|
December 16, 2020 In This Issue
Games vary in difficulty from the first levels of Candy Crush to the final bosses of Sekiro: Shadows Die Twice. They vary in visual fidelity from the ASCII characters of Dwarf Fortress to the high-detail, motion-capture shown in the latest sports games. They can be controlled by joysticks, dance pads, and fishing reels. They are also designed, developed, and published by developers, which whether small or multibillion-dollar companies, need to be mindful of various business and legal issues in the gaming space. We discuss some of those issues below. Will Next-Gen Consoles Meet EU’s Proposed Right to Repair? The release of the PlayStation 5 by Sony Interactive Entertainment LLC (Sony) and the Xbox Series X by Microsoft Corporation (Microsoft) occurred in the fourth quarter of 2020.1 While these consoles’ capabilities will take years to fully exploit, it is a near-certainty that these next-gen consoles will provide gamers with better visuals, faster frame rates, and speedier processing in the coming decade through significantly improved hardware.2 Despite the inclusion of the newest hardware, users will still be subject to first-gen thinking when it comes to their rights and ability to modify and repair their consoles. There are movements underway both in the U.S. and abroad to provide users with the “right to repair.” Earlier this year, the European Commission (EC) announced a new action plan for a circular economy generally aimed at “mak[ing] sustainable products, services and business models the norm and transform[ing] consumption patterns so that no waste is produced in the first place.”3 This plan includes giving consumers a right to repair, among other things, their electronic devices (in particular, phones, tablets, and laptops), which would effectively “open source” certain designs, specifications, and manuals that companies have historically either retained as confidential or only provided to authorized repair shops. While the EC’s circular economy plan is silent as to whether consoles also constitute “electronic devices,” gamers may advocate to apply the right to repair laws to consoles. Right to repair laws in the U.S. have primarily focused on automobiles, tractors, and other farm equipment,4 but the EC’s right to repair legislation may be prompting (or pressuring) legislators in the U.S. to consider similar laws. For example, the U.S. House of Representatives advanced a funding bill this summer that required the Federal Trade Commission to report on anticompetitive practices in the repair market.5 If the EC’s right to repair legislation ultimately does extend to consoles, it could put pressure on legislators in the U.S. to pass similar laws. As the pandemic has depressed consumers’ disposable income, a circular economy—where consumers can reuse and sell parts to, among other things, their electronic devices—may have heightened appeal. DMCA Anti-Circumvention Suits Are a Potent Tool for Hardware and Software Makers Alike Any right to repair legislation in the U.S. may be limited by the protections available to console manufacturers (as well as game developers) under the anti-circumvention provision of the Digital Millennium Copyright Act (DMCA).6 The DMCA's anti-circumvention provision prohibits the circumvention of a technology measure that 1) controls access to a copyrighted work, 2) effectively controls access to a copyrighted work, or 3) effectively protects a copyright owner's right in a copyrighted work.7 Console manufacturers have generally used the DMCA's anti-circumvention provision to stop third parties from using their consoles in unintended and unauthorized ways. Using the provision, Nintendo of America, Inc. (Nintendo) stopped sales of third-party accessories to the Nintendo Switch,8 and Sony stopped sales of modified versions of the PlayStation 4,9 which, in both instances, allowed gamers to play pirated games on the respective consoles.10 Even game developers can bring claims under the DMCA's anti-circumvention provision. For example, Blizzard brought claims to stop user-owned servers from running World of Warcraft,11 the use of "bots" that play online games on behalf of users,12 and the use of cheating tools.13 Game developers can generally avail themselves of the protections of the DMCA's provision to enforce anti-circumvention measures in another party's hardware that protects the developer from competing with pirated versions of its own games.14 As right to repair legislation is percolating in the EU and the U.S., it will be interesting to see whether the proposed bills will have any impact on the protections afforded to console manufacturers and game developers under the DMCA's anti-circumvention provision. Is Gaming Employers’ Antidote for Employee Zoom Fatigue? Consider the Side Effects Working from home has become the new norm for many employees in the U.S. Observers have reported on "Zoom fatigue"—the downside of constant video calls.15 Video calls can also deprive workplaces of a sense of community and companies of the ability to host recruits, customers, or investors. Without corporate retreats, job fairs, industry conferences, and incubators happening in person this year, companies have had to rethink how (if at all) they can produce the same end result as those in-person events through virtual means. Some traditionally physical activities have gone virtual (e.g., virtual escape rooms),16 while other traditionally virtual activities have leveled up quickly this year (e.g., video conferences complete with customizable backgrounds).17 As gaming with friends has replaced going out with friends for much of 2020, gaming has also entered the workplace. Gaming companies