You're 20 years old, you play FIFA every day, and you've spent about $340 on packs this year. You didn't plan to. Each purchase felt small — $4.99 here, $9.99 there — and each time EA's algorithm had just served you a near-miss: a gold flash where Messi almost appeared, then didn't. The AI tracked your session length, your frustration signals (rapid button presses after losses), and your spending history. It knew, statistically, the exact moment you were most likely to convert.
In 2023, EA's internal documents, exposed during a Federal Trade Commission inquiry, confirmed that Ultimate Team's pack system used behavioral telemetry to optimize "engagement" — a word that in this context meant spending. The Belgian Gaming Commission had already banned FIFA loot boxes in 2018, calling them gambling under Belgian law. EA pulled the feature from Belgium and the Netherlands. Everyone else kept paying.
The thing is: the system wasn't broken. It was working exactly as designed. That's what makes it an ethics question, not a bug report.
Modern game monetization doesn't rely on you deciding to spend money. It relies on constructing conditions where spending feels like the natural next step. AI is central to this — not as science fiction but as production-grade recommendation and behavioral prediction systems running in the background of games you play right now.
The core mechanism is what behavioral economists call variable ratio reinforcement — the same psychology behind slot machines. You don't know when the reward is coming, which makes you pull the lever more often than if rewards were predictable. Games have used this since the 1980s. What changed in the 2010s was the addition of AI personalization: the ratio isn't fixed anymore. It's tuned to you specifically, based on your spending history, your session patterns, your emotional state inferred from gameplay behavior.
EA, Activision, and 2K have all filed patents describing systems that adjust matchmaking, reward timing, and in-game offers based on player behavioral profiles. These aren't theoretical — they're the playbooks behind the games already on your console.
In 2017, Activision patented a system (US10279260B2) that would match newer players against highly-skilled players who use expensive cosmetic items — explicitly to drive purchase interest in those items. Activision stated the patent was never implemented in a shipped game, but the design intent is instructive: matchmaking as advertisement delivery.
The free-to-play business model has a dirty secret: roughly 1–2% of players — called "whales" in industry language — generate 80% or more of revenue. AI systems are specifically optimized to identify potential whales early in their play history and funnel them toward high-spend pathways before they know what's happening.
This is where personalized pricing enters. Some games — particularly mobile titles like Genshin Impact competitors and certain casino-adjacent apps — have tested systems that show different prices to different players based on inferred spending capacity. A player whose session data suggests disposable income (longer sessions on newer hardware, faster click responses indicating less price deliberation) might see higher price anchors for the same bundles.
This isn't disclosed. There's no terms of service clause that says "we infer your income and price accordingly." Players often don't know it's happening — which is precisely the ethical problem. Personalization without transparency converts into a form of price discrimination that would be controversial in any other consumer context.
For context: airlines do price discrimination openly, and it's still controversial. Games do it covertly, to teenagers and college students with developing impulse regulation, and it's called "dynamic offers."
A 2023 survey by the UK Gambling Commission found that 39% of 11–24 year olds who had purchased loot boxes reported feeling like they "had to" keep buying to stay competitive. Among those who spent over £100 in a year on loot boxes, 68% said the purchases felt compulsive rather than chosen. You're not weak if this has happened to you — you're the target of systems built by behavioral scientists and AI engineers specifically to produce that feeling.
The legal landscape around AI-driven game monetization is genuinely fragmented, and that matters if you're planning a career in game development — because what's legal today in one market may expose your studio to liability next year in another.
Belgium and Netherlands: Banned loot boxes as gambling in 2018. EA, Blizzard, and 2K either modified or pulled products from these markets. Belgium's position: if items of value can be obtained randomly via payment, it's gambling regardless of whether those items can be cashed out.
UK (2023): The UK Gambling Commission concluded loot boxes aren't technically gambling under current law, but recommended age restrictions and mandatory disclosure of odds. The government opened a voluntary code of practice with major publishers.
United States: No federal loot box legislation as of 2024. The FTC has investigated but not regulated. Individual states have introduced bills (Washington, Hawaii, Minnesota) that have mostly stalled.
South Korea: Mandates disclosure of loot box odds since 2015 — one of the earliest regulations globally. Apple and Google App Stores require odds disclosure in South Korea as a condition of distribution.
