For a game studio, the first compliance questions are usually who your players are and how they pay. If children play, children's privacy rules such as COPPA in the US apply. If you handle card data, PCI DSS applies. Engineering work starts with minimizing data and shrinking payment scope.
This is general information, not legal advice. Your counsel should confirm which laws apply to your studio.
Do children's privacy rules apply to your game?
The FTC's COPPA guidance says the rule applies to operators of commercial websites and online services, including apps and connected toys, that are directed to children under 13 and collect their personal information. It also applies to general audience services that have actual knowledge they are collecting personal information from children under 13.
Two details matter for games. A site directed to children may not block children under 13. A mixed audience service may age screen users, but it must still meet COPPA for under 13 users. So an age gate is a design decision with legal weight, not a UI detail.
The FTC page notes the COPPA Rule was amended on April 22, 2025, so read the revised rule for the current requirements.
What does COPPA ask engineers to build?
From the FTC FAQ:
- Verifiable parental consent before collecting personal information from children, unless a limited exception applies. Accepted methods listed include a signed form, a monetary transaction that notifies the account holder, a call or video with trained staff, and government ID checks with prompt deletion of the ID. If data is used only internally and not disclosed, the "email plus" method may be used.
- Direct notice to parents with specific content.
- Security. Maintain the confidentiality, security and integrity of children's information, and release it only to third parties that can do the same.
- Retention. Keep the data only as long as needed for its purpose, then delete it with reasonable measures against unauthorized access.
Constructed example: a studio's chat feature stores messages and voice clips for 90 days by default for moderation. If players under 13 can reach it, the team needs to ask whether that is personal information, whether consent exists, who the moderation vendor is, and whether 90 days is justified. Engineering fixes might be an age-aware default of no chat or a shorter retention for flagged accounts.
When does PCI DSS come in?
The PCI Security Standards Council describes PCI DSS as a baseline of technical and operational requirements for protecting payment account data. It applies to any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment. Payment brands or acquirers decide who must validate compliance. The page refers to PCI DSS v4.x resources. Check the council's document library for the current version and dates.
The practical move for most studios is to keep card data out of your systems. Use a hosted payment page or your platform store's billing, so card numbers never touch your servers. That shrinks scope. Document what is out of scope and why, because an assessor will ask.
What goes on the engineering priority list?
- Know your data. List every field collected from players, where it goes and which vendors see it, including analytics, crash reporting, chat and ad SDKs.
- Decide your age approach with legal input, and build the flow, including parental consent if you allow under 13 players.
- Minimize and expire. Drop fields you do not use, set retention periods, and build real deletion.
- Keep card data out with hosted payment, and document the scope boundary.
- Vet third party SDKs and plugins. They run inside your game and can collect data you did not intend. Track them in an inventory.
- Secure the build and release pipeline, since a tampered build reaches every player.
- Write an incident plan with contacts for legal, platform partners and regulators.
Safeguard's dependency inventory and SBOM generation can list the SDKs and libraries in each build, which feeds step 5. See the dependency inventory demo.
Quick check
Can a game block players under 13 to avoid COPPA?
Not if it is directed to children. The FTC says child directed sites may not block children under 13. Mixed audience sites may age screen but must still meet COPPA for under 13 users.
What is the simplest way to reduce PCI DSS scope?
Keep cardholder data out of your systems by using a hosted payment page or platform billing, and document the scope boundary.
Sources
Last reviewed: 18 October 2026.
