Protection of minors in online games: age ratings, chat functions and parental control

: An important decision is currently attracting attention in games law: in April 2025, the youth ministries of the German federal states decided to officially recognize age ratings for online games via the IARC system. This innovation underlines how important reliable age ratings have also become in digital distribution. However, the protection of minors in online games means much more than just age ratings – it also includes the handling of chat functions, the control of user-generated content and the protection of children’s personal data. Developers, platform operators and publishers are therefore faced with complex legal requirements relating to the protection of minors and data protection. This blog post provides a comprehensive overview of the current regulations on the age rating of online games, moderation and reporting obligations for chats and user content, GDPR obligations for children’s data and platform liability in the games sector. The presentation is legally sound, practical and SEO-optimized – as an orientation guide in games law and at the same time as a positioning of an experienced lawyer in the field of media and IT law.

Age ratings for online games: IARC recognition, USK and PEGI

Age ratings are the central instrument of youth protection to provide parents and players with guidance on the suitability of games for certain age groups. In Germany, the Entertainment Software Self-Regulation Body(USK) traditionally assigns age ratings for video games. In addition, PEGI (Pan-European Game Information) is a Europe-wide age rating system which, however, has no legally binding effect in Germany, as the USK labels are authoritative in this country. Games that are sold to minors may only be offered in stationary retail outlets with a valid USK seal – otherwise there is a risk of sales bans and fines (see § 12, § 14 of the German Youth Protection Act, JuSchG).

With the increasing digitalization and distribution of games via online platforms, the need for a uniform procedure for the age classification of digital content has arisen. This is where the International Age Rating Coalition (IARC) comes in – an internationally coordinated system in which developers use an online questionnaire to provide information on violence, sexuality, language, drugs and other content relevant to the protection of minors in their games. Based on this information, IARC automatically generates age ratings for different regions, adapted to the national requirements of the respective self-regulatory bodies. For example, developers simultaneously receive a USK rating for Germany, a PEGI rating for many EU countries and an ESRB rating for the USA. This system was co-founded by the USK and has been used for several years in app stores such as Google Play, the Nintendo eShop, the PlayStation Store, Microsoft Store and others.

What is new is that the highest state youth authorities in Germany now officially recognize the IARC age ratings. After years of examination, it was decided in April 2025 that an age classification obtained via IARC meets German requirements and can be confirmed by administrative act. In practice, this means that Online gaming platforms that use IARC can now fulfill their labeling obligation in a legally secure manner in accordance with German youth protection law. The USK accompanies the process and ensures that the high German youth protection standards are met by checking the age ratings proposed by IARC and then formally issuing them by the responsible state youth authority in accordance with the JuSchG. This simplifies the process considerably for developers and publishers – a single IARC application covers global requirements without having to go through separate national reviews (such as a lengthy USK review process). At the same time, the USK labels remain present online and offer parents a familiar orientation aid.

The recognition of the IARC results strengthens the integration of USK and PEGI in the online sector. While PEGI ratings are displayed on many platforms, the following now applies to the German market: A PEGI rating is only sufficient here if it has been converted into a USK seal within the framework of IARC. Otherwise, there is a risk that a game without USK approval will be treated as “not labeled” – which means that it is not approved for children and young people. Developers should therefore make sure to obtain an official age rating (0, 6, 12, 16 or 18 years) for the German market in accordance with the German Youth Protection Act. Thanks to IARC recognition, this can now be easily integrated into the distribution cycle. Platform operators such as app stores are also obliged to present the displayed age labels correctly and clearly (see Section 12 JMStV for online offers). Overall, the IARC integration represents a modern, internationally compatible solution that puts the protection of minors in the online games sector on a solid legal footing.

Interstate Treaty on the Protection of Minors in the Media: age rating, moderation and reporting obligations

In addition to the JuSchG at federal level, the Interstate Treaty on the Protection of Minors in the Media (JMStV) regulates the requirements for online media content. At its core, the JMStV pursues the goal of keeping “developmentally harmful or youth-endangering” content away from children and young people or controlling their access to it. These obligations are constitutionally legitimized: The German Basic Law (Art. 5 Para. 2 GG) explicitly mentions the protection of minors as a limit to freedom of opinion and media freedom – the state may and must restrict content to protect young people. Providers of online games (as telemedia) must therefore adhere to certain guidelines, especially if their content goes beyond the mere presentation of game content and offers opportunities for interaction.

