We are subject to certain privacy and data protection laws and industry terms and codes of conduct, the requirements of which are rapidly changing and likely will continue to do so for the foreseeable future. This may add complexity to our compliance efforts and could have a negative impact on or materially change our approach to the sale and marketing of our products. For example, the E.U. General Data Protection Regulation ("GDPR") and the U.K. Data Protection Act 2018 ("DPA 2018") both became effective in May 2018. GDPR and DPA 2018 apply to us because we target our services to and/or receive and process the personal information of individuals in the E.U. and the U.K., and we maintain certain local entities in the E.U. and the U.K. responsible for processing personal information. GDPR and DPA 2018 contain significant penalties for non- compliance, which have been imposed by regulators. In addition, E.U. member states continue to enact national laws to implement the GDPR. Also, the E.U. Digital Services Act (“DSA”) became fully applicable on February 17, 2024. The DSA imposes new content moderation obligations, notice and transparency obligations, advertising restrictions and other requirements on digital platforms to protect consumers and their rights online. Noncompliance with the DSA could result in fines of up to 6% of annual global revenues, which are in addition to the ability of civil society organizations and non-governmental organizations to lodge class action lawsuits. In the U.S., approximately 20 states have enacted comprehensive privacy laws and several other states have enacted more narrow privacy laws. These apply to processing of personal information of those state residents and may impact how we can collect and use that information, especially for players under 18 years of age. Other U.S. states are considering similar privacy or data protection laws that may apply to us. Certain U.S. states are also considering a number of other additional laws related to use of artificial intelligence or “automated decision making,” and advertising, such as requiring mandatory device settings for users to opt-out of advertising. Failure to comply with privacy and data protection laws may increase our costs, subject us to expensive and distracting government investigations, and result in substantial fines, or result in lawsuits and claims against us to the extent these laws include a private right of action.
Moreover, a number of jurisdictions impose specific and more onerous requirements regarding the collection and use of child and teen data. For instance, the U.S. Children's Online Privacy Protection Act regulates the collection, use, and disclosure of personal information from children under 13 years of age, and age-based privacy laws can apply to how we collect and use personal information or provide certain game features to players up to 18 years of age, including how or whether we are permitted to use their information for targeted advertising. The U.K. implemented an Age Appropriate Design Code, which became effective in September 2021, that sets forth risk-based standards to be implemented by organizations that provide online services (e.g., online games) likely to be accessed by children in the U.K. under the age of 18, as part of such organization’s efforts to comply with applicable data protection laws. A number of U.S. states have enacted or are considering legislation similar to the U.K. Age Appropriate Design Code and several have also enacted or are considering legislation that prohibits targeted advertising to child and teen players under the age of 16 or 18 without express consent. For instance, the California Age-Appropriate Design Code Act took effect in July 2024; however, as of March 2025, the California Attorney General has been enjoined from enforcing the act on First Amendment grounds. We cannot predict how this or other age-based obligations imposed on providers of online services may affect our compliance efforts going forward, and whether they will result in industry-wide changes to online services available to child and teen players.
The U.S. government, including the FTC and the Department of Commerce, also continue to review the need for greater or different regulation over the collection of personal information and information about consumer behavior on the Internet and on mobile devices, and the U.S. Congress is considering a number of legislative proposals to regulate in this area, including a draft Federal comprehensive privacy law, updates to existing children's privacy laws that may expand the scope of coverage, and online safety laws that may require additional content moderation or changes to features in our games to minimize harm to children. Various government and consumer agencies worldwide have also called for new regulation and changes in industry practices. We cannot predict whether such proposals may be enacted into law, in what form or when. Any such new or amended privacy laws may add complexity to our compliance efforts and require us to expend additional financial or other resources as a result.