If you're building games that will ship internationally, you need to design your monetization systems for the most restrictive market you're targeting — or build regional compliance into your architecture from the start. "We'll figure it out when we get there" is how studios get pulled from markets at launch.
Let's be direct: you're simultaneously a consumer of these systems and a future creator of them. Both roles require practical tools.
As a player: Set a monthly hard cap in your payment method's settings — most major banks and Apple/Google Pay allow per-merchant spending limits. Turn off "saved payment methods" in game stores. The 30-second friction of re-entering card details kills a significant portion of impulse purchases. Check whether your game discloses loot box odds (required in some markets) — if it doesn't, treat every pack as a slot machine pull with unknown odds.
As a future developer: The most trusted game studios in the industry right now — CD Projekt Red, FromSoftware, Larian Studios — have built loyal audiences partly by not deploying predatory monetization. Player trust is a long-term asset. A $5 cosmetic DLC with transparent pricing generates less revenue per transaction than a loot box system, but it doesn't generate regulatory scrutiny, Reddit boycotts, or the 20% player trust erosion that follows a monetization scandal.
There's also a personal ethics position to stake out early: if you join a studio and you're asked to tune AI systems toward more psychologically manipulative monetization, what's your answer? Plenty of junior developers have done that work because it felt abstract or because they needed the job. Knowing where your line is before you're in the room is the only way to hold it when you're in the room.
Before your next in-game purchase: pause for 60 seconds and ask whether you were about to buy something you'd been thinking about for days, or whether you were responding to an in-game trigger (a near-miss, a "limited time" countdown, a big win). The trigger-response pattern is manufactured. The 60-second pause breaks it. This is not willpower advice — it's systems literacy.
You've been hired by a hypothetical player advocacy nonprofit to audit the AI-driven monetization of a major game. Your AI partner — an experienced game industry analyst — will challenge your reasoning and push you toward specific, defensible conclusions.
Pick any game with in-game purchases (FIFA, Fortnite, Genshin Impact, Call of Duty, Apex Legends, any mobile game) and conduct an ethics audit. What AI mechanisms are likely at work? What specific harms are they creating? What would a defensible, player-respecting version look like?
It's the final lap of Mario Kart 8 Deluxe. You're in 8th place. Suddenly a blue shell hits first place, you get a triple red shell item, and somehow you win. It feels incredible. It also wasn't a coincidence — Nintendo's AI explicitly gives trailing players better items to maintain competitive races. This is called rubberbanding, and it's been in Mario Kart since the original SNES game in 1992.
In 2023, a viral Reddit thread on r/gamedesign asked whether rubberbanding is "cheating." 4,000 comments later, the consensus was: it depends entirely on whether you disclose it. Nintendo never hides that items are randomized to favor balance — that's part of Mario Kart's identity as a chaotic party game. But when the same mechanic appears in a competitive ranked mode, or in a single-player game without disclosure, it raises a different question: are you measuring real skill, or are you measuring skill after the AI has adjusted reality around you?
The disclosure question matters because players make real decisions based on their perception of their own skill level — career decisions, tournament entry decisions, hours invested in grinding ranked. When the game is secretly adjusting difficulty, those self-assessments are based on false data.
Not all AI difficulty manipulation is the same. There's a spectrum from transparent and player-serving to covert and potentially harmful, and the ethical distinction isn't "does the AI adjust" — it's "does the player know and consent."
Transparent scaling: Games like Celeste and Hades have extensive built-in accessibility options — players explicitly choose a slower projectile speed or invincibility mode. The player is in control. This is widely considered exemplary design.
Disclosed adaptive difficulty: Some games — Resident Evil 4's original 2005 release, for instance — disclose that the game adjusts difficulty based on performance. Players know the rule is in play. They can engage with that knowledge or not.
Undisclosed adaptive AI: The more common commercial approach. Games track player death rates, win/loss streaks, and session frustration signals (measured by controller input patterns), then silently adjust enemy behavior, health values, or item drop rates. Players experience this as "I'm getting better" or "this enemy is tough today" without knowing that the AI has moved the goalposts.
Adversarial AI manipulation: The most troubling end of the spectrum — when AI adjusts difficulty specifically to push players toward in-game purchases. "Hit a frustration wall, then see an offer for a power boost" is not difficulty design. It's a conversion funnel wearing game design as a costume.
