Data protection

All digital games generate data, and many data uses are necessary for the functioning, improvement and further development of computer and video games – and are therefore also permitted. game advocates a modern data law that takes informational self-determination seriously while at the same time enabling economic and technological progress.

Cookie regulation in the games industry is governed by the ePrivacy Directive and the German Act on Data Protection and Privacy in Telecommunications and Digital Services (TDDDG). Following the CJEU ruling in Planet49, it is now clear that the use of cookies generally requires active and voluntary consent. This obligation does not apply where cookies are technically strictly necessary for a service. In games in particular, many cookies are essential for the functioning of the game and for improving the gaming experience and can therefore be considered functional, so that no additional consent is required.

For the international computer and video games industry, data transfers to other countries such as the USA and the UK are essential. Data transfers to so-called third countries require international agreements or appropriate safeguards such as standard contractual clauses. For the USA, the EU-US Data Privacy Framework (DPF) has served as the legal basis for data transfers since July 2023. A court of first instance confirmed its validity in September 2025, although an appeal to the CJEU is still possible. For the United Kingdom, the EU adequacy decision was renewed in December 2025 until 2031, meaning that data transfers to the UK remain possible without additional safeguards.

For further information, the game has published a supplement in the legal journal MMR: MMR 08-2021 – Supplement on Data Use