Preface: Reader's Guide to This Adaptation
What you are reading, and why it exists
In May 2026, the Online Safety Act Network, working with 5Rights Foundation, the NSPCC, the Molly Rose Foundation, and a coalition of civil society organisations, led by Professor Lorna Woods OBE, published a Safety by Design Code of Practice. That document established a comprehensive lifecycle framework for making digital services safe by design: from governance structures and pre-launch testing, through deployment and monitoring, to decommissioning. It represented the most detailed and ambitious attempt to date to translate the Online Safety Act's "safe by design" requirement into operational guidance.
But there are significant overlaps between social media and gaming, so I've explored how easy they are to adapt to promote awareness of what Safety by Design looks like in games.
Gaming presents a related but distinct risk profile: the harms are real, well-evidenced, and increasingly serious, but the mechanisms through which they occur are different enough from social media that the original code, applied without adaptation, would leave significant gaps.
What the framework is, and what has changed
The original code's structure, a four-part lifecycle approach covering governance, development, deployment, and decommissioning, applies to gaming without fundamental restructuring. The same principles hold: design out hazards rather than manage them; apply safety across the product in its entirety; treat safety as an ongoing governance responsibility, not a compliance checkbox.
What changes is the specific content of each section. The table below shows, at a glance, what was retained, what was substantially rewritten, and what is entirely new:
The dark pattern taxonomy: what this code now covers
This adaptation cross-references the full gaming dark pattern taxonomy catalogued at darkpattern.games, which identifies 32 documented dark patterns across four categories. Click any pattern to see its definition and where it is addressed in the code.
All 32 documented patterns are addressed in the code.
Introduction
Safety by design has emerged as a central principle in digital regulation, reflecting a shift toward tech accountability that requires digital services to assess and mitigate risks to users from the earliest stages of product development and throughout the entire lifecycle of the product or service.
While there is broad consensus that safety by design involves proactively building protections into systems and designing out risks to ensure user safety, there remains less clarity around the specific measures platforms must adopt and how these principles translate into operational practice. This is particularly acute in the context of online gaming, where the regulatory framework has developed more slowly than the industry, and where significant design choices, including monetisation mechanics, in-game social features, and engagement-maximising gameplay design, have proceeded largely without systematic safety scrutiny.
This code of practice seeks to address that gap by providing a practical overview of safety by design for online gaming services, within the framework of the Online Safety Act and Ofcom's existing codes and guidance.
Context
Safety by design is increasingly referenced in relation to digital services. In gaming specifically, there is growing evidence that design choices made by developers and publishers create measurable risks to users, and that children are disproportionately exposed to those risks.
Recent high-profile proceedings against gaming companies in multiple jurisdictions have highlighted the role of design choices on user safety and wellbeing, particularly in relation to addictive mechanics and monetisation features. Belgium and the Netherlands have formally classified certain loot box mechanics as gambling. The UK Gambling Commission has published research demonstrating links between loot box engagement and problem gambling behaviours, particularly among young people. Ofcom's commissioned research on persuasive design features and potential child financial harms identifies online games as a significant site of risk. In 2024, the Competition and Markets Authority announced an investigation into subscription and monetisation practices in mobile gaming targeting children.
Despite clear evidence that design choices made by gaming platforms can be harmful, civil society organisations have highlighted a lack of clarity around what safety by design means in the gaming context, and have called for safety by design to be more clearly mandated to ensure gaming services do not continue to put users, especially children, in harm's way.
The Online Safety Act applies to user-to-user services including online games with social features. The Act's requirement that regulated services be "safe by design" applies as much to a multiplayer game as to a social media platform; yet Ofcom's codes of practice have not specifically addressed gaming, and the gaming industry's own voluntary frameworks (including PEGI, and UKIE's Safe by Design commitment) fall significantly short of what a robust statutory code would require.
Beyond the UK, international principles and legislation, including the EU Digital Services Act and guidance from the Australian eSafety Commissioner, emphasise accountability, transparency, the assessment and mitigation of risk, and the protection of fundamental rights for users. The UN Special Rapporteur on the sale, sexual exploitation and sexual abuse of children has highlighted that "despite existing national, regional and international regulations and guidelines calling for the design and development of digital products with the highest level of privacy, safety and security for children, enforcement remains inconsistent, with limited oversight and liability frameworks. Many companies fail to implement safety by design approaches, robust age verification and algorithmic transparency."