Age labeling requirement: According to the JMStV, content that is unsuitable for certain age groups may not be made available to children and young people of the relevant age group without restriction. In practice, the most important measure is age rating by a recognized self-regulatory body (such as the USK). If a game has a USK seal of approval, providers are generally allowed to make this game available online in accordance with the approved age category. If there is no label, the provider must check for itself whether the content is potentially harmful to development (Section 5 JMStV) or even harmful to minors (Section 4 JMStV). Content from the age of 18 (or indexed content) may not be freely available on the Internet – here the JMStV prescribes effective youth protection measures such as age verification systems or broadcasting time restrictions. For games, this means that an unrated shooter with drastic violence, for example, may not simply be published on a platform that is also open to minors. In such cases, platform operators and publishers risk regulatory action by the Commission for the Protection of Minors in the Media (KJM), the supervisory authority that punishes violations of the JMStV. In practice, it is therefore strongly recommended that every game that is made publicly available (in Germany) is given a USK/IARC age rating. These labels must be clearly displayed in accordance with Section 12 JMStV, for example on the product page of the game in the online store.

Chat functions and interaction risks: Modern online games are often more than isolated games – they are social platforms that contain chats, user forums, co-op modes or virtual marketplaces. Such additional functions harbor their own risks for the protection of minors, which have increasingly come to the attention of legislators in recent years. With the 2021 amendment to the JuSchG, the federal legislator has clarified that so-called usage risks must also be taken into account when assessing the age of a game (Section 10 (1) sentence 3 JuSchG). These include, in particular, unsupervised communication opportunities between users that can lead to cyberbullying, sexual grooming or other dangers, as well as cost-related risks such as in-game purchases, loot boxes (gambling-like mechanics) or other “cost traps”. In concrete terms, this means A game that allows freely accessible chat between strangers, for example, will generally receive a higher age rating than a game with otherwise identical content and no chat. In 2024, for example, the USK upgraded the popular platform Roblox – which is primarily aimed at children – from “from 12” to “USK from 16” following a new review. This step was justified by precisely those risks: the unlimited communication between users and the presence of game elements that simulate buying incentives or gambling. This example shows that chat functions and UGC elements (user-generated content) have a significant influence on the youth protection status of a game.

Games that are purely harmless in terms of content can therefore be harmful to minors due to their online features. Providers must respond to this legally, for example by moderating and using default settings that protect minors. For example, it is advisable to provide restrictive chat settings for younger users by default (e.g. limiting communication to known friends, using word filters or AI-based moderation tools to detect harassment). The JMStV requires providers to take appropriate precautionary measures to protect children from content that is harmful to their development (Section 5 (3) JMStV). This category also includes the control of interaction options: A game that does not implement appropriate protection mechanisms could be objected to by the supervisory authorities or, in an emergency, force a higher age classification. Parental control also plays a role here: platforms and game providers should provide parents with tools to configure their children’s gaming environment – such as dashboards for parental accounts that can be used to limit chat or spending. Such voluntary measures not only improve protection, but can also be positively taken into account in the assessment under youth protection law (keyword: “inclusion of technical protection concepts” as part of the USK review).

Notification and reporting obligations: Another aspect of the protection of minors is the obligation of providers to proactively address content that is harmful to minors. In accordance with the JMStV and media supervisory regulations, platforms must provide a reporting system that allows users to easily report violations or questionable content. Many games therefore have a “report content” function or a moderated support channel. If a report is received about obscene chat messages, pornographic content or extremely violent UGC, for example, the provider must investigate immediately and remove or block the content if the violation is confirmed. Although German law does not have a general pre-censorship requirement (on the contrary, Section 7 (2) TMG clarifies that there is no general monitoring obligation for host providers), it is mandatory to act quickly after becoming aware of a specific infringement. If a platform operator fails to do so, there is not only the threat of sanctions under youth protection law, but also the possibility of injunctive relief under civil law. In particularly serious cases (such as the distribution of child abuse depictions or hateful content via a gaming platform), the provider may even be liable to prosecution if they deliberately look the other way or do not cooperate sufficiently.

