Category: Insights

Last week, the EU Consumer Protection Cooperation Network (CPC Network) launched a coordinated enforcement action against nine video game companies in relation to the use of in-game currency.

The CPC Network is a network of national authorities responsible for enforcing EU consumer protection laws and serves as the vehicle for coordinated cross-border enforcement. Given the international nature of video games, the CPC Network elected to pursue an EU/EEA-wide enforcement approach under the CPC Regulation.

These announcements from the European Commission and the CPC Network mark the next phase in the tussle between regulators and the video game industry over what consumer law compliance should look like for in-game currencies. A spate of press releases from national consumer authorities also echoed the announcements with some stern words from officials (including Ireland, Sweden, and the Netherlands).

The CPC Principles

These enforcement actions relate to the CPC Network’s “Key Principles on In-game Virtual Currencies” (Principles), published in March 2025. The CPC Network takes the position that premium in-game currency (i.e. currency purchased with real-world money) obscures the real value of in-game content and is a mechanism through which companies try to deny certain mandatory consumer rights. Core to the CPC Network’s argument is that premium in-game currency constitutes a “digital representation of value”. If a consumer spends that premium in-game currency, the consumer should be entitled to the same protections which arise when real-world money is spent, including pre-contractual information rights and 14-day withdrawal rights. However, there are serious and growing concerns in industry about whether the Principles apply the underlying consumer protection laws correctly. If you are interested in further detail on this, you can also read our article on the CJEU Runescape Gold case here.

Briefly, the actions seek to ensure the following are applied from the Principles:

• Real-world pricing: real-world prices must be displayed for in-game items and in-game currencies.
• Obscuring costs: game companies should not implement multiple types of in-game currencies or exchange pathways that obscure the true cost of in-game items.
• Forced spend: players should not feel obligated to buy an unnecessary amount of in-game currency in order to progress or enjoy the game.
• Clear pre-contract information: players should be presented with clear pre-contract information concerning their purchase before the transaction for their in-game items or in-game currencies is completed.
• Withdrawal rights: players must be told about their 14-day withdrawal rights prior to purchase, which includes their right to withdraw in respect of unused in-game currency.
• Transparent terms: the terms and conditions governing in-game currency must be fair and transparent as required under consumer law.
• Vulnerable consumers: vulnerable players are afforded a greater degree of protection under consumer law, and so appropriate safeguards should be put in place, particularly for children.

Interestingly, the CPC Network appears to be treating compliance with the Principles (which are not law) as mandatory, given that the enforcement actions are specifically directed at enforcing them.

Disappointingly, the Principles have not been amended since their publication in March 2025, suggesting that stakeholder dialogue was not as productive as it could have been. The European Commission notes this, saying “As the dialogue did not bring satisfactory results, the Network proceeded with a market check and identified several games, which would require further assessment”.

In addition to enforcement of the Principles, the CPC Network is also taking action on broader issues including personal data collection, addictive game design, parental control settings, direct marketing to children, and the blocking of gaming accounts. Its Joint Statement also signals particular attention on variable reward systems (e.g. loot boxes) and dark patterns.

Key takeaways

• These actions are part of the already intensifying regulatory scrutiny of the video game industry across Europe, particularly on in-game transactions, in-game currencies and the protection of vulnerable users.
  
• Given the ongoing debate about the legal basis for the Principles, some in the industry had been waiting for the outcome of the stakeholder dialogue before committing to compliance roadmaps. That dialogue has not led to a resolution, and the CPC Network is proceeding to enforcement.
  
• The CPC Network is treating the Principles as requiring mandatory compliance and calling on all video game companies (not just those named in the coordinated actions) to review their practices and ensure compliance. However, this is not accompanied with any further guidance on how compliance with the Principles can be achieved in the real world, given that a literal interpretation of some of them (such as the requirement to provide pre-contractual information and post contract purchase confirmations for each in-game item purchase) would be unworkable in practice, not to mention deeply undesirable for consumers.
  
• We expect more clarity to flow out of these enforcement actions. Until then, the prudent approach for studios and publishers is to review their practices in respect of in-game currencies, and consider how closely they can align with the Principles without fundamentally breaking the game.

On 7 September 2026, Ofcom published guidance directed at parents of children who play online video games.

According to Ofcom’s research, most parents impose some form of restriction on their children’s gaming habits, however many remain concerned about online safety issues. These concerns principally relate to their children interacting with unknown players, encountering violent or otherwise age-inappropriate material and being on the receiving end of in-game abuse or ‘trolling’.

What is Ofcom asking parents to do?

At its core, the guidance encourages parents to take steps in three stages: review the safety settings currently configured on their children’s gaming devices and accounts; have regular conversations with their children about their online gaming habits; and update parental controls in light of what they find.

