Digital Law Tracker — Week 19, 2026 (4–10 May) — Mid-Week Update through 5 May

Mid-week update — events through 5 May 2026. W19 (4–10 May 2026) opens with India's online gaming regulatory framework entering its first full enforcement week: the PROG Rules 2026 (effective 1 May 2026) are live, OGAI is operational, and the bank-gatekeeper mechanism for blocking payments to prohibited money-game platforms is active. TRAI released a landmark V2X consultation paper on 30 April 2026, initiating India's first formal spectrum-and-licensing framework for connected vehicles under the Telecommunications Act, 2023. Two high-stakes hearings are days away: the Gujarat HC SAHYOG counter-affidavit date (8 May) and the Supreme Court's DPDP Act Section 44(3) larger bench (13 May).

Partial-week caveat (as of 5 May 2026, today): This tracker is issued mid-week. Events on 6–10 May — including the 8 May Gujarat HC SAHYOG hearing — will not be retroactively captured here but will be the anchor item in the W20 tracker.

Top 3 Developments This Week

1. PROG Rules 2026 — first enforcement week; OGAI operational; bank gatekeeper mechanism active

What changed: The Promotion and Regulation of Online Gaming Rules, 2026 — notified under gazette number CG-DL-E-22042026-271974 by the Ministry of Electronics and Information Technology on 22 April 2026 under the PROG Act, 2025 — entered their first full enforcement week from 4 May 2026. The Online Gaming Authority of India (OGAI) is constituted as an attached office of MeitY, chaired ex officio by the Additional Secretary, MeitY, with five Joint Secretary-level members from the Ministries of Home Affairs, Information and Broadcasting, Youth Affairs and Sports, the Department of Financial Services, and the Department of Legal Affairs. Banks and UPI platforms are positively obligated from 1 May 2026 to block transactions directed at OGAI-listed prohibited platforms.

Issuer and date: Ministry of Electronics and Information Technology; PROG Act 2025; PROG Rules 2026 notified 22 April 2026; effective 1 May 2026; enforcement week 1 May–10 May 2026.

Why it matters: The operational picture in the first enforcement week is the real test for two classes of compliance actors. First, gaming-platform operators face three parallel Day-1 obligations: (a) holding a valid OGAI determination or having suspended real-money or prize-linked game operations; (b) having live user-safety infrastructure (age verification, time limits, parental controls, two-stage grievance mechanism with 30-day resolution commitment at each stage); and (c) having implemented data localisation for all Indian user data within India. Second, banks and payment service providers must have implemented OGAI prohibited-platform list monitoring in their payment screening infrastructure — the statutory obligation is absolute, not discretionary. The 90-day determination window under PROG Rules Rule 9 means operators who filed for OGAI determination on 1 May 2026 would have a decision by approximately 31 July 2026. Operators who have neither filed nor suspended are in violation from 1 May. The state-vs-central jurisdiction question — with Telangana, Karnataka, Tamil Nadu, and Andhra Pradesh having enacted pre-existing state-level gaming prohibitions — will generate litigation; the PROG Act's List III (Concurrent List) entries 31 and 42 are the contested constitutional footing.

Link: MeitY — PROG Rules 2026 Gazette Notifications.

Score: 10/15 (significance 4, impact 4, novelty 2 — enforcement novelty, not instrument novelty).

2. TRAI V2X consultation paper — first regulatory framework for connected vehicles under Telecom Act 2023

What changed: The Telecom Regulatory Authority of India released its Consultation Paper on the Regulatory Framework for Vehicle-to-Everything (V2X) Communication on 30 April 2026, published as Press Release No. 57/2026. The consultation, handled by TRAI's Network, Spectrum and Licensing Division, was requested by the Department of Telecommunications vide letter dated 1 December 2025 and addresses the spectrum assignment, licensing, and authorisation conditions for V2X — covering V2I (vehicle-to-infrastructure), V2N (vehicle-to-network), V2P (vehicle-to-pedestrian), and V2V (vehicle-to-vehicle) communications. Written comments from stakeholders are invited by 28 May 2026 and counter-comments by 11 June 2026, addressed to Advisor (Networks, Spectrum and Licensing), TRAI, at advmn@trai.gov.in.