In addition, Section 7 JMStV requires commercial providers of “developmentally harmful” content to appoint a youth protection officer. This officer is to act in an advisory and supervisory capacity within the company to ensure compliance with youth protection regulations. Especially for larger platform operators (e.g. operators of gaming portals, video and games communities), a youth protection officer is mandatory. He or she also serves as a central point of contact for users and the authorities in the event of complaints. Compliance with such organizational obligations contributes significantly to minimizing risks in the area of youth protection.

Data protection: GDPR requirements for the data processing of children

The protection of minors includes not only the content of the game, but also the protection of minors’ personal data. Online games often collect extensive data: Account information, chat logs, gaming behavior, device-related IDs and much more. This is where the EU General Data Protection Regulation (GDPR ) comes into play with strict requirements when it comes to children as data subjects. Article 8 GDPR stipulates that children can generally only effectively consent to the processing of their personal data once they have reached the age of 16. If a child is younger than 16, consent is only legally effective if the parents (or legal guardians) have given their consent. Some EU countries have lowered this age limit to 13 years, but Germany has not made use of this option – the 16-year age limit applies here. This means that if a game provider offers an online service directly to a child under 16 and wants to rely on consent as a legal basis (e.g. for the creation of a personalized profile, newsletter, storage of user data, etc.), it must first obtain parental consent.

In practice, this presents companies with challenges, as pure age checks can easily be circumvented. The GDPR requires “reasonable efforts” to verify age – for example through technical age checks or parental verification (e.g. via ID, credit card payment or other identification procedures). There are therefore different solutions for games aimed at children: Some games completely prohibit use under a certain age (e.g. under 13, to at least align with US COPPA standards). Others only allow children to register with parental consent, which must be confirmed by the parents, e.g. by e-mail confirmation or code entry. It is important that the chosen method is appropriate to the risk: the younger the target player group, the greater the expected scrutiny.

In addition to the issue of consent, the GDPR stipulates special protection of children’s privacy. Information for children must be easy to understand (Art. 12 GDPR, transparency requirement). Providers must also not collect excessive amounts of personal data from minors – the principle of data minimization (Art. 5 para. 1 lit. c GDPR) applies here in particular. Functions such as in-game chats should have privacy-friendly default settings (e.g. profiles should not be made public, search engines should not be able to access them, display names should be pseudonymized) in order to protect children from too much visibility. The consent itself must be documented and revocable at any time. In cases where parental consent has not been obtained, the provider must fall back on alternative legal bases or refrain from processing the data. Caution is required, especially in the free-to-play sector with personalized advertising: The profiling of children for advertising purposes is under strict observation by the supervisory authorities under data protection law and may violate the principles of the GDPR.

Overall, the GDPR requires games companies to implement a high level of data security and privacy by design for children. Violations can not only damage a company’s image, but also result in considerable fines. It is therefore advisable to consider concepts for age rating and data protection together when developing a game (or a platform) – e.g. through age checks during onboarding, differentiated settings depending on age and clear instructions for parents. In this way, the balancing act of integrating young target groups in a data protection-compliant manner without violating youth protection principles is mastered.

Liability for user-generated content: Responsibility of platform and creator

Many online games thrive on user-generated content (UGC) – be it the player-created level in Roblox, a self-programmed mini-game on Itch.io or mods and maps in other games. This user-created content enriches the gaming experience, but also raises complex legal issues: Who is liable if user content violates youth protection rules or is even illegal? The answer lies in weighing up the responsibility of the platform operator against that of the individual content creator.

Responsibility of platform operators:
Under German law, operators of online platforms are initially considered service providers within the meaning of the Digital Services Act (DDG), which replaced the previous Telemedia Act (TMG) in March 2024. § Section 9 DDG contains the liability privilege for host providers: According to this, a platform operator is not responsible for third-party information posted by users as long as it has no actual knowledge of illegal content. This principle – derived from the EU E-Commerce Directive and continued in the Digital Services Act (DSA) and nationally in the DDG – protects platforms such as Roblox or Itch.io from being immediately held liable for any game content created by users.

Case law has confirmed these principles of platform liability. For example, the Federal Court of Justice clarified in the so-called “YouTube” ruling (BGH, ruling of 13.09.2018 – I ZR 140/15) that a video platform is not liable as the perpetrator for every illegal upload by a user. However, once the provider becomes aware of a specific legal infringement, it may be liable as a so-called disturber for injunctive relief if it does not take immediate action. The following also applies under the new law: The privilege no longer applies as soon as the platform operator becomes aware of illegal user-generated content. In this case, the provider is obliged to act immediately and remove or block access.