Interestingly, Ofcom urges parents to verify that the correct date of birth is registered on their child’s accounts. This is important because the UK Online Safety Act’s (“OSA”) requirement to use highly effective age assurance (meaning ID matching, open banking etc.) does not generally extend to mainstream gaming services. This obligation can only trigger where a regulated provider permits “primary priority content” on its service (such as pornographic or suicide-related content), which most gaming platforms do not. In the absence of that obligation, Ofcom is asking parents to step in and ensure a false date of birth has not been used, which is a well-known shortcoming of relying on self-declared age.

Where a player’s true age is reflected on their account, platforms will usually tailor the experience accordingly. For instance, by gating certain social or communication features, disabling loot boxes or filtering out age-inappropriate content such as 18-rated titles.  Ofcom also reminds parents that there is a breadth of parental controls available to them. These include the ability to restrict friend requests and messaging, limit playtime and in-game spend, and adjust privacy controls.

In short, Ofcom is encouraging parents to take a proactive approach in order to help foster a safe online environment for their children. This will be welcomed by the industry, as it signals some recognition by the regulator that responsibility for children’s online safety does not rest solely with platforms, and that parents, too, have a role to play in managing their children’s gaming experiences.

Growing regulatory scrutiny

This guidance arrives at a time when the UK Government is pursuing further legislative measures to protect children in online gaming. As we reported on here in June this year, the Government has announced plans to restrict high-risk features, including the ability for strangers to contact under 16s. For 16 to 17 year olds, that feature is to be switched off by default. Draft regulations are expected before the end of this year, with implementation from Spring 2027.

Separately, on 28 August 2026, Ofcom issued an open letter to all in-scope service providers, emphasising that existing obligations under the OSA remain fully in force even in light of the Government’s announced reforms. The letter makes clear that Ofcom expects compliance with current illegal content and children’s safety duties, stating it will “not hesitate to take enforcement action if services fail to comply with their existing safety duties.”

What does this mean for studios and publishers?

The new parental guidance is a signal that gaming is moving up Ofcom’s agenda. To date, the regulator’s enforcement activity under the OSA has generally concentrated on higher risk services (such as pornography services, suicide forums, social media and file sharing services) and on the deployment of highly effective age verification. This latest publication suggests that the games sector is increasingly in Ofcom’s sights.

Video game companies should ensure they have assessed whether they are in scope of the OSA. Typical features which bring games services in scope include in-game chat, usernames, player profiles, leaderboards, guilds, clans and discussion forums. In its guidance for online video games, Ofcom adopts a broad interpretation of the OSA’s scope, confirming that manipulation of player profiles, avatars, objects, and the environments themselves, are forms of regulated user-generated content.

Companies that are in scope should be: completing or updating their risk assessments and child access assessments; ensuring they have implemented (and recorded in writing) the safety measures set out in Ofcom’s Codes of Practice (or demonstrating that their alternative measures meet the required standards); and complying with other OSA obligations, such as reporting CSEA content.

Companies that are in scope of the OSA should also consider whether their services fall within the scope of the EU Digital Services Act (“DSA”), and in particular, whether they might constitute a hosting service or an online platform. Where they are in scope, there are opportunities to align compliance across these regimes. For example, by using data from DSA Transparency Reports to feed into OSA risk assessments, or by building a content reporting tool that satisfies the requirements of both the DSA and Ofcom’s Codes of Practice.

Platforms that have not already done so may also wish to consider how they can deliver tailored age-appropriate experiences (as opposed to uniform experiences across the userbase).

Finally, while these are relatively new legal frameworks and there remains room for interpretation in how these obligations apply to games services, companies should resist the temptation to wait for greater clarity before acting. Regulators expect to see evidence of genuine, documented compliance efforts. Having a record of the steps taken will place companies in a stronger position if or when Ofcom makes contact.

The legal debate over the characterisation of in-game currency has continued for some time now. What happens when it lands in the EU’s highest court?

This article dives into the CJEU’s 2026 ruling in Žaidimų Valiuta (C-472/24), in which the CJEU held that Runescape Gold is neither a virtual currency nor a voucher for VAT purposes. It also asks what that means for the ongoing regulatory battle over premium in-game currencies.

The origin story

The in-game currency debate kicked off in 2024, when BEUC [¹] filed a complaint to the European Commission, and continued into 2025 when the CPC Network [²] published its “Key Principles on In-game Virtual Currencies”. Both publications take aim at the industry’s use of premium in-game currency (i.e. currency purchased with real-world money). BEUC and the CPC Network argued that premium in-game currency obscures the real value of in-game content and denies certain consumer rights. Going further, they contend that in-game currency is a “digital representation of value”. In other words, a direct proxy for real-world money. If correct, consumer law obligations and contract formation would not simply be triggered when a player first purchases a bundle of gems with real money, but at all subsequent exchanges of those gems for in-game content.

The European Commission’s 2024 Digital Fairness Fitness Check echoed BEUC and the CPC Network’s concerns. The upcoming Digital Fairness Act (DFA) looks set to codify the Commission’s proposed solution into law. A first draft is not expected until later on in 2026, but the DFA consultation hints at what might be coming, including a requirement for real-world money pricing being displayed alongside in-game currency prices.