A safety-by-design approach as outlined in this code enables gaming companies to align with these global expectations, and provides a template for Ofcom to extend its codes to cover gaming services specifically.
Safety by Design Code of Practice: Gaming Services
What is this code?
Safety by design has become a core tenet in digital regulation. While there is agreement on what it means in broad terms, there is less certainty about what is specifically required in the gaming context and how that might work in practice.
This code aims to provide an overview of safety by design for online gaming services, set within the framework of the Online Safety Act and Ofcom's existing codes and guidance. Our code takes a more ambitious approach than Ofcom has taken to date in relation to gaming. However, its positioning within the framework of the OSA means that, with just a few technical amendments, Ofcom could adopt this swiftly as a gaming-specific supplement to its existing codes.
Who is it for?
This Code of Practice provides detailed guidance for all companies involved in the development, publishing, and operation of online gaming services. This includes:
- Games developers and publishers (whether developing for console, PC, or mobile platforms)
- Platform holders operating storefronts or online gaming networks (including but not limited to console manufacturers and PC distribution platforms)
- Operators of online gaming environments, including persistent multiplayer games, battle royale titles, and social gaming platforms
- Operators of mobile gaming applications with in-app purchase features or social functionality
- Third-party services integrated into gaming environments, including voice communication services, in-game marketplaces, and user-generated content tools
The code also serves as a template for adoption by Government and Ofcom as a model for delivering on the Act's requirement that regulated services are "safe by design", and specifically for extending that requirement clearly and comprehensively to gaming services, where it has to date been insufficiently applied.
What is safety by design?
Safety must be embedded into product design decisions from the outset and retroactively. It requires:
- A hierarchy of control approach
- Application across the product in its entirety
- Consideration of safety across the product lifecycle, as opposed to merely retroactive or 'add-on' safety measures
Hierarchy of control means that services should seek to design out hazards from the outset. Where this is not possible, services should seek to manage and mitigate risk of harm. Remediation is a mechanism of last resort. In making design choices, services should seek solutions which best optimise outcomes for users, rather than relying on harsh trade-offs.
As part of this approach, risk assessments are key and appropriate product testing essential. Gaming companies should approach risk assessments holistically, scrutinising their products through audits including (but not limited to) gameplay mechanic testing for behavioural exploitation, monetisation feature assessment, algorithm quality testing (including for matchmaking systems), human rights impact assessments, and environmental safety testing that accounts for broader impacts across the value chain.
Product entirety means that safety issues should be considered across the product in its entirety: this includes not just user-facing gameplay but also the backend systems, recommendation and matchmaking algorithms, monetisation mechanics, and business models. Gaming companies should assess their revenue generation strategies, including free-to-play mechanics, in-app purchase design, and virtual currency systems, through a safety and human rights lens. This should include consideration of:
- The impact that the proposed model or strategy would likely have on user safety, taking into account current knowledge from both internal and external research on gaming-facilitated harms
- The impact on human rights, including privacy and freedom of expression
- Changes that could alleviate these risks, including moving away from engagement-maximising mechanics, minimising data collection, and designing monetisation features that do not exploit psychological vulnerabilities
Safety by design should be considered across all elements of a gaming service, including: account sign-up processes; core gameplay mechanics; progression and reward systems; monetisation features (including in-game purchases, loot boxes, virtual currencies, and subscription mechanics); social and communication features (including voice chat, direct messaging, friend and group systems, and gifting); content discovery and matchmaking functions; and moderation and reporting tools. Hazards should be tackled as close to source as possible.
Product lifecycle requires consideration of safety at the product development stage, through ongoing monitoring and updating, and finally decommissioning. This code is structured around the product lifecycle.
As numerous studies have shown, different users have different exposure to harm, and different features may produce additional or more acute risks for some users. For a product or service to be "safe by design," it should be designed in accordance with design justice principles. This includes:
- Consideration of how different groups have participated in the design of the product or service
- Consideration of how different groups may be harmed by the design, and taking steps to remediate where certain groups are disproportionately harmed
- Consideration of how different groups may benefit from the design, and how those benefits can be fairly allocated
In the gaming context, this means giving particular attention to: children and young people; users with problem gambling vulnerabilities; users with mental health conditions; women and girls, who face distinct patterns of online harassment in gaming environments; and players from minoritised communities.
