If you thought virtual reality was free from real-world regulations, think again. On April 4, 2024, the CFPB released an Issue Spotlight that dives deeply into a realm the agency had not previously traversed—video games and virtual worlds. The CFPB signaled a particular focus on gaming markets, including issues of fraud and money laundering, impact on young consumers, and gaming companies’ potential collection of an immense amount of sensitive consumer data. These activities, according to the CFPB, raise questions about gaming companies’ compliance with applicable law, including federal consumer financial protection laws. The agency’s focus on gaming aligns with the CFPB’s and Director Rohit Chopra’s recent actions and statements on emerging technologies and reflects the agency’s shifting approach toward innovation.
Issue spotlight content
Background
The Issue Spotlight provides a broad overview of the gaming and virtual world market. It describes the rising value of gaming assets and the resulting emergence of marketplaces and infrastructure for trading and exchanging these assets. While these marketplaces resemble traditional banking and payment systems, gaming companies and operators of virtual worlds currently do not provide consumer protections typically associated with such systems.
The CFPB clarifies that the Issue Spotlight does not impose legal obligations or give an official interpretation of any law or regulation. Gaming companies’ liability under existing applicable laws will be a fact-dependent determination, and the CFPB encourages those entities to examine their legal obligations and responsibilities accordingly. The focus on these issues may be in part due to the massive size of the gaming market, which is expected to reach $321.1 billion by 2026. The CFPB also “expects” that emerging trends in the gaming market will garner attention from policymakers and other government agencies responsible for addressing the issues highlighted—a statement that may be seen as a nudge to Congress and other regulators to take action.
Fraud and money laundering
The ability to transfer and convert gaming assets to fiat currency or crypto assets has given rise to money laundering and fraud on gaming platforms. Regarding money laundering, the CFPB notes that illegally acquired fiat currency can be used to buy gaming assets which are later converted back into fiat currency. The transfers can obfuscate the trail of the original ill-begotten funds. Further, fraudsters often leverage compromised user credentials to access player accounts that hold in-game currency or virtual items. Many of these accounts are unprotected, lacking security protections that would be typical of a traditional bank account. Moreover, consumers are threatened by an emerging market of account recovery scammers that promote their ability to obtain lost gaming assets for victims of theft.
Nevertheless, the CFPB says gaming companies often take a “buyer beware” approach and provide little to no recourse for aggrieved gamers. Moreover, many third-party systems facilitate the buying, selling, and trading of in-game currency, virtual items, and even entire player accounts, yet the CFPB notes that these sites can have porous data security and entice players with tactics that might expose them to credit card fraud, malware, and identity theft risks.
Young consumers
The CFPB highlights gaming’s wide popularity with young people and the associated vulnerabilities that may entail. For many of them, gaming can function as an early introduction to financial activity by providing “the opportunity to learn about earning currency, managing assets, and making purchases.” Young people may be particularly susceptible to tactics used by gaming companies to induce spending. Gaming companies also may target young gamers to cultivate a long-term consumer base and leverage the social aspect of gaming, which research indicates is a key attraction for young players.
Data collection
The CFPB discusses the extensive personal and biometric data collection in gaming, which can create detailed offline personal profiles, and how such data may be utilized to drive increased spending by players. The data collected may include financial data, location data, interactions with games and devices, and other information obtained through social media integrations. For alternative reality/virtual reality devices, the information may be even more personal and can involve biometric data such as posture, eye gaze, facial expression, voice, heart rate, and interpersonal distance. The CFPB specifically criticizes gaming companies’ use of data to provide highly personalized pricing and offerings of goods or services, which may give “a misleading impression to the player about the fairness or neutrality of these opportunities.”