like Jackbox Games, Inc.18 and Treasure Mountain19 have stepped up to fill the demand from employers looking for team-bonding options while their teams remain working remotely. Company resources that planned and sponsored in-person company events have had to get creative and adaptive to further team harmony and business development efforts. For example, an advertising executive in Brooklyn reported having more success attracting a meeting with an analyst at an investment management firm by offering to play Grand Theft Auto instead of discussing potential collaboration opportunities on Zoom.20 Employers could similarly consider virtual options offered by the gaming industry to mitigate Zoom fatigue. Before expanding virtual outings to include games, employers should consider what type of information may be disclosed by employees during the games and, if any of that information may be commercially sensitive, whether the games reasonably protect the confidentiality of that information.21 Outside participants in the game or even the gaming company may be able to overhear or retain messages sent during gameplay. It may be possible to increase the level of a game's privacy though. For example, many gaming companies offer gamers the option to make their games private, and employers can take advantage of these invite-only options. Employers may also increase the security of communications by keeping them on a private chat server, such as the employer's internal instant messaging service. Still, it may make sense for participants to consider themselves out in public when discussing matters even in private games. From Gaming Disorders to Medical Devices: FDA Clears EndeavorRx™ The clinical discussion around the harmful effects of gaming is decades old.22 Many have decried the addictive nature of games: they are designed to cycle through enough "wins" or highs to keep gamers from giving up, but balanced against enough "losses" or lows to keep gamers from getting bored.23 Despite these critics, gaming is and will continue to be a popular recreation across all ages, genders, and geographies. In 2018, the World Health Organization (WHO) in its 11th Revision of the International Classification of Diseases (ICD-11), for the very first time, recognized "Gaming Disorder" as a mental health condition.24 For a diagnosis, the WHO established that there must be a behavior "pattern of persistent or recurrent gaming" in which gamers lose control of their gaming behavior, resulting in "significant impairment of personal, family, social, educational, occupational or other important areas of functioning and would normally have been evident for at least 12 months."25 In somewhat stark contrast to the WHO's recognition of gaming disorders in the last few years, in June 2020, the U.S. Food and Drug Administration (FDA) cleared, for the first time, the marketing of a game as a prescription device.26 That game, EndeavorRx™ was developed by Akili Interactive Labs Inc. (Akili) and has been proven, based on computer-based testing measurements, to generally improve "attention function" in children between the ages of 8 and 12 with inattentive or combined-type ADHD.27 The game, which was specifically engineered in collaboration with neuroscientists, uses adaptive algorithms to improve focus, multitasking, memory, goal management, planning, and organization, among other benefits. The team behind EndeavorRx™ treated its development of the game much as one would for any medical device. It performed rigorous double-blind clinical trials of its AKL-T01 device.28 It published the results of those studies earlier this year in the Lancet Digital Health,29 and it backed its systems and methods of treatment with patent protection, at least one of which was issued by the U.S. Patent and Trademark Office earlier this year.30 Being the first of its kind, Akili had to go through a more rigorous process before the FDA to establish a new regulatory pathway for devices of this type. Now that EndeavorRx™ has been approved, the FDA now has a new classification for such devices, paving the way for a quicker approval process for other games that can demonstrate "substantial equivalence" with Akili's game. At a minimum, the FDA's approval is an official acknowledgement from the medical establishment that gaming is not all bad. Gaming Companies Are Not Immune from CFIUS Review In September, the Committee on Foreign Investment in the United States (CFIUS) reportedly sent letters to League of Legends developer Riot Games, Inc. and others to “to inquire about their security protocols in handling Americans’ personal data.”31 These letters are not surprising given CFIUS’s increased activity in the last few years. U.S. gaming companies and foreign gaming companies with material U.S. operations can find themselves subject to CFIUS jurisdiction if they receive investments from foreign persons. CFIUS has jurisdiction to review a broad range of investments in which a foreign person obtains an equity interest in a U.S. business.32 A U.S. business includes a foreign company with material U.S. operations, so a non-U.S. gaming company with a U.S. subsidiary may be a U.S. business. On the investor side, a foreign person includes not only a foreign individual or foreign entity but also any U.S. entity over which a foreign person can exercise control. Even a U.S. private fund may be considered a foreign person under CFIUS regulations if certain indicia of foreign control are present.33 A foreign person’s investment into a U.S. gaming company may be subject to CFIUS’s jurisdiction if the investment could yield control by the foreign person (where control may be as little as a 10 percent stake or a board seat) or