Key risk areas

The “Growing up in the online world” consultation (closing 26 May) covers a number of different topics, with several that are directly relevant to the video game industry. As future age restriction regulations will be directly informed by the outcome of the consultation, these areas therefore have the potential to be regulated/implemented and pose risks to the industry.

This article outlines what the areas are, how they could impact the industry, and who they are most relevant to. If it strikes a chord and you want to have a chat, get in touch!

At a glance 

With different risk levels for different types of game or service, we’ve summarised the relevance of the topics in this handy infographic:

‘Social media’ ban 

The most notorious part of the consultation and proposed regulation, with its roots in political pressure. It’s the origin of the upcoming regulations, since the first proposal was specifically framed as an age restriction on social media and it’s what most of the public discourse has considered.

However, it is not limited to ‘traditional’ social media – even the narrowest version of the proposed legislation covered ‘user-to-user services’. As such, it directly relates to communication between players and to UGC games content. Much of this is already covered by the Online Safety Act in terms of content, but a ‘social media’ ban would be about whether minors can access user-to-user functions at all. Further below we look at particularly risky types of communications (chiefly in-game chat) but the ‘social media’ ban could apply very broadly and potentially prevent under-16s accessing UGC content (items or games) at all.

This represents a very high risk to platforms that rely on UGC content or where chat is integral to gameplay (more on this below). However, there is still a risk to other games with comms systems that are less vital to gameplay, since age restrictions could have impacts for how these are implemented and managed.

Digital age of consent 

This is about whether the age at which children can consent to personal data processing should be raised from 13 to (likely) 16. The rationale for this is that the data processing landscape has evolved considerably since this age was set.

The impacts of this change will depend on how games companies approach data processing and whether they wish to continue undertaking it for under-16s. If so, they would need to build systems for collecting verifiable parental consent. If they intend to exclude under-16s from data processing (or the service itself) then existing processes would need to be expanded to cover (and therefore identify) existing under-16 players. As the ICO now requires age verification measures that go beyond self-declaration, all personal data processing based on consent would need to be subject to age assurance.

This is a particular risk to companies where personalisation forms a significant part of their business model, especially targeted marketing and pricing. This is because it reduces the proportion of their existing audience that can be included.

‘Risky features’ 

This covers elements from a range of the other topics, but primarily ‘stranger pairing’ within communication functions. Video games have been identified as a particularly risky online service when it comes to interactions with strangers, since the common practice of multiplayer with strangers is seen to normalise this kind of contact. Practically any form of co-operative or competitive play with communication functions could be captured by this. For more information on why, check out our article on how player comms are in scope.

For games that heavily feature or rely on these mechanics, such as battle royale or UGC platforms that allow integration of comms, this is a significant risk. Other types of games may still be impacted, but they are either more heavily skewed towards older players or their implementation may be less central to game function and design.

Addictive design 

This encompasses features such as in-game purchasing, ‘affirmation’ functions, and (where relevant) algorithms intended to increase engagement. This is discussed in a section looking at ‘addiction’ and compulsive design specifically.

With the exception of in-game purchasing, which relates to video games directly, the other aspects are largely framed as a reflection of mechanics in ‘traditional’ social media. For instance, most of the ‘affirmation’ functions are about comments, reactions and performance of individual posts, and sit alongside features like infinite scrolling. However, depending on how these elements are treated, they can cover video games.

All of these functions are ubiquitous in the video games industry, particularly loot boxes, daily rewards, and achievement mechanisms. If they are age restricted, then some potential implementations would have a significant impact on almost every online game. It’s therefore high risk across a wide variety of game types.

AI chatbots 

A lot of the focus on AI chatbots has been on standalone services (or those that are a significant function of a broader platform). However, the ramifications could well apply to some types of games as the use of AI develops.

Some developers are using AI as a way to enhance immersion through intelligent non-playable characters, or to create unique gameplay mechanics dependent on responsive interactivity. It will therefore be important to know where the boundaries lie and what constitutes a chatbot.

Risk level varies by audience here, so integration into all-ages games is higher risk than other services. Where they can be inserted into UGC content, there could be barriers to oversight by the platform, also making this higher risk.

Age assurance 

Because the point of these regulations is to create age restrictions, age assurance will inevitably become a requirement on service providers for enforcement. Even where children are not the target market or a game has a PEGI 16 or 18 rating, the restrictions would nonetheless need active implementation.

It would be reasonable for the method of verification to vary by function – for instance, estimation may arguably be sufficient for some applications, with stricter measures being reserved for others. However, this is not guaranteed, and it is possible for intensive age assurance to be a requirement for many, many games.

Given that every type of game has a risk in one or more areas, this issue applies to everyone with an online game subject to eventual age restriction and is therefore potentially the most significant risk.