As a reader of The Markup, there’s a good chance you care about your privacy. Maybe you have taken the time to limit the amount of data apps can collect from your phone, use a privacy-focused browser, or install an ad blocker to thwart data brokers. After all that hard work, you probably just want to plop down on your couch and escape this dystopian reality—perhaps into a game where you fly a paraglider over green meadows or snipe some friends on the battlefield. 

Well, I’m sorry to spoil your fun, but that playful land of willowy fields and rifle scopes is its own nightmare: Your privacy and safety are at risk on your game console, and if you have children, theirs is as well. If you and your family want to play in peace, you need to learn how to lock your system down.

The enemies you are up against in this quest are legion. Big tech companies, data brokers, and advertisers all want to slurp up as much information as possible about the time you spend in your gaming world. They have allied themselves with console makers, game developers, and the various companies who enable features like online and social gaming. This means that a single gaming experience may be subject to several overlapping privacy policies and that user preferences are spread across several different locations. Their tactics arrayed against you are complex, but they share a simple goal: to monetize you.

If you are a parent of game-obsessed kids (like I am), chances are you are already at least partly aware of these challenges: A recent Pew Research survey found that 84% of Americans said they are concerned about games tracking what kids are doing on them. There is no easy way to say this: If you want to unlock the achievement of protecting your privacy, you will have to do some serious digging into the settings on your kids’ consoles and make important choices about how much freedom they are allowed, who they can interact with, and how to keep their gaming lives private. 

The device manufacturers are putting a huge burden on parents.

Girard Kelly, Common Sense Media

“The device manufacturers are putting a huge burden on parents to somehow monitor all these settings and try to protect their kids,” said Girard Kelly, head of privacy at Common Sense Media, a nonprofit focused on children’s tech and entertainment. Kelly noted that any advice about these settings has a short shelf life due to constant updates. “These settings are always changing,” he said.

But there is hope. To help you on your epic journey to find the hidden settings that will restore your privacy, we’ve created a helpful sidekick we’re calling the Game Safety Buddy. We’ve read the cryptic language of privacy policies and built the Buddy to help you avoid traps designed to exploit your personal information. As Kelly’s comments attest, the ever-shifting sands of game privacy settings mean the Buddy won’t remain up to date forever—so use it well, and while you can. It will direct you to the most important controls you need based on your situation. Once you’ve found some helpful advice, the sections that follow provide more detailed context and background on some of the issues at play.

The Game Safety Buddy’s advice is focused on your particular concerns, but there are some things to keep in mind no matter what aspect of gaming worries you.

The BreakdownPrivacy

How to Quickly Get to the Important Truth Inside Any Privacy Policy

An investigative data journalist and a former tech lawyer teach you how to spot tricks and hidden disclosures within these interminable documents—and even how to claw back some privacy

August 3, 2023 08:00 ET

One is to avoid linking external services to your game console, such as signing in with a social media account or other platform. Each time you link up another service, you might be giving permission for another company to see and share what you are doing when you play. 

Also, if you have children who game, and you share their console with them, set up restricted child accounts for them, and be vigilant about who is using which profile. Failing to do so can thwart all the tools in place to manage several family members of different ages living under one roof with different levels of restrictions. “Sometimes children are viewing content or playing games using their parent’s profile. That’s even more of a problem for homes with only one device,” said Kelly. “The burden again is on the parents to make sure the child is always using the right account.”

One of the most important reasons to protect kids’ privacy in online games is that they have proven to be places where adults can prey on children, either through messaging in the games themselves or on gaming adjacent platforms like Discord. Parents may not be aware of the many ways that players can communicate in online games, such as voice chats, in-game messages, or cross-platform play, which can be harder to monitor and moderate. 

John Redgrave, Discord’s VP of trust and safety told The Markup in an emailed statement, “The exploitation of children is appalling, unacceptable, and has no place on Discord or in society. We work relentlessly to stop it, which can include removing users, shutting down servers, and engaging with the proper authorities, including the National Center for Missing & Exploited Children (NCMEC).”

The anecdotes of children blowing big bucks on videogames are not hard to find — $700 on Roblox, $955 on Fortnite, $1500 on XBox bazookas and other weapons and vehicles. The problem is that even children who understand and appreciate the value of a dollar may not realize that’s what they are actually spending when they authorize transactions inside the fantasy world of a game. And when they do, they may not realize how quickly purchases add up. As Sen. Maggie Hassan put it in a letter to an industry group, “The prevalence of in-game micro-transactions, [for such virtual items as] ‘loot boxes,’ raises several concerns surrounding the use of psychological principles and enticing mechanics that closely mirror those often found in casinos and games of chance. The potential for harm is real.”

