As a solicitor who is also a gamer, and having worked in the legal side of the tech industry, for more than a few years now, the future of online safety regulation is something that I am both personally interested in and impacted by. One of the most interesting areas of application of these things is within the video games industry, although they apply to most social media platforms and to tech generally – this is an area where it cannot be denied that Children are indeed users and so it is an area of focus for regulators. With the specialisms I have developed in data protection, consumer law, and tech and contracts generally I can see that there are some obvious crossroads of these issues which the video games sector is fast approaching. There are a number of trends pushing the sector right now, protecting children and consumers generally being the most relevant in my opinion.

How does the law try to deal with the fast pace of tech?

The way that a lot of modern regulation of the internet and tech generally works is that it focusses on outcomes rather than specific requirements. For example, with personal data regulation there is a requirement to consider the risks to the rights and freedoms of individuals when assessing if a certain processing activity is going to be OK or not when assessing "legitimate interests", and this leaves quite a lot of flexibility to the processor as to how they reach that determination. That flexibility allows for innovative approaches, and is aimed at promoting new things rather than being overly restrictive. The Online Safety Act introduces requirements to implement systems and processes to reduce the risk of allowing or enabling illegal activity or harm to take place, and it has an extra layer of focussing on protecting children online. There are then reems upon reems of consumer laws and these often include more specific regulations. All of these different laws and regulations interact and need to be considered in the whole rather than just individually.

Whilst the tech scene moves fairly quickly, the law tends not to, and so outcomes focussed approaches are usually better at preventing adverse consequences from arising out of novel developments. Part of my role is not only to consider how existing laws apply to new technologies, but also to try to consider how new laws might try to further regulate technologies that don’t yet exist and what technologies might be developed in the near future. For that reason I spend a lot of time scanning the proverbial horizon and there are a few recent developments that have me thinking about that future.

What changes are we seeing already?

The recent-ish developments are:

• Court cases deciding that an AI image of a celebrity is technically regulated as personal data;Recent announcement of UK-US joint investigation of children's safety online;
• UK Online Safety Act and the ICO's now slightly older Children's Code (and things like requiring Age Assurance measures);
• Body image investigation by the CAP and BCAP finding that no new regulation is required;
• Roblox (a popular video game) implementing an array of privacy controls for parents;
• Trends involving early access games or pre-order arrangements not being delivered as described (either not functioning correctly or falling short of promised feature development);
  

Now why are these things interesting to me?

Well…

• We are getting closer to AI avatars in games, pretty soon I can imagine that character creation engines will be able to scan your face/body in order to create an in-game representation of yourself. It's already fairly clear in some VR games who the children are in a room because they tend to be a bit smaller than your average adult (not to mention the high pitched voices) and yet this data is not usually protected in any real way - allowing children to be targeted without them knowing (or indeed, kicked and excluded from a team with little reason other than the fact that adults do not necessarily wish to play games with children in some cases);
• The US has not historically been that active in trying to protect personal data generally, so seeing them make any sort of announcement about becoming a world leader in this stuff is an interesting pivot for them. The cynic in me wonders if it has anything to do with their anti-TikTok stance and whether such a code might eventually be used as a sword for that cause;
• The UK Information Commissioners’ Children's Code should have addressed much of what the Online Safety Act could be used to achieve, and so, much like with the 2018 (UK)GDPR rehashing much of the previous Data Protection Act from 1998 - just with extra teeth - could the increase in the level of fines and enforcement powers be the thing that pushes this into the fore?
• Age assurance - this is still not really a thing. Are you 18? Yes or No? Credit cards are pretty easy to get hold of for such a purpose and so that doesn’t cut the mustard either.
• Body images in games are generally not realistic, sometimes even fantastical, and from my perspective at least I can imagine that the same harmful consequences might flow from video games, as they do from advertising, and yet I've not seen anything regulating character models in games as yet or guidance on this point. Some games in particular that I won't name seem to take certain character aspects to ludicrous heights and that on its own could lead to unintended negative outcomes for developing minds as to what body image means to them and in developing preferences generally;
• Roblox appear to be leading the way in an industry that tends to fairly reliably prefer to self-regulate rather than have regulations imposed upon it, and with multiple year development cycles to consider, is this the start of a new age of privacy and parental controls within gaming?
• The ICO has stated that whilst businesses are subject to regulations it is ultimately for individuals to manage their own privacy, but that businesses must educate their users about privacy so that they can make informed decisions. I feel that with the challenges faced by small businesses generally, trying to explain the complex nature of the (often third party) tools they utilise is not a realistic expectation, nor is it likely to be a priority for them. Then at the other end, larger studios or publishers are likely using so many tools and so much data that it is probably TMI and overwhelming for the average person (let alone a child) to understand exactly what it means to “share network information” with a game, for example;
• Recent-history games releases have in some cases either fallen well short of expectations or collapsed completely. Whilst there are some success stories like those of Cyberpunk 2077 or No Man’s Sky whose poor launches were more than made up for by further development (well done those people), other games have not always managed to fix themselves after launch. In some cases customers may have paid for a game in early access only to have it pulled and be left with nothing (and no refund). Steam in particular have made efforts to apply some level of quality assurance to such games, but the damage has already been done and gamer’s trust has been eroded over time; and
• Microtransactions in games have become increasingly prevalent, and it isn’t always easy to understand ahead of time how a game will want to take your money from you after you’ve already paid the initial outlay. Not to mention downloadable content that follows release which in some cases might be required to be able to play online with a meaningful number of other people.
  

Challenges with respect to children’s safety online

Even more fascinating for me is the combination of the above and what that means for the future. Children in particular are usually keen to find workarounds for parental controls, so how do we try to prevent that from happening?