Here's the flip side: while games sometimes secretly make things easier for you, they're also deploying AI to surveil your behavior to catch cheaters. Anti-cheat systems like Riot's Vanguard (kernel-level on your PC) and Valve's VAC operate at a level of system access that would be called spyware if it appeared in any other context.
Vanguard runs at system startup, operates at ring-0 (the highest OS privilege level), and monitors processes across your entire machine — not just while the game is running. Riot has defended this as necessary to catch sophisticated cheating software, which also operates at kernel level. The trade-off is real: shallow anti-cheat systems are easy to circumvent, and cheating ruins multiplayer games for everyone.
But there's a consent and transparency problem. Most players who install Valorant don't understand what Vanguard is actually doing on their system. They click "I agree" on a terms of service that buries the kernel-level access in legal language. "Informed consent" requires that the person actually understands what they're consenting to — clicking past a wall of legal text doesn't meet that bar in any meaningful sense.
In 2022, privacy researchers found that Vanguard's telemetry data collection included hardware identifiers that persisted even after the game was uninstalled, allowing Riot to hardware-ban cheaters across reinstalls. Legitimate use case — but also a tracking mechanism that persists on your machine beyond the scope of gameplay. Players weren't told this explicitly.
AI anti-cheat systems trained on behavioral data will produce false positives — players whose legitimate play patterns look statistically similar to cheating. High-level FPS players with extremely fast reaction times have been falsely banned by AI anti-cheat in Counter-Strike, Overwatch, and Warzone. The appeals process at most studios is opaque, slow, or non-existent. If you're good enough at a game that your skill looks "impossible" to the AI, you can lose years of account progress with no meaningful recourse.
Competitive games use AI matchmaking systems (MMR, Glicko, TrueSkill) that supposedly represent your skill level. Millions of players take these numbers seriously — they set goals around them, measure their improvement, and in competitive communities, these ratings function like grades or performance reviews. Some streaming careers are built on "climbing the ranked ladder."
What most players don't know: ranked systems have multiple objectives that aren't about accurate skill measurement. They're also optimized for player retention. Keeping players near 50% win rate — regardless of actual skill trajectory — maximizes session length and return rate. This means the algorithm may be deliberately preventing you from reaching your "true" rating to keep you engaged longer.
Riot's ranked team has discussed publicly that League of Legends' matchmaking has "loss streaks" mechanics — periods where the system will place you in slightly more difficult matches to create dramatic win streak recovery narratives. This is disclosed in blog posts, but not in the game client where most players interact with their rank.
The ethical question: when millions of players treat a number as meaningful feedback about their actual skill development, and that number is secretly optimized for retention rather than accuracy, what's the harm? The harm is epistemic — players are developing false beliefs about their own skill. That's not a minor game design choice; it's a manipulation of self-knowledge at scale.
A lot of people around you are treating their ranked rating in competitive games as meaningful self-assessment data — grinding to hit a specific rank because they think it reflects real skill. It might. It might also be a retention-optimized number designed to keep you playing regardless of improvement. Before you invest 200 more hours chasing Platinum, ask whether the number you're chasing is measuring what you think it's measuring.
If you're heading into game development, you're going to be asked to make these systems. DDA is a real and valuable design tool — it genuinely makes games more accessible, reduces frustration drop-off, and keeps more players in the experience longer. The ethical line isn't "never use it." It's "disclose it when it matters."
The disclosure test: If players knew exactly how your AI was adjusting the game around them, would they feel helped or deceived? That question doesn't have a universal answer — it depends on the game's social contract with its players. Mario Kart players expect chaos and balance. Competitive FPS players expect unmodified skill expression. Dating either system to the wrong game type breaks player trust.
The power-up-to-purchase pipeline: If your DDA system's adjustment thresholds are tuned to create frustration states that are then resolved by in-game purchases, you've crossed from design into manipulation. This combination is what regulators are starting to look for, and it's the version that will eventually produce legislation.
Practical step: Add a "how this works" section to any adaptive difficulty system you build. Make it findable in the settings or help menu. Players who don't want to know don't have to read it. Players who do want to know can make informed choices. Transparency like this costs almost nothing and produces significant trust dividends over time.
You're designing the dynamic difficulty adjustment system for a new single-player action RPG. Your AI partner is a design lead who's seen every ethical misstep in the industry — they'll push you to make specific, defensible design decisions rather than vague principles.
