act is section 14, which makes it mandatory for companies offering online betting games to implement geo-blocking to stop Tamil Nadu residents from accessing their games, including rummy and poker.

Geo-blocking is a technology that restricts users from accessing online content, applications or services based on the user’s geographical location. The Act states that online betting companies must ensure they do not offer their services to anyone while they are within the territorial boundaries of the state.

Under this obligation, online gambling companies have to ensure that users are not within the territorial boundaries of Tamil Nadu when they log in to begin playing the game or at any time during their playing period.

While ensuring effective compliance with the geo-blocking obligation might seem like an arduous task, it can be ensured by adopting compliance-grade geo-blocking technology.

Effective geofencing technology is already deployed in North America's highly regulated online gaming jurisdictions. This is the first time a state government in India has mandated its use to enforce its authority on betting and gambling under the Constitution (Seventh Schedule, Art. 246, List II, Entry 34) and to restrict online betting within its territorial boundaries.

Mandating the use of effective geo-blocking technology by online gaming companies enables state governments to guarantee that banned gaming websites and apps are not offered within their territorial boundaries, or conversely, permitted online gaming websites and apps do not operate beyond their territorial boundaries.

The inability to implement effective geofencing is an issue repeatedly raised by online gaming companies in response to multiple state ordinances and statutes banning online gaming or banning online gaming without a license. However, compliance-grade geo-blocking technology exists and can be adopted by online gambling companies to comply with the Tamil Nadu Act and Rule 3(1)(b)(ix) of the central government’s IT Rules, which requires compliance with all federal and state legislations.

Much like in India, gambling and betting are regulated state-by-state in the US and Canada.

American states and Canadian provinces that sought to regulate or ban real money online betting games within their territorial boundaries faced similar challenges to the ones we face in India today.

State and provincial governments in the US and Canada have introduced legislation to restrict or regulate online gaming within their territorial boundaries by mandating that companies implement compliance-grade geo-blocking solutions.

This prevents the companies from offering their products to customers outside the territorial boundaries of the relevant states, thereby complying with federal and state laws. State governments in North America have ensured that compliance grade geo-blocking solutions exist and can be implemented by online gaming companies.

To comply with regulations and ensure state boundaries are not breached, compliance-grade geo-fencing solutions need to be more advanced than some of the more commonly-used geolocation solutions found in other industries.

We are familiar with location data sources such as GPS, Wi-Fi, and cell towers from popular applications such as Google Maps, Zomato, and Ola Cabs. However, the main difference between these open-door tools and the compliance-grade geo-blocking required for regulated internet gambling is the way the more advanced technology interrogates location data to ensure it is trusted and secure.

Compliance-grade geo-blocking technology for the online gaming industry cannot simply rely on IP data to determine a player’s location and needs to dig deeper.

It needs to analyze data sources based on a combination of Wi-Fi, GPS, cell tower, IP, and Bluetooth data to verify a player’s location. The technology should be able to detect and block the use of proxies, VPNs, remote desktop software, virtual machines, jail-broken devices, mock location settings, and developer tools. It must also identify the latest spoofing technologies and adjust its systems to detect them.

Before legalizing online gaming in the State of Ohio, the Senate Select Committee on Gaming heard testimony from GeoComply, one of the leading geofencing technology companies in the US. The Senate was assured that effective compliance-grade geo-blocking solutions do exist and are reliable.

According to public records, GeoComply’s technology upholds geofencing/geo-blocking mandates in more than 23 US states, requiring all wagers to happen only within a legal jurisdiction.

The technology is precise enough to create virtual boundaries between states with densely populated borders. It can even build customised boundaries within a state to block access from specific geographic areas that are not permitted to accept wagers. In Washington DC, for example, one cannot place a bet in a federal building, so all federal buildings have a geofence erected around them to stop betting on government property.

Rule 4(11)(c) of the central government’s IT Rules tells online gaming companies to take necessary measures to protect customers' deposits. Furthermore, companies must inform their users about such actions.

Just like bank accounts, deposits in user accounts on gaming platforms are targeted by professional fraudsters, who are known to target new markets and vulnerable systems.

Fraud in e-commerce, whether identity theft, credit card fraud, or account takeovers, occurs across all e-commerce businesses, and online real-money gaming is no exception.

Much like other e-commerce websites, real-money online gaming platforms allow users to save a preferred payment options wherein banking information is stored in a database online. This makes it possible for the user to make subsequent deposits without entering their bank or payment details, but it is also one of the few vulnerabilities that fraudsters can exploit.

However, the gaming industry is far better suited than most e-commerce verticals to identify the fraud, identify the perpetrators, and help mitigate the damages that are done.

Interestingly, geolocation technology can also be used to detect fraud and consequently protect users’ deposits.

In addition to recognizing a new device and location, companies like GeoComply use additional data to determine whether a transaction is abnormal. This might include betting behavior or changes to an email address, verification method, address, bank account, or payment method.

GeoComply aims to balance player safety with user experience and reduce friction points, which might make a user flee to the black market. Moreover, GeoComply understands user concerns about privacy and is transparent about its data collection practices.

Tamil Nadu’s Act does not expect online gambling companies to do the impossible. The Act is another example of the law lagging behind technological developments rather than anticipating them.

While some provisions of the central government’s IT Act have yet to come into effect, the Tamil Nadu Online Gambling Act came into effect on April 10, 2023. Companies offering online betting games, including rummy and poker, must adopt compliance-grade geo-blocking solutions immediately.

Rohit Jain is the Managing Partner of Singhania & Co and Manav Bhargava is a Barrister & Solicitor, Canada Desk, Singhania & Co.