25 July 2022
The explosive growth of the digital world has been largely unregulated so far, on the basis that too much regulation would stifle innovation. But high profile examples of sports stars inundated with racist abuse, teens encouraged to commit suicide and the prevalence of child sexual exploitation and abuse has turned the tide of political appetite towards regulation of online spaces. Incoming legislation principally targets the platforms which facilitate offending content and practices which, legislators argue, have profited from the lack of regulation to date.
In a gaming world which is engineering a 'metaverse' to recreate and augment real life interactions online, risks of harm are self-evident. Children may be exposed to adults without the usual buffer of parents, guardians or teachers, and many users have reported virtual groping and verbal abuse in VR settings.
The Online Safety Bill (OSB) is the UK's headline content legislation in this space. The OSB is intended to protect users, particularly children, from online harm. It will mainly focus on user generated content, covering both illegal and harmful content. It introduces a statutory duty of care on certain online providers to protect their users from harm. It will apply to:
Although it is not yet finalised in the form of an Act (what will presumably be the Online Safety Act), it has undergone substantial legislative scrutiny and was nearing completion before being delayed following Boris Johnson's resignation.
While the largest technology and social media companies are likely to be deemed the highest risk due to high volumes of user-to-user interaction and sharing of user-generated content, online gaming no doubt falls within scope for the same reasons.
Broadly, online games facilitating player-to-player interaction or players' creation of content are within scope of the OSB. The geographic scope requires that either:
In particular, the following sorts of functionality are likely to fall within scope of the OSB:
Games without online functionality, or games with online functionality that don't fit these criteria, are unlikely to be within scope. In the gaming context, there is also an exception for one-to-one live spoken communications. This may apply to spoken chat functionality between two players in a specific chatroom, server or lobby, but as soon as more than two join people join, or if there is also text chat functionality, the exception will not be relevant.
Of course, organisations within the gaming space but which are not strictly developers or publishers may also be impacted. Games forums, marketplaces, distribution platforms, livestreaming and video-on-demand platforms are all likely to be caught. For more detail on the scope of the OSB, please read here.
The OSB orients its regulation around three types of content: illegal content, content that is harmful to children, and content that is harmful to adults. For more detail on what these mean, please read here.
In summary, organisations will have safety duties dependent on the specific type of content they are trying to manage. These include:
All games organisations will need to carry out children's risk assessments to establish whether their player-base includes children. This assessment should determine:
It seems likely that all but the most mature indie games which are also behind age walls will qualify for this threshold. In addition to the summary requirements for in-scope games businesses, there are requirements which relate expressly to the protection of children. These include an overarching duty to protect children's online safety, breaking down into sub-duties to:
For more detail on child protection under the OSB, please read here.
The OSB leaves open a number of questions and uncertainties. Some of these may be resolved under statutory codes of conduct which Ofcom is obliged to produce but others may come down to operational implementation.
Which party in the game lifecycle is responsible?
Should it be the developer, the party most responsible for the production of the game? Should it be the publisher, the party funding and commercialising the game? Should it be the distributor (if different from the publisher) wanting to protect the brand of their platform? The OSB itself isn't specifically targeted at gaming and therefore does not address such questions directly. We anticipate that once the OSB is in effect, the contractual arrangements between these parties will determine who is responsible for what, including operational requirements and liability if things go wrong.
What will SMEs and indie developers need to do?
A thorough OSB compliance project, entailing myriad risk assessments and operational changes, is likely to require significant resource to manage. While this is achievable for large organisations which have more cash to spare on compliance processes, there is unfortunately no carve-out in the OSB for organisations under particular thresholds. This means that the likes of indie developers will still be on the hook.
Practically speaking, Ofcom itself will be managing resources and enforcement priorities. It isn't yet clear whether the games industry is specifically in the crosshairs or if it will amount to collateral damage, but it is likely that the smaller the organisation, the less it is likely to attract regulator attention unless it does something particularly egregious. Ofcom has said its regulatory responsibilities will involve it partly "learning on the job" and that it will therefore be engaging with organisations it regulates in the first instance, rather than moving straight to enforcement action. This may allow smaller organisations to shape up rather than face immediate sanctions.
Frequent references to "proportionality" should also help to assuage some fears. What's proportionate for the world's largest publisher will not be the same for a new indie mobile game developer.
There will undoubtedly be edge cases of content which is neither clearly in nor out of scope. For instance, are personalised characters or avatars captured? And what about personalised emblems, logos and other in-game items – for example, to indicate association with particular individuals or groups (clan tags)?
Hopefully, any Ofcom guidance or codes of conduct targeted at games will assist in this regard but it may be that edge cases require testing in the courts.
The UK Children's Code has already drawn a line in the sand to try to protect children and their personal data. Both this and the OSB form part of a wider UK and EU regulatory endeavour to protect people online. It's therefore very important that all gaming businesses, big and small, begin to plan for the implementation of the OSB and greater regulation of problematic online content.
As we welcome the new year, Richard Faichney reflects on the year that was and looks ahead to what the next 12 months might hold for the video games sector, with a focus on corporate deal activity, key commercial trends and increasing legal challenges.