Online games never go out of trend; only the players grow up, and a new generation takes their place. From the games we grew up playing as children to the increasingly immersive digital worlds that captivate today’s younger generation, gaming has remained a constant source of excitement, curiosity and connection. As a child, I remember the fascination that games held; today, as an adult, I see the next generation drawn into these virtual worlds with the same enthusiasm, if not more. Yet, while the games have evolved, so has the world behind them. What once seemed like harmless entertainment, has transformed into an interconnected digital ecosystem where children do not merely play, but may also share personal information, knowingly or unknowingly, interact with strangers and leave behind an extensive digital footprint.
In a world where data has become a valuable commodity, an unsettling question emerges: While gaming companies continue to innovate and monetise their platforms, who is responsible to ensure that a child’s privacy is not the price paid for their entertainment?
Children’s data privacy under the GDPR
The GDPR does not treat children as just another category of digital service users. Recognising their particular vulnerability and limited awareness of the risks associated with sharing personal information, it affords them special protection in the digital environment. This concern is expressly reflected in Recital 38 of the GDPR[1], which acknowledges that children may be less aware of the risks, consequences and safeguards associated with the processing of their personal data, and therefore merit specific protection. In the context of online gaming, this is particularly significant: from usernames and email addresses to gaming habits, purchase histories and behavioural patterns, children may generate and disclose far more personal data than they realise.
Protecting children’s data under the GDPR is not a matter of inserting a parental-consent checkbox into a sign-up page. It requires a comprehensive approach in which every stage of data processing is governed by a legal safeguard.
- Article 5, GDPR[2] –
Ground Rule : Personal data must be processed lawfully, fairly and transparently, collected for specified purposes and limited to what is necessary. For a gaming platform, this means that the excitement of a game cannot justify collecting more information about a child than the service genuinely needs.
- Article 6, GDPR[3]–
The Legal Justification: Before processing personal data, a platform must establish a valid legal basis. Consent is one possibility, but it is not the only one. A company cannot simply assume that collecting data is permissible because it is commercially useful or technically convenient.
- Article 7, GDPR[4]–
Proving Consent: Where consent is relied upon, it must meet the GDPR’s requirements, and the controller must be able to demonstrate that consent was given. A checkbox may record a click, but it does not, by itself, establish that consent was freely given, informed, specific and unambiguous—or that the person clicking it had the necessary authority.
- Article 8, GDPR[5]–
Who Can Say “Yes”?: The GDPR sets the default age for a child to consent independently to the processing of their personal data for online services at 16 years, but individual EU Member States may lower this age to 13. The applicable age therefore depends on the law of the relevant Member State. If a child is below that age, parental consent or authorisation is required when the service relies on consent as its legal basis. The platform must also make reasonable efforts to verify that the parent or guardian has actually given that authorisation, taking available technology into account. In other words, a child ticking “I agree” is not enough where parental authorisation is legally required.
- Article 12, GDPR[6]–
Making Privacy Understandable: Privacy information must be concise, transparent, intelligible, easily accessible and expressed in clear and plain language. Lengthy legal notices that children cannot realistically understand undermine meaningful transparency. The information should be presented in a way appropriate to the intended audience.
- Article 25, GDPR[7]–
Protection Built into the Game: Data protection must be considered when a service is designed and configured, not added after a problem emerges. Privacy-friendly defaults, limited data collection and appropriate restrictions on access should be built into the platform from the outset.
- Article 35, GDPR[8]–
Identifying Risks Before They Materialise: Where processing is likely to result in a high risk to individuals’ rights and freedoms, a Data Protection Impact Assessment (DPIA) is required before processing begins. For a gaming platform involving extensive profiling, systematic monitoring or other high-risk processing of children’s data, a DPIA can help identify and address risks before they affect young users.
Seven Provisions, One Solution- Together, these provisions create a connected system of accountability: Article 5 establishes the principles; Article 6 provides the legal basis; Articles 7 and 8 address consent and parental authorisation; Article 12 makes the processing understandable; Article 25 embeds safeguards into the service; and Article 35 requires high-risk processing to be assessed in advance.
Beyond the Check-Box: Who Said “YES”?
