On April 4, 2024, the Consumer Financial Protection Bureau (CFPB) issued a new report, titled “Banking in Video Games and Virtual Worlds” (Report), that examines the growth of financial transactions in online video games and virtual worlds. The CFPB has previously signaled the expansion of its monitoring capabilities to new markets, and this Report continues that expansion to the gaming industry. 

According to the Report, the CFPB is monitoring non-traditional markets where financial products and services may be offered, including the use of virtual currencies in games and virtual worlds in response to “concerning issues regarding gaming markets,” such as financial losses (due to theft, scams, and other criminal activity), fraud and money laundering, and the collection and use of consumer data by gaming companies. The Report also notes that there may be increased risks to consumers, specifically children, within the gaming industry. Gaming companies can use the insights from the Report to review their own policies and procedures to ensure compliance with federal consumer financial protection laws.

This update summarizes the Report’s key findings, describes the risks and trends identified by the CFPB, which are likely to inform the CFPB’s market monitoring activities, and provides key takeaways for companies doing business in this space to consider going forward.

Key Findings

Evolution of the Gaming Industry. The Report comes as the gaming industry experiences rapid evolution, particularly into non-traditional financial markets. According to the Report, the gaming industry has transformed as gaming companies no longer largely rely on one-time purchases, but can also be profitable engaging in multiple smaller purchases with a player during the player’s engagement with a game.  Further, the CFPB notes the emergence of gaming companies as “one-stop shop[s]” where the distribution, playing, and storing of games and their assets are all integrated into one.

It is estimated that the gaming industry was worth $249.55 billion in 2022, with American consumers contributing to $56.6 billion of this revenue. The value of the gaming industry is expected to reach $321.1 billion by 2026, with AR/VR/MR growing as major technology companies have entered the gaming industry, according to the CFPB. The Report notes that 76% of children in the United States play video games, making them “vulnerable to tactics used by gaming companies to induce spending and monetize gaming, as their financial habits are still forming.”

The CFPB is not the first agency to turn its attention to financial transactions in online video games and virtual worlds. In 2019, the Federal Trade Commission (FTC) raised concerns about loot boxes (i.e., seemingly randomized packages of game assets where the player only knows the contents after paying and opening the package), focusing on the effectiveness of disclosures prior to purchase, the design of loot boxes promoting compulsive spending, and potential risks to young players. For now, efforts to address these issues have mostly involved industry-wide self-regulation, rather than specific policy interventions; however, the FTC notes that it will continue to monitor developments surrounding loot boxes and take appropriate steps to prevent unfair or deceptive practices.

Collection of Player Data and Its Financial and Privacy Implications. The CFPB notes that gaming companies are collecting a “great deal” of data on their players through spending history, in-game interactions, and biometric data (including data from AR/VR/MR headsets). The CFPB recognizes this data can be beneficial to consumers’ in-game experience but warns of potential harms this data can have, such as the use of consumer data to create demand for in-game items and pricing methods that personally target consumers, as well as to target ads to specific audiences and to make targeted ads more effective.

The CFPB also raises the question of whether privacy regulations are being properly adhered to and whether consumers are fully protected. The CFPB notes that gaming companies can collect a host of “surveillance data” about their users, including location data, social media data, and behavioral interactions (e.g., posture, eye gaze, gestures, facial expressions, voice, heart rate, and interpersonal distance). The CFPB warns that, without the right privacy protections, collected data may be used to inform predictive models (including those marketed as artificial intelligence); additionally, there is a risk that players may be harmed when their data is sold, bought, and traded between companies.

The Report echoes similar statements the CFPB has made regarding the collection of data in other contexts. For instance, the CFPB has also raised questions about surveillance and the monetization of customer transaction data with respect to certain Big Tech companies, and accordingly, has taken actions that range from ordering these companies to provide the CFPB with information about their products, plans, and practices, to issuing proposed rules that would subject these companies to the CFPB’s supervisory authority. The collection and use of consumer data, including the accompanying privacy issues, clearly continue to be a major area of interest for the CFPB.

