Research cutoff: 22 July 2026
Scope: General comparative research for product, publishing and compliance planning. It is not legal advice for a particular game, entity or territory.
Executive summary
A Chinese online game entering Europe, the United States, Japan or South Korea does not encounter four versions of a foreign “game licence”. The four markets connect similar risks to different legal and commercial tools. The European Union combines consumer law, digital-content contracting and the Digital Services Act (DSA), while age classification, gambling and enforcement still require member-state analysis. The United States has no federal game-content licence; the Federal Trade Commission (FTC) can nevertheless treat interface design, payments, refunds, children’s data and default communications as one unfair or deceptive practice, with California adding its own subscription and digital-goods rules. Japan has no general game licence: CERO and industry guidance matter in channels, while consumer representation, distance selling and prepaid-payment rules supply the binding edges. South Korea places statutory classification at the centre of market entry and has added statutory disclosure for probability-based items and a domestic-agent interface for certain overseas operators.
The useful comparison unit is therefore a product function and its evidence: who contracts with the player, who controls the version, what age assurance is used, whether a parent must consent, how random rewards and virtual currency are priced, how a player cancels or seeks a refund, who moderates user content and who must answer a regulator. PEGI, ESRB, CERO, GRAC and IARC all produce age-facing labels, but their legal effects range from self-regulatory practice and distribution contracts to statutory classification. A loot box cannot be labelled simply “gambling” or “not gambling” across these markets: probability disclosure, children’s commercial practices, misrepresentation, payment regulation, consumer remedies and local gambling law may operate at the same time.
The practical answer is a jurisdictional version baseline built from six variables: territory, age group, product mechanism, payment path, community function and responsible entity. A publisher agreement should turn “the publisher handles local compliance” into named tasks, deadlines, access rights, evidence duties and cost allocation. A global build may be reused, but its assumptions must be tested against each local interface and operating model.
1. Why market entry is not one launch approval
Teams often reduce overseas launch to three questions: Is a licence required? Can the game contain gacha? Does the privacy policy need translation? Those questions miss the points at which a live service fails. A game may not need a Chinese-style content licence and still be blocked by German age-classification consequences, a South Korean GRAC procedure, a children’s chat default, an unclear subscription cancellation path or a store probability field. An age label also does not prove that a user-generated-content system, a refund flow or a local representative arrangement is complete.
The four jurisdictions show four recurring structures. The EU uses horizontal rules plus national enforcement. The United States combines federal enforcement, state law, platform contracts and private litigation. Japan uses general consumer and payments law alongside meaningful industry self-regulation. South Korea uses a specialist game statute whose classification and operator duties create clearer entry points. None of these structures can be represented by a single country risk score.
This report compares functions across the operating life of a game. Personal-information and cross-border-data issues appear only where they change age assurance, marketing, community features or responsibility allocation. A separate data-governance article is needed for a full analysis of server architecture, transfers and security assessments.
2. A hierarchy of rules before a checklist
Five categories should be separated before a team compares outcomes.
Statutory admission or classification. South Korea’s Game Industry Promotion Act links classification and operator duties to public enforcement. A classification obtained through an authorised self-rating route is still a statutory mechanism, not the same thing as a voluntary label.
A classification recognised by domestic law. Germany’s Youth Protection Act gives legal structure to age labels and the role of USK. That effect cannot be inferred from the existence of PEGI elsewhere in Europe.
Industry classification. PEGI, ESRB and CERO are established systems with strong practical consequences because publishers, platforms, retailers and console manufacturers use them. They are not interchangeable with government approval. A label may be contractually decisive while remaining legally distinct from a permit.
Platform policy. Apple, Google, Steam and console stores can require age questionnaires, payment handling, probability disclosure, subscriptions, UGC controls and refunds. The immediate remedy is usually review rejection, removal, account suspension or a contractual refund charge. That is serious, but it is not automatically an administrative offence.
Guidance and coordinated enforcement positions. The EU Consumer Protection Cooperation Network’s principles on in-game virtual currencies and the Commission’s guidance on minors help show how authorities may apply existing legislation. Their legal status and scope must still be distinguished from an EU regulation or national statute.
A product matrix should therefore record, for each feature, the rule type, decision maker, evidence, review date and technical owner.
