On April 4, 2024, the CFPB issued a report titled “Banking in Video Games and Virtual Worlds” that examines the financial and privacy risks to consumers in online video gaming marketplaces.

The CFPB’s report explains that gaming platforms facilitate the storage and exchange of valuable assets while collecting large amounts of data from their users. According to the CFPB, the gaming marketplaces and infrastructure that facilitate the exchange of assets increasingly resemble traditional banking and payment systems, while the underlying asset exchanges increasingly resemble traditional financial products, like loans. Moreover, gaming platforms are collecting large amounts of data from their users, including financial data, location data, and biometric data. Given that conduct, the CFPB is concerned about the financial and privacy risks to consumers, especially because gaming platforms do not appear to provide the kinds of consumer protections that apply to banking and payment systems.

“Americans of all ages are converting billions of dollars into currencies used on virtual reality and gaming platforms,” CFPB Director Rohit Chopra said in a separate press release. “As more banking and payments activity takes place in video games and virtual worlds, the CFPB is looking at ways to protect consumers from fraud and scams.”

The Report

The report explores the growing scope of virtual assets throughout the gaming industry and analyzes the associated risks posed to consumers. In 2023, American gamers collectively spent nearly $57 billion, with expenditures for hardware, software, and in-game transactions involving the conversion of traditional currency into virtual equivalents. These virtual assets are frequently bought, sold, and exchanged within virtual economies, enabling gaming companies to simulate real-world financial interactions within digital landscapes.

The report identified three key trends and risks associated with gaming assets, including:

1. Gaming products and services mimic traditional financial products but frequently lack equivalent safeguards. Games and virtual worlds serve as dynamic platforms for players to manage and exchange valuable assets, ranging from in-game currencies to exclusive cosmetic items and collectibles. Notably, these digital economies have witnessed transactions surpassing $500,000 for a sought-after cosmetic skin. Leveraging this trend, the CFPB’s report asserts that gaming companies have integrated financial services like proprietary payment processors and money transmitters, blurring the boundaries between virtual and real-world marketplace.
2. Gaming companies typically offer minimal customer support to players experiencing financial harm. The surge in the value of in-game assets has led to a corresponding increase in fraudulent activities such as scams, phishing, and account breaches. Cybercriminals utilize various tactics, including phishing and compromised credentials, to access accounts and steal game currency or virtual items, which are then sold on external platforms. Despite numerous consumer complaints, the CFPB’s report asserts that gaming companies often offer little assistance or compensation for such losses, leaving players frustrated and unprotected.
3. Gaming companies compile players' personal and behavioral data, raising privacy and consumer protection concerns. Gaming publishers gather extensive player data, covering financial transactions, purchasing behavior, and even location tracking, providing insights into daily habits and health status. Further, advancements in virtual and mixed-reality gaming introduce additional privacy concerns, as headset technology gathers biometric data like iris scans and gait analysis, posing potential medical privacy risks. The CFPB’s report asserts that wealth of personal information, including health metrics and behavioral patterns, is often correlated with social media data to enable targeted advertising and personalized gameplay experiences.

Takeaways

The CFPB's report signals that the agency is concerned about—and believes it has the authority to address—the financial and privacy risks to consumers created by gaming marketplaces and other markets for non-traditional financial products and services. Given that posture, gaming platforms should carefully review the CFPB’s report and their own compliance process and procedures to determine whether any remedial steps are warranted.