Value of Gaming Assets. According to the Report, gaming companies are replicating everyday activities and transactions and creating value in gaming assets in the following ways:

• Cash-Out of Gaming Assets for Real-World Value.  Gaming assets, such as in-game currency or virtual items, can be “token[s] of status” or have “considerable value” outside of their games. The CFPB contributes this to some games allowing for a “two-way flow,” where: (1) fiat currency can enter the game and be transformed and used as a gaming asset; and (2) gaming assets can be transferred out of the game (cashed-out) into fiat currency or other real-world value through the platforms of gaming companies or the use of third-party markets. One gaming asset in the form of a “skin” resulted in a $500,000 cash-out in 2023, the CFPB notes. 
• Use of Crypto as Gaming Assets. According to the CFPB, some virtual worlds and games use crypto-assets, such as non-fungible tokens (NFTs), as gaming assets. For virtual worlds and games with a native crypto-asset, consumers are provided with more ways to cash-out as they can transform their assets into fiat currency through crypto-asset trading platforms.
• Peer-to-Peer Transactions. The CFPB notes that gaming assets can be exchanged, transferred, and gifted between consumers, allowing for the creation of peer-to-peer (P2P) markets, with gaming companies “appear[ing] to function like payment systems by facilitating the storage and exchange of valuable assets.”

In connection with the value of gaming assets, the CFPB also raises a concern with in-game currency conversions, pointing out that some gaming companies appear to be hiding the value of items consumers are buying through bundles that seem like a “better deal.” The CFPB further explained that fiat currency to in-game currency exchange ratios are often complex and that deposits and withdrawals can be burdensome, leading to confusion by consumers.

Risks and Trends

According to the Report, the CFPB is monitoring how gaming assets are used and the associated risks, including those impacting children and the emergence of products or services that resemble traditional consumer financial products and services. Below, we highlight the key risks and trends that the CFPB identifies, as these are areas in which the CFPB may focus any future market monitoring activities.

• Accounts May Be Vulnerable to Losses. The CFPB notes that gaming accounts often lack the security and protections of traditional bank accounts and that some of the most common scams include defrauding a player of the assets stored on their account, as well as hacking into their account and transferring in-game currency to another account. The CFPB also notes that the monetary value of player accounts combined with the ability to cash-out gaming assets has led to an influx of phishing attempts and reports of account theft.
• Lack of Recourse When Assets Are Lost. The CFPB reports that players subject to hacking attempts, account theft, scams, unauthorized transactions, and loss of access to game currencies and virtual items have received limited recourse from gaming companies. For instance, according to the CFPB, consumers have complained that some gaming companies will terminate the accounts of players for pursuing recourse from their financial institution for unauthorized game purchases. The CFPB also reports that when a player loses access to their account because they are accused of violating a game’s terms of service or a game is terminated altogether, the game publishers state that they have no obligation to compensate the players for their lost assets or return the money players have invested.
• Fraud in Gaming Markets. According to the CFPB, the ability to transfer and otherwise convert gaming assets to fiat currency or crypto-assets has led to a proliferation of money laundering and fraud on gaming platforms.
• Issues with Third-Party Systems. The CFPB notes that the terms and conditions of third-party websites (i.e., those that facilitate the buying, selling, and trading of in-game currency, virtual items, and entire player accounts), can be misleading or otherwise obscure the truth about the risks involved in their services. The CFPB warns that these systems potentially expose players to risks like credit card fraud, malware, and identity theft.
• Gaming Specific Financial Products. The CFPB observes that the role of banks and consumer finance products within gaming is evolving, but there appears to be a trend toward introducing services that are similar to traditional consumer financial products that rely on the value of gaming assets and the digital transactions that are happening on gaming platforms.

As the Report states, the CFPB “expects that emerging trends in the gaming market, as detailed in this [Report], will be of interest to policymakers and other government agencies with responsibilities related to the issues uncovered.” Companies should pay particular attention to these areas, which are likely to face increasing attention from the CFPB, to ensure they remain in compliance with federal consumer financial protection laws.

Key Takeaways

The CFPB’s statement that it will be monitoring markets relating to video games and virtual worlds makes clear that the CFPB will focus increasing attention on companies doing business in this space. Accordingly, it is important to keep in mind that in conducting any market monitoring, the CFPB has the authority to gather information regarding the organization, business conduct, markets, and activities of certain companies (i.e., those that engage in offering or providing a consumer financial product or service) and that the CFPB may require these companies to file annual or special reports as well as answers in writing to specific questions. For instance, the CFPB recently ordered large technology companies operating payment systems to turn over information regarding their business practices so that the CFPB could better understand how these companies use personal payment data and manage data access to users. With the CFPB’s statement that it will be monitoring markets relating to video games and virtual worlds, similar orders could be forthcoming.

Additionally, the CFPB is making clear that the accumulation of data collected from consumers by gaming companies raises questions as to whether privacy rules are being adhered to and whether consumers are fully aware of how their data is being collected and used across the industry. The CFPB notes that it will continue to work with other agencies to monitor companies that assemble and sell sensitive consumer data, such as a consumer’s payment history.

[View source.]