Online games use dark designs to collect player data, researchers reveal

Gaming is a $193 billion industry—nearly double the size of the film and music industries combined—and there are around three billion gamers worldwide. While online gaming can improve well-being and foster social relations, privacy and awareness issues could potentially offset these benefits and cause real harm to gamers.

The study, by scientists at Aalto University’s Department of Computer Science, reveals potentially questionable data collection practices in online games, along with misconceptions and concerns about privacy among players. The study also offers risk mitigation strategies for players and design recommendations for game developers to improve privacy in online games.

“We had two supporting lines of inquiry in this study: what players think about games, and what games are really up to with respect to privacy,” says Janne Lindqvist, associate professor of computer science at Aalto. “It was really surprising to us how nuanced the considerations of gamers were. For example, participants said that, to protect their privacy, they would avoid using voice chat in games unless it was absolutely necessary. Our game analysis revealed that some games try to nudge people to reveal their online identities by offering things like virtual rewards.”

The authors identified instances of games using dark design—interface decisions that manipulate users into doing something they otherwise wouldn’t. These could facilitate the collection of player data and encourage players to integrate their social media accounts or allow data sharing with third parties.

“When social media accounts are linked to games, players generally can’t know what access the games have to these accounts or what information they receive,” says Amel Bourdoucen, doctoral researcher in usable security at Aalto. “For example, in some popular games, users can log in with (or link to) their social media accounts, but these games may not specify what data is collected through such integration.”

The global gaming community has been subject to increased scrutiny over the past decade because of online harassment and the industry’s burnout culture. While these issues still linger, the push for more tech regulation in the EU and US has also brought privacy issues to the forefront.

“Data handling practices of games are often hidden behind legal jargon in privacy policies,” says Bourdoucen. “When users’ data are collected, games should make sure the players understand and consent to what is being collected. This can increase the player’s awareness and sense of control in games. Gaming companies should also protect players’ privacy and keep them safe while playing online.”

According to the study, participants were often unaware that their chat-based conversations might be disclosed to third parties. Games also didn’t notify players of data sharing during the game.

The study showed that players are aware of the risks, and it highlights several mitigation tactics used by players. “We found that players try to maintain their privacy when playing online games by choosing text chats for discussion instead of voice chats, since they believe they may be more closely watched,” says Bourdoucen. “According to our findings, female players are the most impacted and feel the need to conceal their gender when playing by creating various avatars or refraining from having voice conversations with other players.”

Finally, the study proposes solutions to counter these problems, such as more transparent approaches to data collection. Overall, the authors recommend that games and gaming platforms strive to protect all their players.

“Games really should be fun and safe for everybody, and they should support the player’s autonomy. One way of supporting autonomy would be able to let players opt out from invasive data collection,” says Lindqvist.

The study is published in the journal Proceedings of the ACM on Human-Computer Interaction.