3. European Union: horizontal rules, national differences
The EU does not have a single pre-launch game-content permit. A game that stores and publicly distributes player posts, mods, voice transcriptions or creator content may perform an intermediary or platform function under the DSA, rather than remaining only a “content product”. The DSA has applied broadly since 17 February 2024. The Digital Content Directive addresses conformity, updates, modification and remedies. The Consumer Rights Directive and Unfair Commercial Practices Directive address pre-contract information, withdrawal, additional payments, misleading design and pressure on children.[1][2]
PEGI is an important European self-regulatory system, but a PEGI label does not eliminate national questions. Germany’s statutory youth-protection structure, and different approaches to paid random rewards in Belgium and the Netherlands, illustrate why “EU version” is not a complete risk unit. The responsible entity must also distinguish a DSA legal representative from a GDPR representative, a consumer-contract party and a tax or corporate agent. The existence of a community feature does not alone decide whether every DSA duty applies.
Article 28 DSA requires providers of online platforms accessible to minors to put appropriate and proportionate measures in place for a high level of privacy, safety and security. The Commission’s 2025 guidance discusses private-by-default accounts, safer recommendations, reduced stranger contact, limits on commercial practices that exploit children’s vulnerability and proportionate age assurance.[3] The guidance is not a universal requirement to collect identity documents. The team should first identify the service role, user accessibility, size exemptions and actual risks, then preserve the risk assessment, default-setting rationale, parental-control test and complaint path.
4. United States: product facts, FTC enforcement and California overlays
The United States has no federal game-content licence and no federal ban on all loot boxes. ESRB’s force comes from industry and distribution practice. The FTC Act, especially 15 U.S.C. §45, gives the FTC a broad route to examine deceptive or unfair acts. A single investigation can connect a misleading button, unauthorised charge, concealed refund route, account lock after a payment dispute and a child-directed default.[4]
COPPA and 16 C.F.R. Part 312 apply to covered services directed to children under 13 and to operators with actual knowledge that they collect children’s information. The FTC’s 2025 amendments add or clarify mixed-audience treatment, separate parental consent for certain third-party disclosures and targeted advertising, retention limits, security-program duties and biometric identifiers. The FTC’s official summary describes the final amendments and parent controls; the Federal Register text is the primary rule source.[5] A “general audience” label is not a safe harbour. Actual audience, game presentation, advertising, licensed characters, account flows and internal knowledge all matter.
California should be tracked separately. AB 2426, effective 1 January 2025, addresses digital-goods language when the consumer receives a revocable licence rather than unrestricted ownership. AB 2863, with its principal changes effective 1 July 2025, strengthens consent records, reminders and cancellation mechanics for automatic renewals.[6][7] Neither statute is a single US-wide game rule. Both can shape a common web or subscription flow when California users are included.
The practical model is a claim map: federal consumer law, COPPA, state consumer or renewal law, store policy and contract remedies should each be attached to the relevant screen, log, consent record and refund decision.
5. Japan: industry classification with binding general law
Japan has no general online-game licence. CERO’s A/B/C/D/Z classifications are industry-operated and matter strongly for consoles and distribution, but CERO’s own ethics and rating materials do not turn it into a national administrative body.[8] Mobile and web games may also meet store and IARC processes.
The binding edges commonly arise from three bodies of law. The Act against Unjustifiable Premiums and Misleading Representations addresses misleading quality or price claims and prize restrictions. The Act on Specified Commercial Transactions requires distance-selling information such as operator identity, price, additional costs, payment and delivery timing, and return or cancellation conditions. The Payment Services Act may regulate certain game currencies or points as prepaid payment instruments, creating issuance, safeguarding, information and shutdown-balance duties.[9]
“No licence” therefore means only that there is no equivalent general content approval. It does not remove Japanese display duties, channel classification, rules on a complete-gacha structure or accounting separation between paid balances, promotional currency and items. A shutdown plan should know which unused balances are regulated prepaid value and which are merely contractual game items.
6. South Korea: statutory classification and operator interfaces
South Korea’s Game Industry Promotion Act creates a statutory classification framework, refusal and correction powers and operator duties. GRAC is not simply another ESRB or CERO. Where an authorised business uses self-rating, that route exists within the statutory structure, not outside it.[10]
From 23 October 2025, certain overseas game operators without a Korean address or place of business must appoint a domestic agent under the relevant rules. The agent is an interface for notices and materials; it does not automatically replace the overseas operator’s substantive obligations. Thresholds and detailed Korean-language rules should be checked against the current Enforcement Decree for the actual service. A publisher contract must identify who owns classification, who receives regulator notices and how quickly the China-based team can provide logs, probabilities and build evidence.
South Korea’s probability-based item disclosure rules are another example of a specialised obligation. A store page containing a generic “odds available” link cannot be assumed to satisfy the statutory location, language, item and change-disclosure requirements. The live server configuration, player-facing probability table, event history and approval record should be one evidence chain.
7. Age classification is product configuration
The same age number can have different legal consequences. PEGI and ESRB operate largely through industry and channel commitments; CERO operates within Japanese distribution practice; GRAC and authorised self-rating connect to South Korean law; IARC and store ratings are collaborative tools. Completing an IARC questionnaire does not prove that every local legal question has been answered.