A child enters a date of birth, types in a parent’s email address, ticks a box marked “I agree” and dives straight into the game. Within seconds, the account is active and data collection begins. But behind that seemingly harmless click lies a much bigger question: was the person behind the screen actually a parent giving consent, or had the platform mistaken a child’s click for a parent’s permission?
This is where the GDPR’s legal requirement meets the practical realities of online gaming. Article 8(2) of the GDPR[9] requires a controller to make reasonable efforts to verify that parental consent or authorisation has been given, taking available technology into consideration. The Regulation does not prescribe a single verification method. Instead, the platform must adopt an approach appropriate to the circumstances and risks involved.
The distinction is critical; collecting an email address is not the same as verifying parental authorisation. A company must do more than record a response; it must take reasonable steps to establish that the authorisation came from the appropriate person. At the same time, verification must not become an excuse to collect excessive personal information from children or their parents.
The challenge is not merely theoretical. Gaming companies have developed different approaches to adult verification and parental involvement, illustrating how a consent process can extend beyond a simple checkbox. Although these practices and the legal requirements governing them vary across jurisdictions, they offer useful examples of how gaming platforms attempt to establish parental authorisation in practice.
1. Epic Games – Fortnite and the “Cabined Accounts” model
Epic Games uses Cabined Accounts for younger players. When a child creates an account, they may be asked to provide a parent or guardian’s email address. The parent receives a request to complete the consent process. Depending on the country and the features involved, the process may include adult verification through methods such as a payment card, an identity-document check or facial age estimation. Certain features remain restricted until the required steps are completed.
2. Nintendo – Using payment-card verification
Nintendo’s parental-consent procedures have included payment-card verification in certain jurisdictions. A small charge or similar payment-card check can help establish that an adult is involved in the process, rather than relying solely on a child entering an email address or date of birth.
3. Roblox – Linking a parent’s account to a child’s account
Roblox allows parents to link their own accounts to their children’s accounts. Its published process asks the parent to enter their date of birth and verify their age using a government-issued ID or credit card before linking the accounts. Once linked, parents can manage parental controls and access information about their child’s activity on the platform.
4. Ubisoft – Parental involvement built into child accounts
Ubisoft, a French video-game company, offers child accounts linked to a parent’s or legal guardian’s account. Its published guidance describes a process in which the parent reviews the child’s account details and provides consent to its creation. In certain countries, the parent may also need to verify their age using a credit card or identity card. Linked accounts provide parental controls, including restrictions on communication and purchases.
Consent Wrong- GDPR Penalties and The Fortnite Case
Gaming companies that fail to protect children’s personal data may face regulatory investigations, orders to restrict processing, data deletion and substantial fines. Under Article 83(5) of the GDPR[10] certain infringements can attract fines of up to €20 million or 4% of the undertaking’s total worldwide annual turnover, whichever is higher. The actual penalty depends on the nature and circumstances of the infringement.
A real-life example is Epic Games, the developer of Fortnite, which agreed to a $520 million settlement announced by the US Federal Trade Commission (FTC) in December 2022. This comprised a $275 million civil penalty relating to alleged violations of the US Children’s Online Privacy Protection Act (COPPA), including failures to obtain required parental consent, and $245 million in consumer refunds relating to separate allegations of deceptive billing practices.
Although this was a US enforcement action and not a GDPR fine, it highlights the consequences of inadequate safeguards for young players. For gaming companies operating under the GDPR, the lesson is clear: parental authorisation, appropriate age-verification measures, privacy-friendly default settings and effective safeguards must be built into the service and not treated as mere formalities.
[1] https://gdpr-info.eu/recitals/no-38/
[2] https://gdpr-info.eu/art-5-gdpr/
[3] https://gdpr-info.eu/art-6-gdpr/
[4] https://gdpr-info.eu/art-7-gdpr/
[5] https://gdpr-info.eu/art-8-gdpr/
[6] https://gdpr-info.eu/art-12-gdpr/
[7] https://gdpr-info.eu/art-25-gdpr/
[8] https://gdpr-info.eu/art-35-gdpr/
[9] https://gdpr-info.eu/art-8-gdpr/
[10] https://gdpr-info.eu/art-83-gdpr/
-Anwesha, Associate, Ductus Legal
