In June 2018, the World Health Organization officially recognised “gaming disorder” in the 11th revision of its International Classification of Diseases (ICD-11). This was, and remains, a very controversial decision. Nevertheless, it is a development that the games industry needs to keep in mind. As part of this, it can be instructive for the games industry to see what lessons can be learnt from the gambling industry, where the need to protect users from addiction is well established.

This blog will explore the complex interaction between addiction in gambling and data protection, based on a recent decision of the High Court in England, and consider what it means for the games industry. This blog is not intended to be alarmist, but instead to serve as a reminder to those in the games industry about actions that they can take (or not take) in relation to targeted advertising and direct marketing to customers.

Recent case law on addiction

Earlier this year, the High Court in England found that a gambling addict could not be said to have given ‘valid’ consent to the direct marketing they had signed up due to their addiction (RTM v SBG[1]). The judgment, in essence, found that the claimant’s addiction impaired their ability to give valid consent to receive direct marketing. The judgment (which is being appealed by the defendants) also indicated that there is a subjective element to consent.

There are many factors that distinguish this case from the video-gaming sector: the gambling industry is regulated in respect of those who suffer from addiction or display markers of harm; and the judgment went to great pains to stress that this case was specific to its facts and the relevant time in question (2017-2019). It is also worth noting that leave to appeal has been granted to the defendants. However, the video gaming sector also undertakes marketing and advertising and players of video games can also suffer from addiction. So where does this leave us?

Marketing and advertising

Video games companies will want to undertake effective advertising and marketing campaigns to broaden their audience and increase sales of games and in-game products. This is an effective way of generating revenue and there is no issue with running these campaigns provided they comply with the law. The law in relation to data protection, however, is slightly murkier following RTM v SBG.

One form of advertising which will engage data protection is targeted advertising. This will require profiling to ensure that the advertising is tailored and to maximise effectiveness. It is this profiling that will require personal data of the recipient to be processed and this processing will be carried out on the basis of either consent or legitimate interests.

Another form of marketing is direct marketing: essentially sending emails, text messages and in-platform messages to players with specific offers or advertising products. Direct marketing may or may not be undertaken with the assistance of profiling, but in any event it will involve processing personal data and this again will be carried out on the basis of consent or legitimate interests (in relation to the ‘soft opt-in’ exemption to consent).

We therefore need to examine what exactly is meant by consent and legitimate interests under the UK and EU GDPR.

GDPR

The UK and EU GDPR provide a definition for consent which states that in order for consent to be valid it must be: freely given, specific, informed and unambiguous. This is intended to be a high threshold.

Alternatively, a controller can carry out processing if the purpose of the processing is in its (or a third party’s) legitimate interests provided that these interests are not overridden by the interests and fundamental rights and freedoms of the individual whose personal data is being processed. Essentially, a controller must weigh its interests against the interests (and harms) of the data subject.

The challenge

In light of RTM v SBG, how can a video games company be confident that its reliance on consent or legitimate interests will stand up to scrutiny if the recipient of advertising and marketing is addicted (or could be addicted) to playing video games? And what can be done when the company in question does not know if the player is suffering from addiction?

Our advice

Sadly, we won’t be sharing a one-size fits all solution and posting it here. There is no single solution: each company will be different and as seen in RTM v SBG, the specific facts when it comes to marketing, advertising and addiction are crucial.

What companies can do is carry out a data protection impact assessment in respect of advertising and marketing. This should be a bespoke document that looks at the practices of the company, any safeguards that are in place, and improvements that can be made. Crucially, this impact assessment will help a video games company to be able to demonstrate how and why marketing and advertising can comply with data protection when set against the issue of addiction – remembering that the UK and EU GDPR require companies to be able to demonstrate how they comply with the regimes.

In order to carry out the impact assessment we would advise the following steps are taken:

• understand precisely what personal data is collected;
• understand how this personal data is used for advertising and marketing; and
• review your user journey.

These steps will provide a useful overview on current practices as well as the expectations of the user.

Additionally, companies can learn important lessons from other industries that currently are regulated in respect of addiction, particularly the gambling industry. The gambling industry places extensive requirements on operators in respect of addiction and some of these may be suitable for integration into a video game organisation depending on the relationship with players and the marketing and advertising practices.

Final thoughts

We are aware that re-framing marketing and advertising practices through the lens of addiction is not a pleasant thought. As mentioned, this blog is not supposed to be alarmist but to raise awareness around the challenges that can be faced.

The video gaming sector is different from gambling in the types of risks and harms involved, though concerns about addiction in the video gaming sector are still present.

We can assist with all of the above. Our data protection team has vast experience in the sectors of both video gaming and gambling and are well placed to help assess the challenges, mitigate the harms and prepare impact assessments.

[1] RTM v Bonne Terre Ltd & Hestview Ltd [2025] EWHC 111 (KB)