if the U.S. business involves certain technologies or access to sensitive personal data of U.S. citizens.34 For example, a U.S. gaming company (or foreign gaming company with material U.S. operations) may collect sensitive personal data of U.S. citizens in the form of geolocation data or non-public chat messages.35 CFIUS could take the view that augmented-reality games like Pokémon Go, which collect geolocation data, or games like Second Life, which primarily facilitate third-party user communications, access sensitive personal data of U.S. citizens. This may subject the developers or publishers of those games to CFIUS scrutiny or require them to make certain filings with CFIUS if the developer or publisher receives an investment from a foreign person. As gaming companies receive investments from foreign persons or even U.S. private funds with foreign investors, they should consider whether accepting those investments trigger any obligations or otherwise pose any risk for the company under CFIUS regulations. Nymwars: Gaming Identities, Real Name Requirements, and Risks Gaming is an increasingly social activity, and gamers are known to be closely attached to, and in some cases defined by, their usernames. These "aliases," "nicknames," "gamertags," "handles," or "gaming IDs," depending on the platform, are in some cases integral to a gamer's identity.36 Some gamers choose a username closely linked to their real names or meant to convey something about themselves, while others choose a name that lets them escape their everyday identity. Once a username is chosen, it can become the basis by which a gamer makes friends, joins a guild, or develops a reputation. How might things change if a gamer were required to use her legal name as her gaming username? Reportedly, China is in the midst of forcing its gamers to find out. As of September 2020, China has begun requiring that anyone playing a game in the country log in using their real name, as authenticated by a state-run authentication system.37 China premised this requirement on the need to protect minors. The regulation accompanies limits on the amount of time and money a minor can spend in a game. In the U.S., real name policies have sometimes been advocated, and in a few cases, implemented, in an effort to make platforms more pleasant communities, and to help reduce the volume of platform rule violations. But in a long string of so-called "nymwars,"38 the platforms that have instituted such policies have often relaxed or reversed them after user backlash. U.S. law does not require the use of real names for usernames, and attempts to require the use of real names by statute would likely face challenges under the First Amendment. However, gaming companies in the U.S. are free to create such a requirement for their users. Before enacting such a requirement, a company should consider some risks that might accompany such a policy. For instance, whereas a data security incident involving only pseudonymous usernames would be unlikely to qualify as a "breach" under any of the security breach notification laws that have now been enacted in all 50 states,39 an incident involving real names is much more likely to qualify, which may require expensive and time consuming notification to users and regulators. Such a policy could also make a platform a target of hackers looking for information about users, exposing the platform to additional risk. The collection and use of real names as usernames can complicate compliance with laws like the Children's Online Privacy Protection Act (COPPA) for platforms directed to children under 13. A platform that institutes such a policy might also find that well-known people are less likely to participate on the platform without anonymity, and users may be less likely to communicate with one another. Finally, companies with such policies may expose themselves to increased press and regulatory scrutiny.40 While China's law may be the most dramatic recent development in the nymwars, it is unlikely to be the last installment in this long running saga. Age-Appropriate Design for Games Accessible from the UK Online gaming has seen a huge boost in 2020. Where such games involve the collection or processing of personal data, the recent Age Appropriate Design Code (the Code) issued by the UK's data protection authority, the Information Commissioner Office (ICO), may be relevant for game developers and online gaming platform providers.41 The Code addresses how to design age-appropriate online services that are likely to be accessed by children (i.e., any individuals below the age of 18) in the UK, regardless of whether this is the main audience of the service. The Code is a first of its kind and expected to be influential in other EU jurisdictions, where regulators are also looking at publishing guidance. The Code came into force on September 2 this year and gives companies 12 months to get their compliance in order. The Code introduces 16 standards, and the key takeaways and requirements are:
In addition, companies must keep appropriate compliance documentation and make sure their privacy policies and any other information given through their games is age appropriate. Wilson Sonsini's electronic gaming practice counsels developers and publishers of multiplayer video games, streaming platforms, tournament hosts, clans, and other participants in the electronic gaming industry. If you have any questions about growing your electronic gaming business and tackling the legal challenges mentioned above, please reach out to any member of Wilson Sonsini's electronic gaming practice here for more information.
|
© 2020 Wilson Sonsini Goodrich & Rosati, Professional Corporation |
|
|
