May 8, 2024
"OVER THE LINE!" Where Banking and Gaming Intersect, the CFPB Has Something to Say.
Julia K. Whitelock, Justin B. Hosie and Jason Esteves
The line between virtual and reality is getting thinner. Gamers pay gaming companies real currency for virtual in-game currency to buy skins, create the world they want to live in (virtually), or purchase loot that aid in their game play. In some circumstances, virtual currency can be used for real-world transactions, such as wagering skins or virtual currency or cashing out and receiving real money. According to the Consumer Financial Protection Bureau (CFPB), the virtual versus reality line does not exist when it comes to video games and banking.
On April 4, 2024, the CFPB issued a report spotlighting consumer protection issues in online video games and virtual worlds. The "Banking in video games and virtual worlds" report details how the CFPB views the flow of gaming assets in and out of gaming marketplaces as financial services. The CFPB's monitoring of the gaming industry, which is a non-traditional market for financial products and services, warrants attention.
Assessing how laws applicable to the consumer financial industry might apply to the gaming industry may seem daunting, and perhaps unexpected. But understanding the issues and potential stakes will aid in putting your best foot forward. Over a series of articles, we will discuss the aspects of the current gaming industry that have drawn the CFPB's concern and the implications for potential violations of consumer protection laws.
- Payments issues: The CFPB is concerned about value accessibility and transparency, recourse when the value disappears due to fraud, moving value, money laundering, and currency conversions.
- Advertising and unfair and deceptive practices: As gaming companies advertise products and features, they can find themselves in hot water with regulators that believe ads potentially mislead players about those products and features, especially if in-game dynamics favor those who spend more money.
- Data safeguarding and privacy issues: Gaming systems collect, store, and communicate significant amounts of sensitive geolocation, personal identifying, and biometic information. Additionally, over half of "gamers" in the United States are under the age of 16. Often privacy disclosures are buried or may be misleading. These issues may implicate state privacy laws and state and federal unfair and deceptive acts and practices laws.
Before delving into these issues in our next few articles, why should the gaming industry take notice of the CFPB's report?
The CFPB's report lays the foundation for asserting its authority over gaming companies.
The CFPB's report does not address its authority to supervise or enforce federal consumer financial laws against the gaming industry. However, its identification of the "problem" lays the groundwork for the CFPB to take future action. According to its report, the CFPB believes that payment processing, money transmission, and loans are financial products and services that exist in the gaming marketplace. The CFPB has received increased reports of users losing access to gaming assets and a significant risk of harm due to gaming publishers' collection, storage, and use of surveillance data about their users.
One way the CFPB exercises its authority is through supervisory exams. Supervisory exams are confidential processes that identify and rectify potential violations of federal consumer financial law. The CFPB has supervisory authority over those offering or providing a consumer financial product or service who the CFPB has reasonable cause to determine "is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services." On April 25, 2022, the CFPB announced its intent to invoke that authority "to be agile and supervise entities that may be fast-growing or are in markets outside the existing nonbank supervision program." While a particular gaming company may not traditionally fall within the purview of the CFPB's authority, the CFPB's report strongly suggests that the CFPB may assert this authority over gaming companies that offer what the CFPB deems to be financial products and services.
The other way the CFBP exercises its authority is through enforcement. The CFPB's enforcement authority is broader than its supervisory authority. Its enforcement authority is, with certain exceptions, over those who violate a federal consumer financial law. The CFPB has the authority to issue civil investigative demands (CIDs), which are a type of administrative subpoena. CIDs may demand documents, answers to written questions, oral testimony under oath, among other things, to aid the CFPB in determining whether a party violated a federal consumer financial law. After an investigation concludes, the CFPB may bring an administrative enforcement proceeding or an enforcement action in federal district court. Federal law allows the CFPB to seek various types of relief, including civil money penalties for knowing violations of up to $1,000,000 per day during which the violation continues.
The Federal Trade Commission (FTC) has already demonstrated it will not tolerate gaming company practices that harm minors.
The FTC has authority to enforce Section 5 of the Federal Trade Commission Act (FTC Act), which prohibits "unfair or deceptive acts or practices in or affecting commerce" by anyone engaged in commerce. In 2022, the FTC went after one of the largest gaming companies for alleged privacy violations and deceptive practices.
The FTC alleged that the gaming company violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children under 13 without notifying parents or obtaining parents' verifiable consent. The FTC also alleged that the gaming company violated the FTC Act by implementing default settings that enable live text and voice communications for users, which could harm children and teens. Pursuant to a consent order, the gaming company agreed to pay a $275 million monetary penalty to address the COPPA allegations and to adopt privacy settings for children and teens that by default turn off voice and text communications.
Federal agencies have used the phrase "dark patterns" to describe website and app interface designs that are crafted to "trick" users into doing something, such as buying things unintentionally. In a separate administrative complaint, the FTC alleged that the gaming company tricked users into making unwanted purchases, allowed children to charge account holders without any parental involvement or authorization, and locked accounts of customers who disputed unauthorized charges. The gaming company agreed to pay $245 million to refund consumers, to stop engaging in these practices to charge consumers or to otherwise charge consumers without obtaining their affirmative consent, and to stop blocking customers who dispute unauthorized charges.
State attorneys general are likely to join in the focus on the gaming industry to protect their respective citizens.
Most states have consumer protection laws and empower their respective state attorney general to enforce those laws. Additionally, both the CFPB and the FTC routinely coordinate and bring enforcement actions with state attorneys general.
There is a real and significant risk of class action claims for gaming companies' financial products and services.
Most states have consumer protection laws that authorize private causes of action for unfair or deceptive practices resulting in consumer injury. Plaintiffs' lawyers often look to government enforcement actions for inspiration on legal theories, in addition to being creative of their own accord.
In a recently filed class action, the parents of two children sued a gaming company for maintaining and facilitating an "illegal gambling ecosystem, targeted at children," through the game's "online gaming platform and digital currency." The plaintiffs alleged that users can purchase the game's virtual currency for in-game experiences, but which the game allows to be cashed out. There are several online casinos that entice minors by allowing wagers in virtual currency. To make the currency "available for gaming, an online gaming casino representative engages in a dummy transaction" on the game "platform that gives the casino access to the minor's" currency "while the minor gambles." In the event the child loses virtual currency in the online casino, the game processes the casino's exchange of the virtual currency for cash and the game takes a cut. Earlier this month, the federal court forced the gaming company to litigate several of plaintiffs' claims.
Legislators may have renewed interest in protecting minors from certain gaming company practices.
In 2019, Senator Hawley (R-MO) introduced the "Protecting Children from Abusive Games Act." The bill expired in January 2021, but it deserves a mention as the FTC's recent enforcement actions and the CFPB's focus may renew legislative efforts to regulate potential financial products and services in gaming. Senator Hawley's bill was intended to ban manipulative video game features aimed at children, specifically "monetization models that promote compulsive 'microtransaction' purchases by consumers." The bill cited two practices as abusive "pay to win" and "loot boxes," both of which the CFPB's report address.
The crystal ball is hazy.
It's hard to predict what exactly will come out of the CFPB's report. But suffice it to say that it foreshadows future CFPB activity and heightens the attention of regulators and plaintiffs' lawyers to these issues. This page will be updated with links as the subsequent articles in this series are published.