Age descriptors also affect other systems. Random rewards, simulated gambling, violence, frightening content and UGC can change a rating. The rating can then affect ads, store merchandising, chat defaults, parental controls and payment authentication. Classification should be part of release configuration. When an update adds a loot-box event, voice chat or creator monetisation, the team should re-check the rating and every affected interface.
A market-entry file should contain the applicant, rating route, store account holder, player-contract party, merchant or refund party, customer-support entity, regulator contact, probability approver and shutdown decision maker. “Local publisher” is a commercial label until these facts are documented.
8. Minors: safety design instead of one copied time table
The four jurisdictions do not offer one universal “anti-addiction hours table”. The EU, US federal system and Japan do not impose a single nationwide game-time number. South Korea’s old mandatory midnight shutdown was abolished from 1 January 2022; current planning should not copy that old rule into a new product.[11]
The shared design questions are more useful: Is age information reliable enough for the feature? Is a child account private by default? Can strangers contact a young player by voice or text? Does a purchase require a second confirmation? Can a parent see spending and close communication quickly? Can the operator explain why it selected a particular age-assurance method?
Under DSA Article 28, a platform accessible to minors must use appropriate and proportionate privacy, safety and security measures. The Commission’s guidance is a risk reference, not a blanket order to collect passports or faces. In the US, COPPA’s under-13 threshold, mixed-audience rules and FTC unfairness analysis can operate in parallel. The 2022 Epic enforcement demonstrates that voice and text defaults, payment design and refund friction may be evaluated together; its specific order should not be converted into a universal rule for every game.[12]
Japan combines youth online-safety measures, channel controls and general consumer law. South Korea combines classification, youth-protection rules, parental controls and game-operator duties. In every market the evidence should include the age gate, default settings, consent path, moderation response and ability to appeal.
9. Random rewards, virtual currency and payments
EU member states have not produced one uniform loot-box answer. The relevant analysis may ask whether money is paid, rewards have value, rewards can be traded, the random mechanism is part of a wider game and whether local gambling law applies. Belgian and Dutch decisions show why one country’s conclusion cannot be exported to the entire EU.[13]
The more portable EU baseline is consumer transparency. The CPC Network’s 2025 virtual-currency principles encourage clear real-money prices, avoidance of currency designs that hide cost or force surplus purchases, and attention to children’s vulnerability.[14] The principles are an enforcement position rather than a new regulation, but they are a useful design test.
In the US, probability disclosure, unauthorised charges, dark patterns, COPPA and state law are separate routes. In Japan, complete gacha is a particular structure analysed under premium and representation rules; “gacha” as a word does not decide the result. In South Korea, probability disclosure is statutory and must stay aligned with the live configuration. The product should retain an immutable event version, the odds shown at purchase, the approval record and a change log.
The same separation applies to refunds and subscriptions. EU digital-content withdrawal and conformity remedies, US ROSCA and California cancellation, Japan’s distance-selling display and prepaid-payment regime, and South Korea’s seven-day consumer framework with a digital-content exception do not share one trigger or one deadline.[15] Platform refund policies are an additional contractual layer, not a substitute for local law.
10. UGC, chat, complaints and enforcement
If a game hosts and publicly distributes player posts, mods or creator content, DSA duties may include an accessible illegal-content notice route, reasons for restrictions, internal complaints and transparency reporting. The DSA does not require prior review of every post, and a contractual rule against harassment or cheating is not automatically the same as a finding of illegality.
In the US, Section 230 and the DMCA are different safe-harbour regimes. Section 230 has intellectual-property and other exceptions; Section 512 requires notice-and-takedown conditions, a designated agent and a repeat-infringer policy. Neither is a general licence to ignore moderation, copyright, children’s safety or a platform contract.[16]
Japan’s amended information-platform framework adds complaint and transparency duties for designated large platforms; it does not create a DSA clone for every game community. South Korea uses game, youth-protection, e-commerce, communications and platform rules in parallel. A Chinese publisher should provide a local-language report, mute, block, appeal and evidence-preservation flow even when the statutory path is less centralised.
Enforcement style also differs. EU authorities coordinate consumer action while member states impose procedure and penalties. US agencies can combine administrative orders, federal court relief, refunds and state or private claims. Japanese regulators may use misleading-representation orders and consumer consultation evidence. South Korean game authorities and consumer agencies operate on separate but connected tracks. The store UI, logs and customer-support scripts can be legal evidence in all four systems.