Your challenge: design a DDA system that improves player experience without generating false skill signals, and that players can trust. You'll need to take real positions on what to disclose, how to adjust, and where the line is between assistance and manipulation.
In 2020, modders and players analyzing the Call of Duty: Warzone character customization system noticed something: the AI face generation tools, used to create operator character variants, systematically produced lighter-skinned faces as the baseline "neutral" result. Darker skin tones required more specific customization inputs to produce accurately. This wasn't malicious — it was the predictable output of a generative model trained primarily on faces that were over-represented in stock photography and existing game character databases: younger, lighter-skinned, predominantly Western.
The same issue appeared in Cyberpunk 2077's character creator (2020), where reviewers noted that certain features common in East Asian and Black faces required players to combine sliders in non-obvious ways, while "default" settings tended toward a narrow Western European template. CD Projekt Red issued a patch update in 2021 that improved representation in preset options.
Neither studio set out to build a biased system. They set out to build a face generator. The bias was in the data. And the data was in the world before it was in the model — which is both an explanation and, if you leave it there, an excuse.
AI bias in games isn't primarily a programming problem. It's a data problem that shows up as a product problem. Understanding the pipeline helps you intervene at the right point.
Training data bias: If a procedural NPC generator is trained on existing game characters (which have historically skewed toward white male protagonists), it will produce more of the same by default. The model learned from biased source material and encoded that bias as "normal."
Annotation bias: Many AI systems use human-labeled data. If the labelers share demographic characteristics (which is common in the US-centric tech industry), their labeling choices will reflect their cultural context. A system trained to detect "aggressive" body language in player avatars might encode culturally specific interpretations of movement.
Evaluation bias: Testing a face generator against metrics like "visual quality" is meaningless if the evaluators who judge quality come from a narrow demographic. What looks "natural" or "realistic" is itself a culturally contingent judgment.
The compounding problem: these three bias types stack. Biased training data gets biased labels from biased evaluators, and the resulting model is validated by developers who might not see the problem because it doesn't show up in their own faces.
Multiplayer games face a genuine moderation problem at scale: millions of chat messages per day, voice comms, user-generated content, forum posts. Human moderation at that scale is expensive and slow. AI content moderation is the practical answer — but it carries significant equity problems that affect who gets to participate in gaming communities.
Profanity and toxicity detection systems are typically trained on labeled data that reflects majority-culture speech patterns. This creates predictable failures: AAVE (African American Vernacular English) phrases that are reclaimed or community-specific get flagged as toxic at higher rates than equivalent expressions in Standard American English. Spanish slang gets flagged more aggressively than English equivalents. In-community language that feels hostile to outsiders (but is normal within a specific group) gets moderated out.
The result: players from marginalized communities face higher moderation rates for equivalent speech, creating a chilling effect on participation. They self-censor more, report worse community experiences, and disproportionately leave games where the moderation AI reads them as the problem.
A 2021 study by the Anti-Defamation League found that 65% of LGBTQ+ players, 59% of Hispanic players, and 58% of Black players reported harassment in online games in the previous six months. When the moderation AI fails to catch targeted harassment (which often uses coded language that doesn't trigger keyword filters) but does catch in-group speech from those same communities, the system is protecting harassers and penalizing targets.
Harassment in gaming communities has become sophisticated enough to evade keyword-based AI detection — using numbers, misspellings, dog whistles, and context-dependent insults that read as benign to an AI trained on explicit slurs. Meanwhile, reclaimed language used within the targeted community gets flagged by the same systems. This is not a coincidence — it's the predictable output of a system trained on explicit text rather than context and power dynamics.
Procedural generation — using AI to generate game worlds, characters, dialogue, and content at scale — is increasingly central to AAA game development. It's also a bias amplifier, because bias embedded in generation parameters gets applied millions of times.
Consider NPC crowds in open-world games. If the procedural generator for NPC appearance has a random distribution that happens to produce 80% male characters by default (because the character asset library was 80% male), every crowd in the game reflects that skew. Multiply by thousands of NPCs across a 40-hour game, and the cumulative message to players is: this world is mostly men. Not because any designer chose that — because a distribution parameter was never interrogated.
The same applies to procedurally generated character backstories, dialogue patterns, name generation, occupation assignment, and relationship structures. Each unexamined default is a small statement about what "normal" looks like, and procedural generation scales those statements into the texture of entire game worlds.