Issuer and date: Telecom Regulatory Authority of India; Consultation Paper released 30 April 2026; comment deadline 28 May 2026.

Why it matters: V2X is India's first foray into defining a regulatory spectrum regime for Intelligent Transportation Systems under the Telecommunications Act, 2023. The consultation will determine whether V2X operates under a dedicated spectrum band (globally, 5.9 GHz ITS spectrum has emerged as a quasi-standard), a shared or unlicensed regime, or a carrier-tied authorisation model. The stakes are high for three sectors: automotive OEMs and ADAS suppliers building compliance roadmaps for connected-car features in the Indian market; telecom operators (Jio, Airtel, Vi) assessing whether V2X becomes a 5G NR-V2X play or a sidelink-only deployment; and public infrastructure bodies (NHAI, state PWDs, smart-city projects) whose roadside units and intersection controllers will need to be TRAI-compliant. Practitioners advising clients in any of these sectors should file comments that address spectrum band selection, licensing category (Unified Licence variant or new class?), roadside-unit authorisation, and cross-border interoperability with EU (ITS Directive 2010/40/EU) and US (DOT V2X Notice of Proposed Rulemaking 2023) frameworks.

Link: TRAI — Consultation Paper on Regulatory Framework for V2X Communication | PIB Press Release No. 57/2026.

Score: 9/15 (significance 4, impact 3, novelty 2).

3. Gujarat HC SAHYOG hearing — 8 May counter-affidavits; X compliance gap under scrutiny

What changed: In Vikas Vijay Nair v. Union of India (C/WPPIL/9/2026), the Gujarat High Court (Division Bench of Chief Justice Sunita Agarwal and Justice D.N. Ray) directed Meta India, Google, X, Reddit, and Scribd to file counter-affidavits by 8 May 2026 on their SAHYOG portal onboarding status and compliance with the three-hour takedown obligation under Rule 3(2)(b)(i) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026. The Union Ministry of Home Affairs disclosed to the Court that X received 94 intimations for unlawful content including synthetically generated information between 2024 and 2026, but provided formal responses to only 13 — a response rate of approximately 14 per cent.

Issuer and date: Gujarat High Court; PIL filed by Vikas Vijay Nair; SAHYOG portal created October 2024; matter listed for 8 May 2026.

Why it matters: The 8 May hearing is a critical compliance checkpoint for the five named intermediaries. A formal response rate of 14 per cent (13 of 94 intimations) for X, against the MHA's disclosure on the record, creates a finding-of-fact risk for X at the hearing — the Court may issue a specific direction on formal-response timelines or escalate to a contempt inquiry if the counter-affidavit fails to address the gap. For the four other intermediaries (Meta, Google, Reddit, Scribd), the MHA disclosure that some have "significantly improved speed, efficiency, and traceability" compared to the W18 position suggests a bifurcated outcome: compliant intermediaries may receive an affirmative finding; non-compliant ones face adverse orders. Legal teams preparing W19 counter-affidavits should confirm SAHYOG technical onboarding (system integration, not mere registration), document every formal response issued against the intimation log, and prepare a timeline showing three-hour-window compliance rates since February 2026. Safe-harbour protection under Section 79 of the Information Technology Act, 2000 turns on actual compliance with Rule 3(2)(b)(i) takedown obligations — the counter-affidavit period is the last practical moment to remedy any gap before judicial record is made.

Link: Gujarat High Court — C/WPPIL/9/2026.

Score: 8/15 (significance 3, impact 4, novelty 1).