Where does this sit within the legislative framework?
Ofcom is required to produce codes to help services fulfil their safety duties (section 41 of the Online Safety Act 2023). Online gaming services with user-to-user features are regulated services under the Act. The OSA explicitly references the need for user-to-user services to be 'safe by design' on the face of the Act in section 1(3):
Duties imposed on providers by this Act seek to secure (among other things) that services regulated by this Act are — (a) safe by design, and (b) designed and operated in such a way that — (i) a higher standard of protection is provided for children than for adults, (ii) users' rights to freedom of expression and privacy are protected, and (iii) transparency and accountability are provided in relation to those services.
The Secretary of State for DSIT sets out safety by design as a key priority in their Statement of Strategic Priorities for Online Safety, making clear that Ofcom should ensure platforms embed safety by design to deliver safe online experiences for all users but especially children.
In addition to the OSA, the following regulatory frameworks are specifically relevant to gaming:
- The Age-Appropriate Design Code (Children's Code): Applies to services likely to be accessed by children, including online games. Sets out 15 standards for data protection by design for children's services.
- The Gambling Commission's position on loot boxes: While loot boxes do not currently meet the legal definition of gambling under the Gambling Act 2005, the Commission has published research identifying concerning links between loot box engagement and problem gambling behaviours in young people.
- The Competition and Markets Authority: Has jurisdiction over unfair commercial practices in gaming monetisation, including practices targeting children. The CMA has actively investigated subscription traps, misleading pricing, and exploitative in-app purchase design.
- ICO enforcement under UK GDPR: Applies to behavioural profiling, targeted advertising, and data processing in gaming services, with additional protections for children under the AADC.
- PEGI: The Pan European Game Information rating system provides age guidance but does not constitute a safety framework. PEGI ratings are not a substitute for safety by design.
Our approach
The following code of practice seeks to address safety by design through the entire lifecycle, considered across the product in its entirety, and taking a hierarchy of control approach. The early design process is key to identifying and seeking to mitigate risk, including risks arising from gameplay mechanics designed to maximise engagement, monetisation features that exploit psychological vulnerabilities, and social features that can be weaponised by those wishing to harm children.
Risks can evolve once a service is live and interacting with real users at scale. Having anticipated potential harms and risks during the design stage, the second stage of a safety-by-design approach requires services to ensure that protective measures are effectively implemented when a product, feature, or business strategy is deployed.
A safety-by-design approach treats deployment as an extension of the design process. It ensures that safety measures are fully integrated, tested in real-world conditions, monitored, and adapted in response to emerging risks or unforeseen patterns of harm.
Effective safety-by-design requires robust governance at every stage of a service's lifecycle. Boards, senior managers, and relevant decision-makers must have clear oversight of risks, mitigation strategies, and emerging harms. There must be clear allocation of accountability for safety-by-design, with clear reporting lines and sufficient mitigation of any conflicts of interest, including commercial incentives to expand monetisation or engagement features that may conflict with safety objectives.
Transparency is a core component of governance. Decision-making processes, evidence of effectiveness, and actions taken in response to risks should be documented, shared internally, and made accessible to regulators, researchers, and where appropriate, the public.
Active leadership is necessary to ensure safe design. It is also important for ensuring that incentives within the company that influence design and development choices are aligned with safety objectives. In gaming, this requires specific attention to the fact that the most commercially successful design features are often also the most psychologically exploitative, a conflict that governance structures must be equipped to manage.
The Senior Managers and Certification Regime (SMCR) in financial services provides a relevant model: individuals in senior roles are approved by regulators, pass a 'fit and proper' test, and adhere to a statement of responsibilities. A similar approach in gaming would require named individuals to be accountable not just for compliance, but for actively ensuring that commercial design choices do not override safety obligations.