Some studios have started implementing "inclusion riders" for AI generation systems — explicit constraints that require procedural outputs to meet demographic representation targets. It's not a perfect solution (representation isn't just counting characters), but it addresses the most obvious form of omission bias.
If you go into game development, you will work on systems that make implicit decisions about who exists, who is "normal," and whose speech is acceptable. Those decisions are currently being made by default — through unexamined training data and untested assumptions. Being the person who asks "whose face does our face generator default to?" or "have we tested our moderation AI against AAVE?" is not being difficult. It's doing the job correctly. Studios that miss this are increasingly getting called out publicly — and the ones that do it well are building reputations that attract better talent and better players.
Talking about AI bias without practical interventions is just guilt-tripping. Here's what actually moves the needle:
Diverse training data, intentionally sourced: The face generator that defaults to light skin does so because the training data was unbalanced. Building balanced datasets requires intentional effort — specifically seeking out underrepresented visual references, not just scraping whatever's most available online.
Bias audits before ship: Any AI system that makes decisions about player content, representation, or community access should be audited against demographic test sets before release. This means deliberately testing whether the face generator handles all skin tones accurately, whether the moderation AI has equivalent false positive rates across language varieties, whether procedural generation produces balanced outputs.
Disaggregated metrics: Reporting average performance of an AI system can mask terrible performance on specific demographic subgroups. An AI that's 90% accurate overall but 60% accurate for a specific group is not a 90% AI for those players. Requiring disaggregated metrics in your QA process forces the problem to be visible.
Community feedback loops: Players from affected communities will find bias problems before internal testers do, because they experience the system from inside the demographic it's failing. Building formal feedback channels specifically for representation issues — and actually responding to them — is both ethical practice and good product development.
It's three weeks before a major open-world RPG ships. You're leading a bias audit on two AI systems: the procedural NPC generator and the AI content moderation system. Your AI partner is a technical ethics consultant who will help you design specific test cases and interpret what you find.
You need to produce an audit protocol — specific tests, metrics, and pass/fail criteria — that the team can actually run in three weeks. Generic recommendations won't fly; the team needs actionable specifics.
In 2019, EA published a patent application for Project Atlas, a cloud gaming infrastructure that would enable real-time behavioral data collection at a scale previously impossible. The system would track not just what players did in games, but how they moved — controller micro-tremors suggesting frustration, pause patterns indicating confusion, reaction time distributions that could distinguish emotional states. EA described this as improving player experience. Critics described it as building psychological profiles of millions of players without their meaningful knowledge.
The same year, Epic Games updated its EULA for Fortnite to include language permitting data sharing with "business partners" and "advertisers" based on gameplay behavioral data. The update was buried in a routine terms of service change. The average reading level of these documents is post-graduate. The average age of Fortnite's player base at the time was 13.
You're probably past 13 now. But you're still accepting terms of service for games that collect behavioral data that would be commercially valuable in ways the documents don't fully disclose — and using it to build AI models that will outlast your relationship with the game by years.
The gap between what players think games collect and what games actually collect is substantial. Most players assume game telemetry means "crash reports and aggregate play statistics." In reality, modern games collect a behavioral dataset that rivals what social media platforms accumulate.
Session-level data: When you log in and out, how long each session lasts, at what points you quit (death? cutscene? purchase screen?), and how session length correlates with time of day, day of week, and recent in-game events.
Micro-behavioral data: Button press timing, joystick movement patterns, menu navigation paths, the sequence of options you review before making decisions. These patterns are surprisingly revealing — psychologists have demonstrated that decision-making speed and navigation patterns correlate with personality dimensions and emotional states.
Social graph data: Who you play with, how those relationships change over time, who you stop playing with and when, voice communication patterns in games with voice chat.
Biometric proxies: Not direct biometrics (yet, mostly), but behavioral signals that serve as proxies — the correlation between loss streaks and subsequent in-game behavior reliably indicates frustration. The pattern of rage-quitting is a recognized emotional signal. Some mobile games have requested camera access specifically to run facial expression analysis during gameplay.
Game behavioral data has three primary commercial uses, only one of which is directly related to improving your experience.
Product improvement: The legitimate use. Understanding where players get stuck, where they disengage, what creates frustration versus flow — this feedback genuinely improves game design. This use case is mostly defensible and is what most players assume when they accept telemetry collection.