There is ample evidence that the privacy of both adult and child gamers is regularly put at risk. In 2023, for example, the Federal Trade Commission announced a $20 million settlement with Microsoft for alleged violations of the Children’s Online Privacy Protection Act (COPPA). The FTC said that Microsoft’s Xbox platform was collecting data on kids under 13 before notifying their parents and failing to notify parents that some of this data was disclosed third parties.

The potential for harm is real.

Sen. Maggie Hassan

In 2022, the FTC took action against Fortnite developer Epic Games, fining the company $275 million for alleged COPPA violations, and requiring stronger default settings for children and teens. Epic Games also agreed to pay $245 million in refunds due to designs in its products that led to misleading purchases of virtual goods. 

Jake Jones, senior communications manager at Epic Games directed us to a blog post about the settlement. “Over the past few years, we’ve been making changes to ensure our ecosystem meets the expectations of our players and regulators, which we hope will be a helpful guide for others in our industry,” read the post. 

The FTC is also looking around the corner to a weird future for games that could include “blurred” advertising, or cleverly disguised advertising woven into the game. “Children may be more likely to trust such messaging, particularly if it comes from a trusted source such as a social media influencer or an avatar they have befriended in a game,” the FTC said in a press release. 

Why do so many game and console settings share your information by default, forcing you to opt-out of each stream of data being collected? Because the hours you spend gaming are rich in behavioral information that advertisers are eager to mine for insights that can be used to sell you things.  

Internal Microsoft documents accidentally provided in unredacted form to a federal district court  in connection with an FTC lawsuit revealed that Microsoft set a goal of making $1.4 billion in annual advertising revenue on the Xbox by 2030. 

Nintendo’s privacy policy says that “we do not, and will not, sell your information to third parties,” but the company does use your activity on the platform and the information that you give it to target you with advertisements. Nintendo lists 27 third-party partners that it may share your data with, including Facebook, Google, YouTube, Bing, TikTok, and Snap. That information can include your “service use history,” interactions with other users, and inferences made about you. 

Similarly, Microsoft says that it “does not sell your game and app usage history or any other personal data to third parties” but also says that third parties may get access to information like your age range, in-game communications, friends lists, and times when you game.

Sony’s PlayStation privacy policy also says that “we do not and will not accept money in exchange for sharing PI [personal information]” before noting that it may share your data with “Advertising and promotional partners.” Such data can include the times when you game, how often you chat, and what music you play. Sony even keeps a recording of the last 5 minutes of voice chats, but says “it’s strictly reserved for reporting online abuse or harassment.”   

Nintendo declined to comment, and Sony and Microsoft did not respond to a request for comment.

So far, we have covered what we think are the most important use cases for, and risks of, game systems. If you’d like to explore potential safeguards other scenarios, here are resources provided by the platforms themselves:

• Nintendo: You can opt out of third-party ad targeting from your account settings. For settings relevant to kids, you can try the Nintendo Switch Parental Controls app (iOS, Android). Nintendo offers a guide to these controls here. 
• Sony: You can opt out of third-party data sharing by entering your email into this form. You can control your “personalized content” settings (including targeted ads) on the web on Sony’s account settings under “Privacy Settings.” Sony has a guide to parental controls on their gaming platform and they have an app (iOS, Android) that offers basically the same detailed settings as playstation.com.
• Microsoft: You can opt out of “personalized recommendations” (but not ads) based on the games you have played, the content you have purchased, the achievements you have unlocked, and your friend list by opting out here. You can find a detailed guide to parental controls on Microsoft’s Xbox “Family hub.” Microsoft also offers a dedicated app for parental controls called the Xbox Family Settings app (iOS, Android). 
• Discord: Parents concerned about this chat platform, commonly used by gamers, can visit Discord’s Parent Hub and Family Center.
• Industry wide: You can find a detailed guide to each platform’s parental controls on the website for the game industry trade organization Entertainment Software Rating Board.

For good independent resources, check out Mozilla’s thorough (and funny) privacy report for the Sony PlayStation, Nintendo Switch and Xbox Series X & S as part of their Privacy Not Included series.