Regulatory Action Log

What's Next

• 2026-05-08 — Gujarat HC SAHYOG hearing in Vikas Vijay Nair v. Union of India (C/WPPIL/9/2026): counter-affidavits from Meta, Google, X, Reddit, and Scribd on SAHYOG onboarding and three-hour takedown compliance. X's 14% formal-response rate is on the Court record; a finding of non-compliance could trigger a direction to the UoI to block X under Section 69A of the IT Act.
• 2026-05-13 — DPDP Act Section 44(3) larger bench — first substantive hearing in The Reporters Collective Trust v. Union of India (W.P.(C) 211/2026). Watch for any interim proportionality framework or direction on DPDP Board operationalisation timing.
• 2026-05-13 — DPDP Rules 2025 six-month marker — monitor egazette.gov.in for Phase 2 sub-rule activation notifications from MeitY (particularly Rule 4 Consent Manager obligations).
• 2026-05-28 — TRAI V2X consultation deadline — written comments due; stakeholders in automotive, telecom, and smart-city sectors should file by this date to influence the V2X spectrum band selection and licensing model.
• 2026-06-01 (expected) — DoT sub-rule notifications under Chapter IV of the Telecommunications Act, 2023; monitor dot.gov.in/notifications for authorisation and spectrum sub-rules.
• 2026-07-31 (approx.) — OGAI 90-day determination window closes for gaming platforms that filed on 1 May 2026; operators awaiting determination must suspend money-game operations until a determination is received.
• 2026-11-13 — DPDP Rules 2025 Rule 4 trigger: Consent Manager registration and obligations come into force (12 months from gazette notification).

Founder Action Items

• PROG Week-1 compliance audit — if your platform has not filed for OGAI determination and continues to offer prize-linked or fee-based games, you are in violation from 1 May 2026. Immediate steps: (1) identify all revenue streams that could constitute "online money game" mechanics under PROG Rules Rule 9 objective factors; (2) suspend or restructure monetisation; (3) file for OGAI determination within this week; (4) activate age verification, time limits, and parental controls if not already live; (5) confirm your banking partner has the OGAI prohibited-platform list integrated into payment screening.
• TRAI V2X comments — if your business has a connected-vehicle, ADAS, smart-city infrastructure, or V2X component, the 28 May 2026 deadline for TRAI comments is the singular opportunity to influence India's V2X spectrum and licensing framework. Engage your regulatory counsel to file a submission addressing spectrum band preference (5.9 GHz ITS vs. LTE-V2X vs. NR-V2X), licensing category, and cross-border product compliance.
• SAHYOG onboarding confirmation — if you are an intermediary (social media, content-sharing, gaming platform, marketplace) operating in India with monthly active users above 50 lakh, confirm SAHYOG technical integration before the 8 May Gujarat HC hearing establishes a compliance-record precedent. A "registered but not integrated" posture carries the same safe-harbour risk as non-registration.
• DPDP larger bench prep — the 13 May hearing in W.P.(C) 211/2026 will likely test whether Section 44(3) of the DPDP Act, 2023 — which exempts data maintained by the Central Government or State Governments from RTI-related personal data disclosure — is proportionate to the right to information under the RTI Act, 2005. Founders and DPOs at companies handling government-employee or public-servant personal data should brief their boards on the litigation risk before the hearing.