Monetization optimization: Using behavioral profiles to tune when and how monetization systems present offers, adjust prices, or create conditions likely to convert to purchase. Discussed in Lesson 1. This use case is about serving the studio's revenue objectives, not the player's experience — and the two often conflict.
Third-party data sales and partnerships: The least visible use. Several major publishers have data partnership agreements with advertising technology firms, market research companies, and in some cases, insurers and financial services companies. Gaming behavioral data — which captures decision-making patterns, risk tolerance, emotional responses, and social behaviors at fine-grained resolution — is commercially valuable far beyond the games industry.
The last category is where things get genuinely unsettling. A behavioral profile derived from your gaming sessions could be used to predict credit risk, insurance risk, or employment suitability — none of which is disclosed in the game's ToS in any transparent way. This is speculative about current practice in games specifically, but it's established practice in mobile apps and data brokers who purchase gaming data.
The EU's General Data Protection Regulation (2018) requires explicit consent for data collection, the right to access your data, the right to deletion, and data minimization principles (collect only what's necessary). In practice: major studios have GDPR-compliant data processes for EU users and often apply those standards globally as a cost-efficiency measure. If you're in the EU, you can request your data from any major publisher under GDPR. The resulting files are often hundreds of megabytes — which is itself informative about the scope of collection. In the US, CCPA (California Consumer Privacy Act) provides similar but weaker rights for California residents.
Here's the core structural problem with gaming data ethics: the mechanism theoretically providing consent — the terms of service agreement — is functionally broken as a consent instrument.
A 2019 study from Carnegie Mellon University estimated that reading all the privacy policies a typical American encounters in a year would take 76 eight-hour work days. Game ToS documents are not outliers — they're lengthy, written in legal language, and presented at the point of maximum friction to reading: when you just want to play the game. The "I agree" button is therefore not a meaningful consent signal. It's a liability shield for the publisher and a click to get past for the player.
Some regulators are starting to treat this seriously. The UK's Information Commissioner's Office has indicated that consent obtained through buried, complex ToS documents may not meet GDPR's "freely given, specific, informed, and unambiguous" consent standard. Several pending EU enforcement actions target game publishers specifically.
The "we told you in the ToS" defense is increasingly legally vulnerable — and ethically, it never held up. Burying disclosure in unreadable documents and then claiming consent was given is consent theater, not consent. The gaming industry's data practices are operating on borrowed time from a regulatory standpoint.
Most people your age think about privacy primarily in terms of social media — what photos are public, who can see your posts. Gaming data gets almost no attention despite being equally detailed and more behaviorally revealing. Your controller micro-tremors and decision-making speed during a gaming session reveal more about your psychological state than most things you'd voluntarily share online. The invisibility of this data collection is by design — behavioral surveillance is most effective when it's not noticed.
Individual action and systemic change are both necessary — and they require different strategies. Let's be clear about which is which.
What you can do as a player right now: Request your data under GDPR (if in EU) or CCPA (if in California) from any major publisher. The resulting files are educational about the scope of collection. Check your game platform settings for analytics and data sharing toggles — most have them, few people find them. Read the privacy policy section specifically — not the full ToS, just the privacy policy — before installing new games. It's shorter and more relevant than you expect.
What you can do if you build games: Apply data minimization — collect only what you actually use for product improvement, delete it on a defined schedule, and don't retain behavioral surplus "because it might be useful someday." Build transparent data dashboards so players can see what's collected and delete it without contacting support. Treat GDPR standards as your baseline globally, not just in EU markets where compliance is legally required.
What requires systemic change: Fixing the consent theater problem requires regulatory intervention — probably a simplified "nutrition label" style disclosure requirement for data collection, and enforceable data minimization standards with actual teeth. Individual choices can protect you partially, but the data collection regime in gaming is a structural problem that requires structural solutions. Knowing this isn't defeatist — it's accurate, and it tells you where to direct advocacy energy if you want to change the industry rather than just navigate it.
You're working for a player rights organization reviewing the data practices of major game publishers. Your AI partner is a data privacy specialist who knows where studios hide the concerning stuff in their legal documents and will push you to make specific, defensible claims rather than vague criticism.
Pick any major game or platform (Steam, Epic Games Store, EA, Activision, PlayStation Network, Xbox) and work through what their actual data practices are. What do they claim to collect? What do they claim to do with it? What's missing or buried? What would a genuinely player-respecting version look like?