Dr Simon Hembt is counsel at Bird & Bird in Frankfurt, Germany. He advises games companies on IP, AI/tech, and media regulation. He co-edited Bird & Bird’sGame Plan 2026report.
Imagine a free-to-play shooter with pay-to-win in-game monetization (aka “golden bullets”), various in-game items (such as skins), voice chat, a user-generated-content (UGC) hub, and an AI companion. All relatively common features, but they represent a regulatory puzzle, since each one might be subject to a different law at national and European Union level.
The EU AI Act’s rules on “deepfakes” and the representation of real-world locations and people in games have applied since August 2, and the first reporting obligations under the Cyber Resilience Act followed on September 11 – but there is more still to come, with the European Commission announcing a further two landmark projects.
The EU KIDS Act has proposed rules on online safety that could affect daily log-in bonuses among many other things, while the first draft of the Digital Fairness Act (DFA) is likely to contain several different rules that affect in-game worlds. In addition, the EU Consumer Protection Cooperation Network (CPC) has started a series of enforcement actions based on its key principles.
Bird & Bird’s international video games team has mapped the legal trends shaping games, and this article highlights six risks that studios need to be aware of, and what they can do to stay ahead.
The CPC has in-game shops in its sights
In March 2025, the CPC acted against Swedish studio Star Stable Entertainment, whose game Star Stable is popular with children. The CPC alleged that the game uses, among other things, incentives for kids to buy items, unclear currency pricing, and undisclosed influencer marketing.
The same month, the CPC published its Key Principles on In-Game Virtual Currencies. The basic idea is that consumer law covers every purchase made with a virtual currency bought with real money.
These seven key principles cover:
- Clear and transparent pricing by showing the real-world money price (for example, in euros).
- No cost-obscuring practices (for example, multiple currency layers).
- No forced surplus purchases (for example, players should not be urged to spend extra money through odd pricing of bundles).
- Clear pre-contractual information.
- The right of withdrawal to cancel purchases and get refunds for unused virtual currencies.
- Fair and understandable terms in plain language.
- The protection of vulnerable groups.
Since the end of September, the EU and national authorities have conducted coordinated actions to enforce these principles.
The EU AI Act now enforces transparency
After the backlash over AI outputs identified by players, the issue has become rather sensitive, but studios now have a legal obligation around making AI use clear in some cases.
Providing a generative AI system, such as a text-to-image model, triggers an obligation by the provider to mark its output in a machine-readable way and make it detectable as artificially generated or manipulated (Article 50(2) of the EU AI Act). A studio offering players its own AI tool for creating UGC would usually be considered as the provider. This obligation began in August, although the grace period for systems already on the market runs until December 2, 2026.
Deepfakes created with third-party AI tools (which can cover representations of real-world locations, people, or events) might also need labelling in some cases. However, certain exceptions could see the obligation waived, or, in an evidently creative work, a notice in the credits might suffice.
Article 50(1) of the AI Act requires providers of interactive AI systems to make sure players know they are dealing with AI, unless that is obvious. These systems could include conversational bots supercharged with AI, and the “obvious” exception may cause particular headaches in games played by children, since in the Commission’s view the use of AI might not be as obvious to children as it is to adults.
Before launch, video game providers should list every AI feature in each title and work out its potential regulation.
The Digital Services Act has tightened the rules for UGC
A video games provider that stores UGC such as pictures, texts, or designs on its servers will be deemed a hosting service under the Digital Services Act (DSA), and making this UGC publicly available to all players is likely to make the provider an online platform.
The DSA provides for a tiered regime with new obligations for each tier (for example, intermediary, hosting service, online platform, and very large online platform). In August, the Commission designated Roblox as a very large online platform, the category with the strictest duties.
The DSA does not make video game providers check every upload. Providers are generally not liable for illegal uploads they are not aware of, as long as they act quickly once they are. Players also need an easy way to report in-game content, and anyone whose UGC the provider removes or restricts must get a statement of reasons. AI creation tools raise the stakes, because players can now produce infringing or harmful content at scale. A report button alone might no longer be enough.
For many online platform games, however, Article 28 of the DSA is key. Online platforms that minors can access have to take appropriate and proportionate measures to ensure a high level of privacy, safety, and security for them: An “18+ clause” buried in the terms and conditions will not take the provider out of scope. The Commission’s guidelines from July 2025 show what it expects. They are not binding, but enforcement bodies measure compliance against them.
Your in-game economy could fall foul of gambling regulations
For some in-game monetization models, a thorough review of potential gambling (or skill game) regulations is a crucial step in a video game provider’s governance process.
There is no harmonised EU gambling law, so each EU jurisdiction has its own rules for loot boxes and other “staking-like” in-game options.
Since 2018, Belgium has treated (paid) loot boxes as gambling. Courts in the Netherlands and Austria have declined to treat football player packs as gambling, because they looked at the game as a whole. German gambling law assesses each feature on its own, so the predominance of chance over skill and a stake and prize that are worth money are decisive. Whether players can transfer items or cash them out often decides the outcome.
In a non-binding resolution, the European Parliament has called for a ban on loot boxes in games likely to be accessible to minors, and since June, PEGI rates new games with paid random items at 16 by default. German youth protection law has factored interaction risks such as gambling-like mechanisms into its age ratings since 2023. The Court of Justice is also considering whether app stores can be liable for offering games with illegal loot boxes.
Before embedding loot boxes or similar features, video game providers should check the gambling laws in their target markets.
The Digital Fairness Act will shake-up digital stores
The European Commission plans to publish the first draft of the DFA on November 11, and part of the aim is to turn the CPC’s concerns into binding law.
Many of the big topics covered in the DFA could apply to video games. The Act is likely to tackle dark patterns in more depth, from fake scarcity to pressure timers. Rules on addictive design might address features built to maximise the time and money consumers spend, including daily streaks, variable rewards, and push notifications. Loot boxes, pay-to-win mechanics, and virtual currencies might also be covered, in particular where they target children, and showing real-money prices for in-game items is likely to be regulated. The DFA is also likely to address personalisation that exploits vulnerabilities, influencer marketing, and cancellation options. An overarching topic is the protection of minors.
The DFA is unlikely to apply before 2028, but studios should closely monitor the legislative process.
On the horizon: the KIDS Act
The European Commission proposed the KIDS Act on September 17. This new Act would cover any video game that players can access, download or buy online. By default, the KIDS Act would require games to be child-safe until age assurance shows a player is an adult. A self-declared age would not meet this requirement.
The KIDS Act asks for mandatory parental tools, and children under 13 could only play through these tools. Video games would need to ensure that nobody can use them to lure children onto risky services elsewhere. UGC platforms would also need tools that let player-made games comply.
It seems unlikely that the KIDS Act will apply before 2028. However, many aspects of it are already featured in the Commission’s guidelines under Article 28 of the DSA, so parental tools and child-safe defaults are worth considering now.
Where to start?
The current pace of regulation at both the EU and national level is high, and many video games providers complain that this “headache list” is getting longer. Bird & Bird’s Game Plan 2026 report sets out key questions and next steps for many of these risks. Ultimately, the earlier that video game providers build these rules into their designs, the fewer costs they will face later down the line.
