On April 4, 2024, the Consumer Financial Protection Bureau (CFPB) issued a report examining the growth and privacy risks of financial transactions in online video games and virtual worlds, noting that Americans spent approximately $57 billion on gaming transactions in 2023. The report looks at these assets’ growing use and scale across the gaming industry, the associated consumer risks, and the evolution of games and virtual worlds into online marketplaces.

Gaming-specific services can resemble traditional financial products, and the CFPB expressed concern that the infrastructure supporting online transactions in nontraditional marketplaces lacks a similar consumer protection regime required of traditional markets.

The report’s findings

The CFPB’s report analyzed the financial services aspects of the gaming marketplace, including using virtual currencies in games and virtual worlds. The bureau’s three key findings – and the risks facing consumers in gaming marketplaces – are listed below.

1. Gaming products and services resemble conventional financial products but often lack the same protections.

Online ecosystems, including games and virtual worlds, enable players to store and transfer assets (e.g., in-game currencies and virtual items). The bureau considers these online ecosystems and their financial products increasingly indistinguishable from real-world marketplaces. As evidenced by newly embedded financial offerings in the gaming industry, companies provide services and products that resemble traditional financial instruments such as loans and proprietary payment systems to facilitate online financial activity.

2. Gaming companies provide little customer support when consumers experience financial harm.

As the value of in-game assets increases, a parallel rise in scams, phishing attempts and account thefts has followed. The CFPB says it has received numerous consumer complaints about hacking attempts, theft and unauthorized forfeiture of gaming assets. Consumers contend they have little recourse with gaming companies when they suffer losses, and game publishers assert no duty to compensate players for financial losses, including when service to a game is suspended or when players request unused virtual content or points after their account is closed.

3. Gaming companies are collecting and using large amounts of players’ personal information, including sensitive personal information, in ways that trigger privacy and consumer protection concerns.

Publishers handle large amounts of data on players, including sensitive personal information such as health data (e.g., heart rate or symptoms that suggest medical conditions), biometric data (e.g., iris scans, gait or movement patterns), geolocation data and behavioral data (e.g., purchasing history and responses to personalized incentives). Publishers may correlate this personal data with information obtained from social media. Players’ personal information may be used for profiling, misleading them about the availability of in-game goods, price discrimination, and highly targeted advertising or offerings. The CFPB is evaluating publishers’ compliance with privacy regulations, and whether consumers are appropriately aware of how their personal information is collected and used across the industry.

Looking forward

The bureau recognizes that the role of banks and consumer finance products within gaming is evolving, and the current trend indicates that traditional financial services will continue to be introduced on gaming platforms. Accordingly, the CFPB indicates it is monitoring this nontraditional market where financial products and services may not comply with the criterion set by existing consumer protection laws applicable to traditional banking and payment systems. Businesses in the virtual world providing financial services that potentially harm consumers’ finances and privacy may be subject to CFPB jurisdiction.

Additionally, given that embedded financial services activities within games are becoming analogous to traditional regulated payment services, such activities also may be subject to state and federal regulatory oversight and, in some cases, licensing or registration. For example, such activities could trigger obligations under state and federal money transmission and virtual currency laws and “loss recovery” statutes (as, in particular, exemptions from such laws for “in-game” virtual currencies are narrow and generally do not permit cash-out functionality or cross-game exchanges), as well as coverage under the federal Electronic Fund Transfer Act and its implementing Regulation E. Gaming companies and other industry participants should review relevant regulations to determine which laws apply. The bureau also asserts that emerging trends in the gaming market will be of interest to policymakers and other government agencies, such as the Federal Trade Commission, to ensure consumers are adequately protected.

Cooley associate Demisse Selassie also contributed to this alert.