If we do create a much more immersive experience and convey things like emotion through facial pass-through technology, does that help or hinder the current situation with online bullying? Will players empathise more with each other when they are given more emotional cues and information about their fellow players or will this go the other way completely? It's not like being together in a playground face to face reduces bullying, in fact that can be worse than online bullying because the bully might now see you cry when they say or do something you don’t like. Some people really do seem to enjoy trolling others, and so it isn’t just the risks we experience today that need to be addressed, it is the risk that we introduce tomorrow that we also need to temper.

To me, there are a lot of questions about how the gaming industry in particular will implement measures to address the harms and risks that modern regulation attempts to address. Adult content video sharing services are still under the microscope for implementing age verification measures and that is something that has been ongoing now for around two years in some cases. Services like OnlyFans, who you would realistically expect to be able to implement an age verification control, still have not satisfied the regulators despite ongoing investigations and having already taken steps to put measures in place. How then a video games company can meet this threshold seems utterly in the air.

How might tech help overcome these challenges?

First off, it will cost time and money and will require specialist attention. That all has to come from somewhere, so it might be a collaboration between the largest players in the industry or it could be government funded (and given the global nature of games, would global governments play nicely together to achieve this?). It is unlikely to come from indie developers. Without substantial government research and guidance it would seem to be a difficult commercial case to make to require video games developers and publishers to test out new controls. It might be that the largest publishers will have teams of people with experience similar to my own in order to develop and manage all of these new processes and controls, but I just don’t see how indie developers will be able to comply with this. That leads me to conclude that the only real way we can achieve everything that is being asked is for someone to develop a dedicated service that provides these tools independently and which is itself monitored by the regulators with input and potentially funding from games publishers and those governments who want to ensure their population (in particular children) can benefit from these protections.

That service could or would have to do several things, in order to satisfy some basic requirements of consumer and other laws that tend to be missing, to name a few:

• Create a register of users - to be used for age verification and ID generally. Maybe another use case for blockchain?;
• Provide for general parental controls/oversight;
• Be compatible and interoperable with games of all sizes;
• Educate and inform users about privacy controls within particular games and especially to draw out the differences between games so that users are informed that certain practices are fairly normal whereas some others might be fairly characterised as unusually invasive;
• Apply standard privacy choices (similar to the way Do Not Track was intended to work as a browser setting); and
• Track and store contracts that users have agreed to, and provide version control/repository functionality for those terms over time.
  

The benefits of this type of system could be numerous, for instance:

• People who make games can focus on making games, rather than keeping a register of children's data somewhere and being particularly liable for protecting that information and keeping it up to date;
• Fraud and money laundering should be reduced by connecting users across games and being able to trace payments and identify suspicious activity;
• Cheating should be reduced, if proper ID is taken and verified, as users are unlikely to want to be banned from gaming completely across other games where they are proven to use cheats. Even being on a blacklist of known cheaters that developers could access might help reduce or prevent cheating, this could be done under existing data protection laws either under contract or the legitimate interests of both users and developers in safeguarding against cheating;
• Parental confidence in gaming without being a burden. Parents should be able to see their children's activity and understand what kind of content their children are potentially going to be exposed to, in a standardised way that allows parents to make meaningful decisions about what games to allow their children to play in the first place (thinking about the rocking cars in GTA back-alleys). If parents are able to feel confident that they understand what certain terminology such as "blood and gore" means within the context of a game, they are more likely to be able to be comfortable making decisions about age ratings (I firmly believe that some children can play 18+ rated games with appropriate supervision without that necessarily causing any harm - it always depends on the person - some people should never play certain games regardless of their age because it might scare them silly);
• More engagement by parents, leading to more sales. Parents who don’t make use of any parental controls have reported feeling that they think that some parental controls are either unnecessary or are too difficult or tedious to set up, or they simply weren't aware of them. If this is standardised based upon the child rather than each individual game, parents should be able to set standard controls that games can then read and apply without requiring the parent to set up those controls each and every time a new game is activated, not just on a platform-by-platform basis but across devices to ensure consistency and ease of management. Having to choose from one or two additional controls for a new game would presumably also take far less time and allow a more nuanced and focussed discussion to take place when required, rather than being drowned out by the usual suspects that some parents may consider the norm (violent scenes, depictions of war etc).
• Terms and conditions and lengthy privacy notices could be cut down to the core of what they need to address, rather than assuming that a 15 year old is going to re-read the same boilerplate terms and conditions and extensive notices about their data being processed in the USA - this would be an opportunity to shift much of the information burden to just-in-time notices and potentially incorporate educational materials into games in a way that is interactive rather than just "read this before you proceed".
• Standardisation of the collection and use of data could increase trust in the sector, and generate a wealth of useful information, which could aid research and development across sectors.
• Reduce the time and annoyance that gamers face on first load of a new game clicking accept, continue, agree before being able to experience a game;
• Draw out unfair practices and unfair terms within video games, to improve visibility of such things to consumers so that they can make informed decisions about what games to buy based on how their data and money might be sucked into a game – before they purchase it ;
• Apply market pressure to games companies not to introduce radically invasive or profiteering practices because of the disincentive of users having increased awareness of what is normal vs what is unusual.
• Reduce administrative burdens on video games makers getting to market and staying there, lowering barriers to entry and improving competition across the board.
  

Who knows if this is how things will play out, but one thing is for certain, change is in the air and the game is certainly afoot, the regulators are making all the right noises to start bringing in regulation that could introduce more than a few pain points for developers worldwide and it would be pretty nice to have a single silver bullet to pierce through the noise – and to let developers focus on making great games rather than worry about regulators breathing down their necks.