11. Self-publishing, local publishers and store distribution
Self-publishing gives the developer control over the store account, player contract, probability table, support and shutdown. It also leaves the developer with the classification, display, refund and notice workload. A local publisher may hold the Korean rating, store account, payment and support function, but a developer that controls the SDK, probability configuration, content update or ban logic may still be a relevant operator or contractual guarantor.
The publishing agreement should answer six questions:
- Who selects the initial territories, age category and rating questionnaire?
- Who converts server odds into the player display, and whose approval is needed for a change?
- Who owns the store account, player contract, payment and refund controls?
- Who receives a regulator, child-safety or UGC notice, and within what time?
- Who pays for removal, refunds, penalties, recalls and emergency changes?
- On termination, how are accounts, balances, subscriptions, tickets and notices migrated?
A platform is one layer of the responsibility chain. Apple, Google, Steam and console stores may provide ratings, payment, tax or refund infrastructure without taking responsibility for a game’s web shop, cross-platform community or misleading marketing. Agreements should include urgent access, data export, suspension allocation and evidence retention.
12. A release evidence model
A practical territory pack contains seven linked sheets: legal entity and contracting party; classification and age; product mechanics; payment and refund; community and safety; data and advertising; support, incidents and shutdown. Each sheet should name an owner, a current version, a review date and the evidence location.
Before launch, walk the full player journey in each territory: install, age gate, account creation, first purchase, random reward, subscription, chat, report, block, appeal, refund, account deletion and shutdown notice. Repeat after any material event update. Compare the odds in the server, client, store page and help centre. Verify that the entity receiving a regulator’s email can obtain the logs without asking another party to reconstruct the facts.
This model also makes the limits visible. An EU classification label cannot answer a Korean probability question. A COPPA consent record cannot by itself satisfy Chinese cross-border procedures. A store refund cannot resolve a Japanese prepaid balance. A contract allocation cannot override a statutory duty.
The release owner should also preserve the negative decisions. If a feature is withheld in Belgium, a probability table is changed for Korea, or a child account is kept out of a targeted campaign in the United States, record the reason, approver, affected build and customer-facing explanation. A later regulator or platform reviewer will often ask why a control was selected, not only whether a control existed. Keeping rejected alternatives prevents a new product manager from restoring a risky global default simply because the first decision was not visible in the repository.
13. Conclusion and limits
The common direction across these markets is a move from static text to verifiable product facts. Age assurance, chat defaults, payment consent, probability accuracy, cancellation, balances, UGC complaints and shutdown are all operational systems. The correct unit for a Chinese game company is a reviewable territory version pack, not a country paragraph or a global privacy policy.
South Korea should be approached through classification, probability disclosure and any domestic-agent requirement. The EU requires member-state screening beyond PEGI and a role analysis under the DSA. The US should separate COPPA, FTC design risk, California law and store policy. Japan requires a distinction between industry classification, complete-gacha structures, distance-selling displays and prepaid value.
This report is limited to the four selected markets and examples available by 22 July 2026. EU member-state and US state rules are broader than the examples used here. Platform policies change frequently. Korean and Japanese implementation details should be checked in the local-language texts for the actual service. No conclusion in this general report determines whether a particular game is lawful or ready to launch.
Core sources
[1] Regulation (EU) 2022/2065 (Digital Services Act), EUR-Lex: official source
[2] Directives (EU) 2019/770, 2011/83/EU and 2005/29/EC, EUR-Lex: official source ; official source ; official source
[3] European Commission, Guidelines on measures to ensure a high level of privacy, safety and security for minors online, 2025: official source
[4] Federal Trade Commission Act, 15 U.S.C. §45: official source
[5] FTC, 16 CFR Part 312: COPPA Final Rule Amendments, 22 April 2025: official source ; FTC summary: official source
[6] California AB 2426: official source
[7] California AB 2863: official source
[8] CERO, Age Rating System and Code of Ethics: official source ; official source
[9] Japan Consumer Affairs Agency and e-Gov texts for the Premiums and Representations Act, Act on Specified Commercial Transactions and Payment Services Act: official source ; official source ; official source
[10] GRAC, Korean game rating system, and Game Industry Promotion Act: official source ; official source
[11] Korean Ministry of Culture, Sports and Tourism, material on abolition of mandatory shutdown: official source
[12] FTC, Epic Games enforcement and consumer refunds, 19 December 2022: official source
[13] Council of State of the Netherlands, ECLI:NL:RVS:2022:690: official source ; Belgian Gaming Commission loot-box report: official source
[14] European Commission, CPC coordinated action on online games and virtual currencies: official source
[15] Consumer and platform sources include South Korea’s Electronic Commerce Consumer Protection Act, Japan’s distance-selling rules and Steam Refunds: official source ; official source
[16] 47 U.S.C. §230 and 17 U.S.C. §512: official source ; official source