Video Gaming Update
Total Page:16
File Type:pdf, Size:1020Kb
June 2020 Also in this issue: Main Quest Does My Video Game Violate 3 Strategy Guide Consumers’ Privacy Rights? 3 Side Quests The California Consumer Privacy Act (CCPA) is the first broad-based state statute aimed Recent holdings at enhancing personal privacy rights for consumers. Following the example set by the in video game and European Union’s General Data Protection Regulation (GDPR), the CCPA expands the rights related lawsuits of California residents to know about the collection, sale and sharing of their personal data, and enables them to object to the retention or sale of such data. Although the CCPA 5 Patch Notes was enacted on June 28, 2018, it only took effect on January 1, 2020, and enforcement by Updates on litigation, the state’s attorney general began on July 1, 2020. Although the statute applies only to regulation and California residents, the law is not limited to California companies; rather, any company legislation impacting that does business in California may fall under its scope. Accordingly, companies that may the industry be impacted by the CCPA — which includes many companies in the video game industry — are well advised to understand the requirements of the CCPA and evaluate their internal 7 Contacts procedures to ensure compliance. Relevant Provisions of the CCPAI The CCPA applies to any business that (a) collects consumers’ personal data, (b) does busi- ness in California (even if situated outside the state), and (c) satisfies one of the following conditions: (i) has annual gross revenues exceeding $25 million; (ii) buys, receives or sells personal information of 50,000 or more consumers or households; or (iii) earns more than half of its annual revenue from selling consumers’ personal information. The CCPA allows California residents to request that businesses meeting these criteria identify the “personal information” that those businesses collect, as well as to demand that those businesses delete and/or not sell such personal information. “Personal information” is defined very broadly in the statute to include not only traditional forms of personal information (e.g., names, email and physical addresses, etc.) but also a broader set of data, including IP addresses, browsing histories, geolocation data, physical data, professional or employment-related data, education information and even biometric data, provided that such data can be used to identify an individual, household or particular device. Moreover, the CCPA’s definition of “personal information” encompasses inferences that can be drawn from any other information collected by the businesses (such as brand preferences, viewing habits, etc.) and used to create profiles about a consumer’s behavior, trends, characteristics, preferences and more. Follow us for more thought leadership: / skadden.com © Skadden, Arps, Slate, Meagher & Flom LLP. All rights reserved. June 2020 The CCPA also requires businesses to (a) provide notice of or older can play; doing so restricts the player base to some data sharing/sale opt-out rights to consumers, and (b) obtain degree, but the company is able to collect the same data from affirmative consent to the sale of information from users under all players, without concern of violating COPPA. However, this 16 years of age (and consent from a parent/guardian for users same strategy of age-gating may not be feasible with respect under 13). In other words, while the default scheme is implied to players 13-16, as such players may (depending on the game) consent with users affirmatively opting out of data sharing, represent a large percentage of the player base. While compa- for users under 16 the default is that sale and sharing are not nies may be able to avoid the need to age-gate by segregating permitted unless the user (or his or her parent/guardian, if the the data collected from users ages 13 to 16 — thus ensuring user is under 13) opts in. that such data is not mistakenly sold without consent — these additional steps may not be feasible or cost-effective. In the event a company fails to comply with these requirements, the CCPA provides for both government enforcement as well Second, the CCPA’s broad definition of “personal information” as a limited private right of action in the case of data breaches. implicates certain activities that video game companies might The California attorney general may seek civil penalties of up not typically associate with the collection of personal data, to $2,500 for each CCPA violation (measured by each instance particularly in the esports and streaming contexts. For example, of any specific provision or requirement being violated), or biometric information about a game’s player, such as keystroke up to $7,500 for intentional violations.1 Additionally, California patterns, recognition and click speeds, and logon/logoff times, consumers may bring a private right of action for data breaches could all fall under the CCPA definition of “personal informa- involving nonencrypted and nonredacted personal information, tion” if they can be uniquely identifiable. Esports companies where the company failed to implement reasonable security may be interested in collecting and storing such data for procedures. Under such private actions, impacted consumers purposes completely separate from their typical data collection may seek either their actual damages or statutory damages of practices — for example, as a means to identify and root out between $100 and $750, whichever is greater. Thus, because cheating. Similarly, streaming services may be interested in of the availability of statutory damages, consumers who have collecting information about a user’s preferred channels or been impacted by a data breach may recover from noncompliant time spent watching a particular stream to better tailor their companies even without a showing of harm. service to the user. Indeed, even a company hosting an esports tournament or gaming event may inadvertently collect personal CCPA’s Impact on the Video Game Industry data by recording who is watching the event, or who is inter- Beyond the general impact of the CCPA — requiring all compa- acting with the company’s social media posts regarding the nies to ensure that their data collection, retention and sale/ event. While the mere collection of this information does not sharing policies meet the CCPA’s requirements — companies in itself violate the CCPA, the fact that a company is collecting, involved in the video game industry are likely to experience storing and potentially sharing this information would require more specific consequences in at least three ways. that company to comply with the CCPA and be aware that such information is subject to the CCPA’s regulations. First, the CCPA’s requirement of obtaining affirmative consent for the sale of data from any user under 16 will likely have a Finally, the effects of the CCPA may be particularly acute for disproportionate impact on the video game industry, given companies in the mobile and free-to-play gaming space, which the popularity of video games with younger audiences. And often rely heavily on consumers’ data as a source of revenue. while many companies already take steps to limit their data It is worth remembering that the CCPA is specifically directed collection practices for users under 13 (as required under to any company that earns more than half its annual revenue the Children’s Online Privacy Protection Act, or COPPA), the from selling customers’ personal data, or collects information strategies employed to do so may not be feasible or desirable from more than 50,000 consumers or household. Thus, a free- for users in the 13-16 age bracket. For example, an online game to-play or mobile game developer that supports itself with ad may age-gate its service so only users who are 13 years of age revenue tied to consumer data may need to be CCPA-compliant even if its annual revenue is relatively low. 1 It should be noted that the CCPA provides a 30-day cure period before the attorney general may seek such fines against a company. 2 Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates June 2020 Strategy Guide There are a number of best practices video game companies can employ in order to minimize the risks associated with the CCPA: - It is vital that companies review their data collection, • While ensuring compliance will likely require some upfront retention and selling practices, and ensure they are in investment, such expenditures are likely far less than compliance with the CCPA, most notably by including the penalties a company could incur for noncompliance, an appropriate “opt-out” option for all users over 16 particularly given the CCPA’s statutory damages provision. years of age and obtaining affirmative consent to sell - Companies should examine the types of data they collect data from users under 16 (or their parent/guardian, and ensure that they are collecting only what is necessary. where appropriate). For example, while it may seem beneficial to ask for a • In connection with this review, companies should insti- user’s phone number as part of a registration process, if tute compliance programs so they are able to respond the company has no plans to use that information, it may to claims of CCPA violations within the statutory time consider forgoing the collection and storage of such data. period and thereby avoid liability. - Where feasible, companies should take steps to anonymize • Additionally, companies should review and update and de-identify any information collected and stored in the their privacy policies as necessary to comply with aggregate. The CCPA covers only personal information that the CCPA requirements. can be linked with an individual; anonymous data does not pose any risks from a CCPA perspective. Side Quests Recent judicial decisions and enacted statutes or regulations that are likely to impact the video game industry Ubisoft Entertainment SA v.