Video games, consoles and gaming accessories

• Regulation (EU) 2016/679 — GDPR, Article 27
• Directive 2014/53/EU — Radio Equipment for hardware
• Regulation (EU) 2022/2065 — DSA where user content or matchmaking chat is hosted
• Directive 2005/29/EC — unfair commercial practices for in-game purchases
• Regulation (EU) 2024/2847 — CRA

Who has to appoint one

Studios and publishers outside the Union whose games are available to EU players, and manufacturers of consoles, controllers and headsets. Online play, accounts, telemetry and advertising all process personal data of EU users; hardware placed on the market triggers the product regime separately.

Thresholds and exemptions

No threshold. Free-to-play titles are fully in scope, since monetisation through advertising and in-game purchases is processing and commercial practice, not an exemption.

What must appear on the label

For hardware: CE marking, manufacturer and EU representative details, model and serial number, radio parameters, WEEE symbol. For the game: the representative's identity in the privacy policy, clear disclosure of in-game purchase mechanics and of the real-money cost of virtual currency before purchase.

Marketplace fields

Console platforms enforce their own certification, and app stores require accurate data-safety declarations. Consumer authorities have acted across the Union on virtual currency pricing, dark patterns and the presentation of loot boxes, and the CPC network has published common positions on in-game purchases.

Documentation you must hold

Article 30 records covering accounts, telemetry, matchmaking, chat and advertising SDKs. The Article 27 designation. Age assurance and parental consent flows where children play. Data protection impact assessment for profiling and behavioural advertising. For hardware, the declaration of conformity and test reports. For hosted user content, the DSA notice-and-action mechanism and the Article 13 representative.

Standards and testing

Not applicable to the game, though consent and age flows are examined in practice. Hardware follows the radio, safety and EMC test regime.

Language requirements

Privacy information, purchase terms and refund rights in the language of the markets targeted.

When it applies

The representative before EU players' data is processed, which is at launch in EU storefronts. DSA obligations since February 2024 for services hosting user content. CRA obligations for connected hardware from 2026 and 2027.

How long records are kept

Processing records for the life of the service. Children's data requires stricter minimisation, and indefinite retention of behavioural profiles is an infringement.

What happens if you do not comply

Up to €20 million or 4% of turnover for unlawful processing, particularly where minors are profiled for advertising, which the DSA prohibits on platforms. Consumer law penalties up to 4% of turnover for widespread infringements concerning in-game purchases. Hardware faces the usual withdrawal and customs exposure.

Who enforces it

Data protection authorities, consumer protection authorities through the CPC network, Digital Services Coordinators, and market surveillance for hardware.

Where the boundary lies

Games are simultaneously a data operation, a consumer commerce operation and, where hardware is sold, a product operation. The area attracting most enforcement is not privacy but purchase design: currency bundles that cannot be spent exactly, countdown pressure and unclear odds are treated as unfair commercial practices.

Questions we are asked

Do we need a representative for a free game?

Yes. Free-to-play still processes accounts, telemetry and advertising identifiers of EU players, which is processing under Article 3(2).

Are loot boxes illegal in the EU?

They are not banned EU-wide, but several member states treat some designs as gambling, and consumer authorities require odds disclosure and prohibit pressure tactics. Belgium and the Netherlands have acted most aggressively.