When it comes to the protection of minors in particular, platform operators are well advised to draw up consistent terms of use that strictly prohibit certain content (e.g. “no content above USK 16” in a child-friendly game or “pornographic content only in segregated 18+ areas with age verification”). However, these rules must also be effectively enforced. Providers are also obliged to set up a functioning reporting system and to check reported content promptly (Section 12 DDG, Section 16 DSA). If a platform systematically fails to do this, it loses the protection of the liability privilege. In extreme cases, the supervisory authorities can take measures up to and including banning the offering in Germany. Game platforms such as Roblox are therefore also under increased scrutiny. The raising of Roblox’s age rating to 16 was largely due to documented cases of inappropriate content and the realization that existing protective measures were not sufficient. Platform operators are therefore required to demonstrably implement youth-friendly community management concepts.

Responsibility of content creators:
In addition to the platform, the person who creates or uploads the problematic content is generally liable. Users who disseminate media that is harmful to minors – for example under Section 131 StGB (glorification of violence) or Section 184 StGB (dissemination of pornographic content) – can be held liable under criminal and civil law. In practice, however, content creators are often anonymous or based abroad, which makes it difficult to enforce the law. Effective control is therefore effectively directed at the platform operators.

Nevertheless, developers and creators should know that they cannot invoke the liability privileges of the platforms. Anyone who creates or distributes content that violates youth protection regulations must expect legal consequences. This includes, in particular, indexing by the Federal Center for the Protection of Children and Young Persons in the Media (BzKJ) as well as possible civil and criminal measures.
In the commercial sector – for example, for indie developers who distribute games via Itch.io or their own websites – age rating obligations also apply. Anyone offering a game that contains content harmful to minors (e.g. “18+”) must ensure that minors are not given access. This can be achieved through suitable technical measures, such as age verification systems or access restrictions. Anyone who fails to do this becomes a provider of content harmful to minors with all the legal consequences, regardless of whether the game is distributed via a platform or independently.

Practical example Itch.io:
The Itch.io platform is known for its variety of indie games, including many experimental or adult games. Unlike large app stores such as Google Play or the Nintendo eShop, Itch.io has not established a mandatory age rating system for a long time, but has only provided voluntary “NSFW” notices. From the perspective of German youth protection law, this is problematic: content that would be subject to an “18+” age rating in Germany could be available without an effective age check.

From a legal perspective, Itch.io is therefore operating in uncertain territory. Although the platform operator is based in the USA, the German Interstate Treaty on the Protection of Minors in the Media (JMStV) also applies to foreign providers if they target their content at the German market or if it is actually available in Germany (Section 3 (1) JMStV). Developers who publish games on Itch.io are therefore recommended to at least set up voluntary age ratings and, if necessary, country-specific access restrictions in order to prevent legal problems. It is even better to plan youth protection measures at an early stage – for example by adapting content or using platforms that have implemented standardized age ratings and protection mechanisms.

Conclusion

The protection of minors in online games is a multifaceted topic in modern games law that combines technical innovation with legal obligations. The recognition of the IARC system in Germany marks a significant step towards efficient age rating for online games and makes it easier for developers to publish their titles globally in accordance with German youth protection requirements. At the same time, expectations on platform operators and publishers to ensure a safe gaming experience are increasing: chats and community features must be designed in such a way that children are not exposed to unheard dangers; reporting systems and moderation are essential. The data protection component – especially GDPR compliance for child-related data – requires further care and often creative solutions to reconcile parental consent and the privacy of young users. Finally, liability is also closely linked to proactive action: Providers who set clear guidelines, consistently punish youth protection violations and take parents and young users seriously minimize their own risk considerably.

It is worthwhile for game developers, platform operators and publishers to see these aspects not as mere regulatory requirements, but as a quality feature of their own offering. A holistic youth protection and data protection concept for an online game is now part of professional product responsibility – and is expected by supervisory authorities and informed users alike. The complex web of JMStV, JuSchG, DSGVO, TMG and other standards provides the framework within which creative solutions are required. A law firm specializing in games and IT law follows these developments closely and supports providers in implementing practical compliance measures. Ultimately, the protection of minors in online games is not an obstacle, but a common concern of the industry, parents and legislators – with the aim of making the fascination of games a safe experience for all age groups.