Privacy-based litigation and similar legal challenges likely will continue to affect our industry and the internet-enabled ecosystem. Existing laws that include private rights of action may continue to be leveraged by private litigants even if those legal challenges do not align with more recent privacy laws. These risks may also be increased when the law includes statutory damages instead of an evaluation of the actual harm presented by the activity in question. The ongoing, or subsequent resolution of, legal challenges affecting organizations using internet-enabled data collection and use may affect how we engage with our players and operate our business.
Further, and most notably in the mobile ecosystem, companies that provide the platforms on which our games are played are changing the terms on which publishers can collect and use personal data obtained from users on those platforms.
Player use of our games is subject to our privacy policy and terms of service ("TOS"). If we fail to comply with our posted privacy policy, TOS, or other consents received in our game experience, or if we fail to comply with existing privacy or data protection laws and regulations, it could result in proceedings or litigation against us by governmental authorities or others, which could result in fines or judgments against us, damage our reputation, affect our financial condition, and harm our business. If regulators, the media, or consumers raise any concerns about our privacy and data protection or consumer protection practices, even if unfounded, this could also result in fines or judgments against us, damage our reputation, negatively affect our financial condition, and damage our business.
It is possible that a number of laws and regulations may be adopted or construed to apply to us in the U.S. and elsewhere that could restrict the interactive entertainment industry, including player privacy, advertising, taxation, content suitability, and moderation, online safety, copyright, distribution, and antitrust. Furthermore, the growth and development of electronic commerce and virtual goods may prompt calls for more stringent consumer protection laws that may impose additional burdens on companies such as ours conducting business through digital sales. Any such changes would require us to devote legal and other resources to address such regulation. For example, existing laws or new laws regarding the regulation of currency, banking institutions, and unclaimed property may be interpreted to cover virtual currency or virtual goods. If that were to occur, we may be required to seek licenses, authorizations, or approvals from relevant regulators, the granting of which may be dependent on us meeting certain capital and other requirements and we may be subject to additional regulation and oversight, all of which could significantly increase our operating costs. Changes in current laws or regulations or the imposition of new laws and regulations in the U.S. or elsewhere regarding these activities may lessen the growth of the interactive entertainment industry and impair our business, financial condition, and operating results. Similarly, new regulatory developments internationally aimed at better protecting consumers online from illegal or harmful content and interactions may introduce additional compliance and reporting obligations for our business which may increase operating costs. If we were to fail to comply with such new regulations, it could result in proceedings or litigation against us by governmental authorities or regulators, which could result in substantial fines or judgments against us, damage our reputation, affect our financial condition, and harm our business.
Although we have structured and operate our skill tournaments and game mechanics, including random digital item mechanics, with applicable laws in mind, including any applicable laws relating to gambling, and believe that playing these games does not constitute gambling, our skill tournaments or game mechanics could become subject to gambling-related rules and regulations, or be deemed violative of current rules and regulations, and expose us to civil and criminal penalties. We also sometimes offer consumers of our online and casual games various types of contests and promotional opportunities. We are subject to laws in a number of jurisdictions concerning the operation and offering of such activities and games, many of which are still evolving and could be interpreted in ways that could harm our business. Further, random digital item mechanics may become subject to further regulations in various jurisdictions. If this were to occur, we might be required to alter some of our games to address these additional requirements or seek licenses, authorizations, or approvals from relevant regulators, the granting of which may be dependent on us meeting certain capital and other requirements, and we may be subject to additional regulation and oversight, such as reporting to regulators, all of which could significantly increase our operating costs. Moreover, the inclusion of random digital item mechanics has attracted the attention of the interactive gaming community, and if the future implementation of these features creates a negative perception of gameplay fairness or other negative perceptions, our reputation and brand could be harmed and revenue could be negatively impacted. Changes in current laws or regulations or the imposition of new laws and regulations in the U.S., the E.U., or elsewhere regarding these activities may lessen the growth of online or casual game services and impair our business. Also, existing laws or new laws regarding the marketing of in-game or in-app purchases, regulation of currency, banking institutions, unclaimed property, or money laundering may be interpreted to cover virtual currency or goods.