The industry response

The industry responded swiftly and robustly. The key counterargument is that in-game currency is not a financial instrument. Rather, it is content which is part of the game, the purpose of which is to enhance the player experience. On that basis, it is difficult to see how a player exchanging gems for in-game content is concluding a new consumer contract; they are simply exchanging one category of digital content for another.

The practical consequences of the alternative view would be seismic. Developers would need to build features to display an array of pre-contractual information (including real-world prices – which would first need to be calculated in real-time and in the correct currency); players would need to accept each contract, waive their digital content withdrawal rights, and receive a copy of the ‘contract’ electronically. Indeed, there may not even be a single determinable “real price” for in-game currency, given, for example, it can usually be purchased through different retail channels at different price points. In-game item exchanges, which are supposed to integrate seamlessly into the gameplay experience, would become a disruptive chore. Moreover, treating in-game item exchanges in this way seems legally flawed.

In-game currency in the EU courts

While stakeholder conversations continue behind closed doors, the in-game currency debate has entered EU courtrooms. In March 2026, the CJEU held in Žaidimų Valiuta (ZV) (C-472/24) that Runescape Gold was neither a virtual currency nor a voucher for VAT purposes.

Runescape Gold can be acquired with real-world money indirectly via a ‘Bond’ purchased from the developer, Jagex. ZV bought and sold Runescape Gold via third party platforms in exchange for real-world money (notably, in breach of Jagex’s Terms of Service). The Lithuanian tax authority found that ZV had not declared or paid VAT on those transactions, and ordered that ZV pay the outstanding VAT, plus interest and a fine. Legal proceedings were commenced, and questions over the characterisation of in-game currency were ultimately referred to the CJEU.

Runescape Gold as a virtual currency?

ZV first argued that Runescape Gold is a virtual currency, so its sale should be VAT-exempt under the exemption covering currency, bank notes and coins used as legal tender. ZV referred to the CJEU’s ruling in Hedqvist (C-264/14), where the CJEU held that exchanging Bitcoin for traditional currencies was VAT-exempt because Bitcoin functioned as a “non-traditional currency”. This was because the Bitcoin satisfied the following criteria: (i) it was accepted by the parties as an alternative to legal tender; and (ii) it had no purpose other than to be a means of payment. In essence, it was a financial transaction. ZV argued that Runescape Gold was analogous to Bitcoin in that sense.

The CJEU disagreed, finding that Runescape Gold failed both Hedqvist conditions. It held that Runescape Gold had no purpose other than to be used within the game. That in-game purpose prevented it from constituting a currency that could be accepted as payment for goods or services. The fact that players do not own the Runescape Gold under Jagex’s Terms of Service further reinforced that conclusion.

Runescape Gold as a voucher?

ZV then argued that the Runescape Gold should be classified as a “multi-purpose voucher”, for which VAT is only charged at the point of redemption. Two conditions needed to be met: (i) there must be an obligation to accept the instrument as consideration for a supply of goods or services; and (ii) the goods or services to be supplied must be on the instrument or in related documentation (such as terms and conditions).

Again, the CJEU disagreed. It held that Runescape Gold was not a voucher because it failed to meet the first condition. A voucher serves to procure a further consumable benefit (a good or service). Runescape Gold does not work in this way. When a player spends Runescape Gold on weapons, armour or consumables, they are not exchanging it for a separate service. Rather, the player is engaging directly with the game service itself.

Where does this leave us?

The CJEU in this case found that Runescape Gold was not a “virtual currency” (and therefore there was not a financial transaction) under VAT law because it only serves an in-game purpose.

On the face of it, this outcome appears to conflict with the CPC Network’s position that premium in-game currencies are a “digital representation of value”. On the contrary, the CJEU’s characterisation of Runescape Gold as an electronic service seems to align with the industry’s position that an in-game currency is digital content which is part of the gaming experience.  

The correct characterisation of in-game currencies by regulators is critical to the industry and consumers. As noted above, the CPC Network’s interpretation would create significant practical compliance considerations for many in the industry. The CJEU case points in a helpful direction for industry, but it does not conclude the debate.

This was, of course, a VAT-specific case. The CJEU did not rule on the categorisation of in-game currency under consumer law, and so ambiguity remains. It does, however, illustrate the difficulties of adopting a blanket approach which treats in-game item exchanges as financial transactions, and the unintended and far-reaching consequences that this could lead to in multiple areas of the law. It also suggests that a more nuanced approach to both soft and hard legislation, which takes into account the specificities of the video games industry, would be more appropriate.

1. The Bureau Européen des Unions de Consommateurs, an umbrella body representing consumer organisations across EU member states. ↩︎
2. The Consumer Protection Cooperation Network, a network of national authorities responsible for enforcing EU consumer protection laws. ↩︎