The video games industry nowadays is more interconnected, developed and commercially lucrative than ever before. Game developers of all ranks and sizes have access to state-of-the-art development, marketing, platform tools and choices to develop, launch and commercialize a game with ease the likes never seen before.

This development however does not solely create lucrative potential, but also legal implications. More specifically, data that players provide when signing up for an online (mobile) game has not only become more commercially valuable, but also subject to more regulation by legislators in Europe.

Personal data processing needs to adhere to the principles laid down in the General Data Protection Regulation (“GDPR”) to be compliant with EU data protection law. Depending on the on- or offline nature of the game, players will disclose data(sets) revealing identifiable information about themselves and others, which game developers in turn process in the context of their business activities. Common examples include gamertags, e-mail addresses, sex/gender, age and – depending on whether in-game transactions and/or membership fees are at play – card and other payment details.

In the following sections, we address three increasingly relevant issues under data protection law in relation to (online) games: the legal basis for processing, automated banning systems, and in-game marketing of additional content.

Legal basis for processing: consent, performance of a contract or legitimate interest

The processing of personal data must be carried out under one of the legal bases provided by the GDPR. Consent given by the data subject for data processing constitutes one of the legal bases relied on in the context of (online) games.

Consent in the context of the GDPR must be understood as an unambiguous indication of an informed and freely given choice by the data subject, relating to specific processing activities. The burden of proof that these criteria are fulfilled falls upon the controller (i.e., the game developer).

Withdrawal and conditionality of consent for a service provision

Once consent is provided, players have the right to withdraw it at any time. Players should be able to withdraw consent as easily as it was given. In practice this means consent should at least be obtainable and withdrawable through the same user interface – for example through the games’ settings or options menu – and preferably by taking the same actions wherewith consent was initially acquired.

Withdrawal of consent should be without detriment to the player. This means that doing so should be possible free of charge or without any risk of decrease in quality of service. Consent as a legal basis is best avoided in case processing activities of personal data are essential for the games’ (proper) functioning, as consent would then not be given freely, but rather as a conditionality.

Consent should not be relied on as a catch-all requirement for all processing activities, including those not inherently required for the functioning of the game. Game developers relying on consent from the player should provide separate options for giving consent for individual processing activities.

Conditions for gaining valid consent in relation to minors

Data processing activities by game developers will regularly involve data processing concerning minors. Consent given by children younger than 16 in relation to an (online) game is only valid if the holder of parental responsibility gives it or authorizes the minor to give consent. Taking into account the technological possibilities available, game developers are responsible for making reasonable efforts to verify that authorization by the parental guardian is given.

Data processing as part of the performance of a contract or legitimate interest

Data processing as a necessity for the performance of a contract to which the data subject (the player) is party constitutes a legal basis under the GDPR. The necessity of the processing needs to be confirmed in relation to the objective of the processing, in this case providing the game. Examples include age verification systems, payment details for in-game payments, progress made in the game, and e-mail address storage as log-in credential.

The legitimate interests of the game developer or third party constitutes another ground for lawful data processing. For game developers to rely on this legal basis, the processed data needs to be limited to what is strictly necessary for fulfilling the legitimate interest and must stand in proportion to the data subjects’ interests. Examples of where legitimate interest could be used include storing player-developer correspondence for quality improvement, the collection of meta-data to improve server strengths and in-game function measurement for product improvement.

Automated banning systems in response to player misconduct

Online games often utilize automated banning systems to prevent players from violating game regulations and codes of conduct. Examples of such conduct include the usage of inappropriate language in online chatrooms or the usage of cheating software to gain unauthorized access to game-elements. Automated banning systems could however qualify as automated individual decision-making as referred to in Article 22 GDPR.

Automated individual decision-making

Players have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Based solely on automated processing means that no human involvement has occurred at any stage in the decision-making process. To qualify as human involvement, any oversight of the decision should be meaningful, rather than just a token gesture. It should be carried out by someone who has the authority and competence to change the decision.

