Key compliance points for game companies entering US market

The US, as the largest and one of the most competitive markets globally, is a primary destination for many game companies expanding internationally. However, Chinese companies face significant challenges due to the vast differences in cultural backgrounds, political systems and legal environments. This article outlines three key compliance points for game companies entering the US market.

Loot box compliance

The loot box is a lucrative model for game companies. Although the US has not enacted explicit laws banning loot boxes, various states have attempted legislation but none have passed effective laws to date. As a result, loot boxes are popular among US gamers, generating substantial profits for game companies.

While there are no prohibitive laws, major app platforms impose restrictions on loot boxes. For instance, clause 3.1 of Apple’s App Store Review Guidelines requires apps offering loot boxes or other mechanisms for purchasing random virtual items to disclose the odds of obtaining each type of item before game players purchase. Game developers providing games through the Apple App Store must comply with these disclosure regulations.

Even though there are no federal laws against loot boxes in the US, the growing global scrutiny and proposed restrictions on such mechanisms mean that game companies pay close attention to loot box compliance when promoting and distributing their games in the US.

Game rating compliance

In the early 1990s, the public outcry over graphic violence in Mortal Kombat II led to the establishment of a game rating system in the US. Today, the Entertainment Software Rating Board (ESRB) rating system is widely implemented.

The ESRB is an industry self-regulatory organisation that rates video games and other entertainment software in North America, classifying them into seven categories: E (Everyone); E10+ (Everyone 10+); T (Teen 13+); M (Mature 17+); AO (Adults Only 18+); and RP (Rating Pending).

These ratings apply not only to game content but also to promotional material. Although the ESRB rating system is voluntary, nearly all games in Canada and the US undergo rating. Without it, companies may face distribution challenges.

Personal information protection

Beyond game content compliance, personal information protection is a global concern. Game companies entering the US market must be aware of US personal information protection laws, particularly the California Consumer Privacy Act (CCPA), the first comprehensive privacy law in the US. It grants California consumers comprehensive protection of privacy rights.

Although the CCPA is a state law, it is impractical for game companies to avoid providing services in California. The population of California exceeds 40 million, and the state is the most economically developed in the US and a hub for internet and technology innovation. Consequently, game companies expanding to the US will likely be subject to CCPA regulations.

The CCPA requires companies to implement several rights, including:

Right to know. Players can request that game companies disclose the categories and specific elements of personal information collected, the sources and purposes of collection, the purposes of information sale, and the categories and identities of third parties with whom information is shared.

Right to delete. Players can request the deletion of their personal information.

Right to refuse. Players can refuse the sale of their personal information and are protected from discrimination for exercising this right, such as differences in pricing or service quality, unless justified by the value of players’ game data.

Right to opt in. Game companies may sell the personal information of players under the age of 16 only with explicit authorisation. For players aged 13 to 16, consent must be obtained from the players themselves. For players under 13, explicit consent must be obtained from their parents or guardians. Any intentional disregard of a player’s age is considered as knowledge of the age.

Right to opt out. Consumers have the right to instruct any business intending to sell their personal information to third parties not to sell their information at any time. If a game company fails to adhere to CCPA regulations, breaches its obligations, fails to implement and maintain reasonable security procedures, or does not take practices appropriate to the nature of the information to protect players’ personal information, resulting in unauthorised access, disclosure, theft or exposure of such information, players can initiate a civil lawsuit.

The company may be required to pay damages ranging from USD100 to USD750 per player, or the amount of actual damages, whichever is higher, or face injunctions or other declarative legal actions.

Jeff Yang is a director at Wang Jing & GH Law Firm