Gaming and law: What businesses need to know

Types of online advertising caught by new and existing regulatory requirements

Most privacy and transparency requitements regulate “programmatic” advertising, where cookies and other identification and tracking technologies are used to target advertising campaigns to people (or devices used by people) most likely to buy (based on a profile built using browsing history and other information about the person). This type of advertising depends on building detailed profiles using personal data, so is caught by privacy laws and new transparency requirements.  This type of advertising can be displayed as pop-up ads, or on advertising within a game (such as billboards or on cars).

Other types of advertising typically displayed in games include product placement, which does not rely on additional personal data from players, presenting the product in same context to all players. That said, product placement is still subject to certain regulatory requirements.

European privacy legislation

Targeted advertising is subject to specific regulation in jurisdictions including the EU and UK (i.e., the E-Privacy Directive and the GDPR, which also apply in the UK as assimilated law). Generally speaking, these laws require users to give freely-given, informed and specific consent to the use of the tracking technology that underpins targeted advertising. As we are all too aware in Europe, this translates to cookie consent banner pop ups on almost every website you visit.

With evolving gaming technologies and increasing use of accounts linked to gaming platforms and browsers, targeted advertising techniques are being used to provide advertising in-game. Given the immersive nature of gaming, businesses have to consider how to obtain the required consent while preserving the user experience. 

Some gamers will be familiar with certain approaches that are taken. Particularly in mobile games, gamers can pay a fee to unlock an “ad free” version of the game - enabling gamers to enjoy a more immersive gaming experience and the game publisher to monetise without displaying ads (and without having to comply with ad-related regulatory obligations). The lawfulness of this type of “pay or okay” model is currently being considered by privacy and competition law regulators following Meta’s introduction of such a model in the EEA and Switzerland. 

Digital Services Act and Digital Markets Act

The content of advertisements in games may also fall within scope of the EU Digital Services Act (DSA), to the extent that game publishers (or subscription providers) are “online platforms”, which will depend on how they operate. In addition the use of end user personal data in online advertising by “gatekeepers” is also regulated by the Digital Markets Act (DMA).

Under Article 26 of the DSA, gaming platforms that are “online platforms” must ensure that, for each advert displayed to a user, the user must be:

• told that they are seeing an advert;
• told on whose behalf that advert is displayed; and
• given meaningful information about the main parameters used to determine why that user is being targeted by that advertisement and, where applicable, how to change those parameters. 

Online platforms have some discretion on how they comply with these requirements, although they will likely use icons in ads that users can click through.  The way this is implemented and the information provided will vary on the type of ad being displayed and the nature of the game (e.g., in-game ad, pop up, home-screen ad). The key requirement is to keep users informed as to why they are seeing the ad – ensuring that the parameters driving ad-placement are transparent to users. 

These measures could also apply to product placement, presenting additional practical challenges when looking to maintain an immersive player experience. 

Marketers will need to find ways to ensure that ad disclosures are clear and upfront. Using notices or symbols will be best (and will cause the least friction if common terminology/symbols are developed).

The DSA also prohibits online platforms from presenting online ads to users based on the profiling of “special categories of personal data”, as defined under the GDPR.  Similarly, targeted advertising to children is prohibited, and online platforms must put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors on their service.

The DSA also requires online platforms to have proper oversight of how advertising is undertaken on the platform and empower users to report illegal content (including ads) in an easy and effective way.   

The DMA also constrains the use of user personal data in online advertising. Designated gatekeepers (currently Google, Amazon and Meta) cannot process personal data generated by users using third party services for the purpose of providing online ads unless the user has been presented with a specific choice ad has given consent. As noted above, the compliance of Meta’s “pay or okay” model with this restriction is currently being considered by the European Commission. 

Considerations from a UK perspective

Similar privacy requirements to those mentioned above apply in the UK. More specifically, the UK Information Commissioner’s Office published guidance in relation to game developers on protecting children in 2023, which includes a number of recommendation relating to marketing, including:

• That behavioural profiling for marketing should be turned off by default; and
• Where a child opts into receiving ads, there should be controls on what they see.

Businesses hosting adverts in the UK must be aware of the Advertising Standards Authority’s (ASA) expectations regarding ads being displayed. The ASA has provided specific advice on advertising in video and mobile games. Video and mobile game ads must be targeted appropriately if they contain elements unsuitable for children, and the ASA is likely to expect advertisers to prove they took all appropriate steps and used all available tools to target the content away from children. 

Standard content restrictions will apply regardless of the nature of the game and whether there is a targeted element to the advertising; the ASA has indicated, for instance, that objectification and sexual violence are unlikely to be acceptable in ads for games, even if it features heavily in the game itself. 

The UK Code of Non-broadcast Advertising and Direct and Promotional Marketing (Code) makes it clear that marketing communication must be obviously identifiable, which can be challenging in a gaming context.

Under the Online Safety Act, some games will be user-to-user services.  Developers of these games must take proportionate measures to prevent users from encountering certain illegal content and prevent children from encountering certain harmful content. For user-user-services classified as “Category 1” by Ofcom, they will also be required to take measures to prevent users from encountering fraudulent advertisements.

Our take

The law applicable to online marketing and advertising in a gaming context is not specific to gaming, but gaming can produce some unique challenges in how to comply with these laws because of the importance of providing an immersive and friction-free experience to the gamer. 

For some companies, these challenges have become more acute since the coming into force of the DSA and DMA, and content moderation requirements will further increase the regulatory burden on game developers.