Practitioner Watch-list

• PROG Act constitutional challenge pipeline — five states (Telangana, Karnataka, Tamil Nadu, Andhra Pradesh, and Kerala) have enacted pre-existing online gaming prohibition statutes under Entry 34 of List II (State List). The PROG Act's List III basis creates a classical 254(1) repugnancy scenario for these state laws. Practitioners advising gaming clients in these states should obtain written legal advice on which regime governs from 1 May 2026 and file for OGAI determination as a protective measure regardless of which legal position the client maintains.
• OGAI prohibited-list monitoring architecture — the obligation on banks and UPI platforms to block OGAI-listed platforms is new territory: it is not a discretionary compliance obligation but a statutory gatekeeping duty under PROG Act 2025. Legal teams at banks and payment service providers should confirm that their transaction screening infrastructure can consume the OGAI prohibited-list in near-real-time, not just periodic batch updates.
• CERT-In advisory CIAD-2026-0020 — legal and security teams should confirm the affected products and mitigations published in this High-severity advisory (26 April 2026) are applied across client infrastructure. CERT-In's 6-hour incident reporting obligation under Section 70B(6) of the IT Act, 2000 (Directions of 28 April 2022) applies to any exploitation of the advisory's CVEs that results in a reportable incident type.
• TRAI V2X and DPDP intersection — V2X systems by design collect location, speed, route, and behaviour data from vehicle occupants. Any V2X deployment in India engaging Indian citizens will be subject to the DPDP Act, 2023 and, on DPDP Rules operationalisation, will require a lawful basis for collection and processing of such personal data. Practitioners advising automotive clients should begin mapping V2X data flows against DPDP Act Sections 4–8 now, ahead of the TRAI framework finalisation.

FAQ

What does PROG Rules 2026's first enforcement week mean for founders of gaming-adjacent businesses?

The PROG Rules 2026, effective 1 May 2026 under gazette notification CG-DL-E-22042026-271974, impose a zero-tolerance framework for online money games — defined as any game involving entry fees, monetary prizes, or in-game assets redeemable for real-world value. The first enforcement week (1–10 May 2026) is not a grace period. The OGAI is constituted and operational; banks and UPI platforms have been carrying the blocking obligation from 1 May. Founders of gaming platforms, fantasy sports apps, in-game-economy products, and adjacent monetisation tools should have completed their legal-architecture review before 1 May. If that review did not happen, the 90-day OGAI determination window (closing approximately 31 July 2026 for applications filed 1 May) is the operative emergency runway.

What should legal teams submit to TRAI's V2X consultation by 28 May 2026?

TRAI's Consultation Paper on the Regulatory Framework for Vehicle-to-Everything (V2X) Communication (30 April 2026, Press Release No. 57/2026) is seeking inputs on: (a) the appropriate spectrum band for V2X (5.9 GHz dedicated ITS band versus shared cellular spectrum); (b) the licensing category (whether a new V2X authorisation class under the Telecommunications Act, 2023 is needed or whether existing Unified Licence categories suffice); (c) roadside-unit and infrastructure-provider obligations; (d) type-approval and equipment-testing requirements; and (e) cross-border interoperability. Legal teams should file submissions addressing their client's technology choice (DSRC vs. C-V2X), the minimum regulatory certainty needed for capital commitment, and any DPDP Act compliance gap created by the current draft framework's silence on personal-data handling in vehicle-communications systems.

Is X's 14% formal-response rate to SAHYOG intimations grounds for losing safe harbour under the IT Act?

The Ministry of Home Affairs disclosed to the Gujarat High Court in C/WPPIL/9/2026 that X received 94 SAHYOG intimations for unlawful content (including synthetically generated information) between 2024 and 2026 and formally responded to 13 — a 14% rate. Under Section 79(3)(b) of the Information Technology Act, 2000, an intermediary loses its safe-harbour immunity if it fails to act upon receiving "actual knowledge" of an unlawful act. A court-docketed SAHYOG intimation constitutes constructive — arguably actual — knowledge. A 14% formal-response rate, on record in open court, significantly undermines X's Section 79 safe-harbour defence. The 8 May 2026 Gujarat HC hearing will likely require X to explain this gap; if the counter-affidavit does not address it with specific remediation commitments, the Court may direct the Union Government to take action under Section 69A of the IT Act (blocking order) pending full compliance.

Source policy: This tracker cites only Tier 1 sources — government ministries, regulators, the official gazette, and court portals. Discovery-only sources are not cited.

Next full edition: W19 supplement or W20 tracker covering 8 May Gujarat HC SAHYOG hearing outcome and 13 May DPDP larger bench listing, scheduled for publication Sunday 17 May 2026 (22:00 IST).