Conclusion
The CFPB emphasizes four points. First, the most popular video games include immersive virtual worlds that offer the storage and exchange of valuable assets, and gaming companies have created digital marketplaces that facilitate the exchange of these assets with limited consumer protections, leading to harmful practices for players including financial losses due to theft and scams. Second, consumer protection laws apply to banking and payment systems that facilitate the storage and exchange of valuable assets. Third, the agency is monitoring non-traditional markets where consumer financial products and services may be offered, including those offered by or in connection with proprietary gaming platforms. Fourth, gaming companies’ vast accumulation of consumer data “raises questions as to whether privacy rules are being adhered to” and whether younger consumers and their parents “are fully aware of how their data is being collected and used.” The CFPB pledges to continue working with other agencies to monitor companies that “assemble and sell sensitive consumer data,” including payment history, “especially when this data is harvested and monetized without the user’s awareness.”
Analysis and key takeaways
The CFPB Issue Spotlight at first blush may appear out of the blue. While an interesting topic, consumer protection concerns related to gaming platforms and virtual worlds would not seem to be the CFPB’s top priority, and this may be the first time the phrases “skins” and “loot boxes” have appeared in a CFPB communication. However, a careful look at the CFPB’s recent statements and actions provide important context.
- FCRA rulemaking and data collection: The CFPB has focused recent policy efforts on the collection and monetization of consumer data. The CFPB is currently undertaking a Fair Credit Reporting Act (FCRA) rulemaking which would subject data brokers to the FCRA. The CFPB may be putting gaming site and virtual world operators on notice that the agency views them as data brokers that will be covered by the rulemaking. The report’s reference to “data surveillance” also mirrors Director Chopra’s language in a recent White House speech where he framed widespread consumer data collection as a national security issue.
- Tech flex: The Issue Spotlight accords with the CFPB’s assertive and proactive approach to technology issues under Director Chopra. The CFPB has proposed to designate digital wallet and payment app providers for supervision. It has issued several guidance documents to address consumer protection concerns or ambiguities related to the application of CFPB authorities to newer technology platforms or business arrangements, some of which we have covered in a prior legal update, including the recent UDAAP guidance on digital comparison-shopping platforms and prior RESPA guidance on a similar topic. The CFPB also has trumpeted its hiring of technologists to bolster its ranks and capabilities.
- Refocused approach to innovation: The Issue Spotlight illustrates the CFPB’s shifting approach to innovation. Under the Trump administration, the agency stood up the Office of Innovation (OI) and issued new policies which briefly enjoyed broad take-up. Then-CFPB leadership, through OI, prioritized engaging with companies to provide regulatory relief or explore sandboxes to incentivize innovative product development. But in 2022, the CFPB announced a move away from these policies and a rebrand of OI as the Office of Competition and Innovation (OCI). Now, the CFPB, through the OCI, appears to be focused on building the case for why innovative technology providers and products must comply with existing consumer protections. An earlier example was a report last year on tap-to-pay technologies.
- UDAAP to protect young consumers: The CFPB seems to signal an intent to use its UDAAP authority to protect young consumers from unfair or abusive practices associated with gaming and virtual world platforms. Although there may be merit to the CFPB’s policy concern, we note an interesting historical parallel to decades ago when the FTC attempted to address perceived risks to children in the analog era. During the 1960s and 1970s, the FTC embraced an expansive view of its FTC Act unfairness authority. This culminated in a 1978 rulemaking that attempted to ban certain advertising during children’s television programming. The ensuing blowback led to congressional defunding and a Washington Post editorial tagging the FTC as the “great national nanny.” It also precipitated the narrowing of the FTC’s unfairness authority through its seminal 1980 policy statement, later codified into statute. The CFPB may want to heed the lessons of history to avoid potential overreach in this area, particularly as it continues to flesh out the contours of its abusiveness authority.
Contact us
Husch Blackwell attorneys are available to help companies navigate the CFPB’s approach to innovation issues broadly and to gaming and virtual worlds specifically. One of the co-authors of this Legal Update worked at the CFPB for over 12 years and led several innovation-related initiatives. If you have questions, contact Mike G. Silver, Leslie Sowers, Alex McFall, Jacob Huston, or your Husch Blackwell attorney.