In Control? Examining the Design of User Privacy Settings in PC Video Games Through a GDPR Lens

Video games increasingly collect personal and behavioural data from players, yet little is known about how privacy controls in this medium are designed or whether they meet regulatory expectations. While prior research has examined consent notices and privacy interfaces in web and mobile applications, video games remain understudied. This paper presents a structured interface audit of user-facing privacy controls in N = 40 popular PC games identified from Steam’s “most played” rankings between November 2025 and January 2026. Drawing on the General Data Protection Regulation (GDPR) and guidance from the European Data Protection Board (EDPB), we developed a legally grounded evaluation rubric translating regulatory requirements into observable interface criteria. The rubric spans four dimensions: (1) consent and user control, (2) interface design, (3) transparency, and (4) usability and accessibility. Our findings reveal weak implementation of privacy settings and identify four recurring design patterns. These patterns raise concerns about transparency, accountability, and user agency within increasingly distributed game and platform ecosystems. By situating game privacy settings within debates on platform governance, dark patterns, and privacy-by-design, this paper argues that privacy should be treated as a core dimension of user experience rather than a legal obligation. Embedding clearer, more granular, and more accessible controls within game design may enhance trust and improve alignment with privacy-by-design principles.