A legal effect requires that the decision affects an individual’s legal rights. A decision that similarly significantly affects an individual means that the decision must have the potential to significantly affect the circumstances, behavior or choices of the individual, and have a prolonged or permanent impact on the data subject or lead to the exclusion or discrimination of individuals. Depending on the circumstances, banning a player from a game could significantly affect them.

Conditions for authorized automated decision-making

Automated decision-making is in principle allowed under certain circumstances, for example when the automated decision is necessary for the performance of or entering a contract. The game developer must be able to show that this type of processing is necessary and no less privacy-intrusive method could be adopted. After all, if less intrusive means to achieve the same goal exist, then it would not be “necessary”. For example: routine human involvement can be deemed impractical or impossible if game developers want to check if players are not using (cheating) software prohibited in the general terms and conditions of the game.

Additionally, game developers could further base the automated decision on the player’s explicit consent (e.g., toggling a box and confirming that action by clicking a pop-up button). This would how-ever be subject to the same conditions as discussed above, with the addition that the consent ought to be aimed specifically at the automated decision-making on its own accord. It should be separate from other consent requests the developer wants to make.

The rights of players in relation to automated banning systems

When dealing with automated decision-making, account must be taken to the player’s rights. Players have the right to obtain meaningful information about the presence and significance of, the logic in-volved and the envisaged consequences of automated banning systems. Meaningful information co-vers the rationale behind, or the criteria relied on in reaching the verdict of banning a player.

Furthermore, game developers should develop appropriate safeguards when dealing with automated decisions, including a way for the player to obtain human intervention, express their point of view, and contest the decision in a meaningful manner.

In-game marketing and communication data

Personalization of in-game advertising

Many games nowadays offer additional in-game content for sale, such as booster packs and/or loot box mechanics, functional or aesthetic items, and access to distinct levels, game modes and/or maps. This content is often promoted through in-game commercials during loading screens or in-game stores. If data is used to target players individually with catered in-game marketing, the GDPR applies.

Meta data collected indirectly from players – such as time spent playing, measurements of playing-sessions, in-game currency spending patterns etc. – is personal data if the player remains identifiable. Game developers who use this to optimize when, what and to whom certain in-game marketing is shown engage in a process known as “profiling” under the GDPR.

The developer needs a legal basis for this processing activity. It is unlikely to be considered necessary for the performance of the service, offering the game (platform). Depending on the level of profiling, a developer may be able to rely on legitimate interest as the legal basis. However, in case of extensive profiling, consent may be required, as the players’ rights and interest could in such case outweigh the developer’s interests.

E-Privacy Regulation and in-game communication

Most online games offer a multitude of in-game communication services such as chatrooms or instant messaging functions. The proposed E-Privacy Regulation might become applicable to some of these communication services.

The draft E-Privacy Regulation aims to widen the scope of regulated electronic communications data. Communications between a defined number of end users, determined by the sender of the communication, are subject to the provisions in the draft E-Privacy Regulation.

“A defined number” does not mean “potentially unlimited”. Hence, an online chat room open to all online players does not qualify as interpersonal electronic communications, rendering the E-Privacy Regulation out of scope.

However, direct messaging communications between two or more players, only accessible to those players, would qualify as interpersonal electronic communications, therefore falling within the scope of the draft E-Privacy Regulation.

In principle, the data of these electronic communications ought to be confidential. This means that listening, tapping, storing, monitoring, scanning or other kinds of interception, surveillance or processing of the communications data is prohibited, except when permitted by the E-Privacy Regulation.

If data derived directly from the direct interpersonal messaging communications is used for profiling, the draft E-Privacy Regulation would require that players consent to in-game advertising based on such data. If the developer wants to send direct marketing communications to players (e.g., via e-mail or push notifications), it requires consent from the player. This consent is separate from (and should be collected separately from) the consent for advertising based on the communications content. For direct marketing communications, players should be given the option to object – at any time and free of charge.

Conclusion

In sum, game developers need to be aware that processing of player data comes with legal responsibilities. EU data protection and electronic communications legislation plays a key role in assessing legal compliance; from the moment a player signs up for a game, to the monitoring of online conduct, as well as the in-game marketing exploitation. 

More insights together with some numbers and statistics in our Video games industry report