Purpose
- An assessment of how core gameplay mechanics interact with psychological reward mechanisms, and whether those interactions create foreseeable risks of harm
- An assessment of how monetisation features are designed, including whether they use variable reward schedules, near-miss mechanics, artificial scarcity, or social pressure, and what risks these create for users, particularly children
- An assessment of how in-game social features could be exploited to facilitate contact between adults and children in ways that create risks of harm, including grooming and exploitation
Understanding hazards and mitigation
- Elimination: Remove features or system designs that create a foreseeable risk of harm; for example, removing loot box mechanics where risk cannot be mitigated to acceptable levels
- Substitution or design modification: Redesign features to reduce the likelihood or severity of harm; for example, replacing randomised reward mechanics with transparent progression systems
- Engineering and technical safeguards: Implement robust technical systems that limit or detect harmful behaviour
- Administrative controls: Actionable and upheld policies, moderation systems, and governance processes to manage risks
- User-level tools: Mechanisms enabling users to control their experience or respond to harm, noting that these are the weakest form of control and cannot substitute for design-level interventions
Trust and safety teams
Safety testing
- Pre-launch safety reviews of gameplay mechanics, monetisation features, and social functionality
- Adversarial testing and abuse scenario simulations, including scenarios in which adults attempt to use in-game social features to contact and groom children
- Testing of reporting and moderation systems under realistic load conditions
- Testing of age assurance and parental control mechanisms to ensure they are effective and not easily circumvented
Prohibited high-risk practices
Account creation
Default safety settings
- Auto-queuing for new matches immediately after a session ends: off by default
- Push notifications and alerts turned off by default, with sufficient granularity for users to choose notification types
- Daily login rewards and streak mechanics disabled for children
- Randomised reward features (loot boxes, gacha mechanics, mystery boxes) disabled for children; where they are available to adults, subject to the requirements set out in the monetisation design section of this code
- Limited-time offers and countdown timers: off by default for children
- Session exit and save: games must permit players to pause, save progress, and exit at any time without gameplay penalty. Any design that traps players in sessions by withholding save functionality, penalising early exit, or triggering adverse in-game consequences for logging off is a prohibited design feature. This includes mechanics that expire time-sensitive content during a session to coerce continued play.
- Artificial wait timers ("wait to play" mechanics): timers that arbitrarily gate gameplay progression, requiring the player to either wait or pay to continue, must be off by default for children, and must be clearly disclosed as a monetisation mechanism in the service's terms of service
Prohibition of dark patterns
- Virtual currency systems designed to obscure the real-money cost of in-game purchases
- Countdown timers creating artificial urgency around in-game purchases
- Near-miss mechanics in loot box or gacha systems designed to simulate the experience of almost winning
- "Pity mechanics" that encourage continued spending by promising a guaranteed reward after a defined number of unsuccessful attempts, where the cost of reaching the pity threshold is not clearly disclosed upfront
- Pre-selected spending options that default to higher amounts
- Removal of purchased content or progression without reasonable notice and compensation
- Deliberate manipulation of matchmaking systems to place free or low-spending players in unfavourable matches to encourage spending (engagement-optimised matchmaking, or "EOMM")
- Accidental purchase design: interfaces that make it easy to spend money without a clear confirmation step, or that remove the ability to undo or seek a refund for accidental in-game purchases
- Anchoring tricks: placing inexpensive items directly adjacent to expensive ones to make high-cost purchases appear more affordable by comparison
- Power creep: deliberately devaluing items that players have already purchased through the introduction of more powerful alternatives, as a mechanism to create renewed pressure to spend
- Pay walls: blocking access to content or gameplay progression that a player has a reasonable expectation of continuing, unless they make an additional payment not disclosed at the point of original purchase
- Waste aversion exploitation: deliberately selling premium currency in denominations that do not align with item prices, to ensure players routinely hold residual unspent currency
- Grinding as a monetisation vector: requiring players to perform repetitive tasks not as a core gameplay design choice but as a deliberate mechanism to make paid shortcuts appear desirable
- Infinite treadmill mechanics: designing games without any meaningful completion state as a deliberate strategy to maintain indefinite engagement and maximise lifetime spend
Psychological and temporal design risks
Monetisation design
In-game social features
Content creation and user-generated content
Risk assessment is central to safety by design. In gaming, this includes not only the content that users create and share, but the design of core gameplay and monetisation mechanics, areas that have historically been treated as purely commercial decisions but which the evidence increasingly shows create significant risks of harm.
The hierarchy of control is a significant element of safety by design. In the gaming context, this means that the presence of parental controls does not discharge a developer's responsibility to address the harm at source. A loot box mechanic does not become safe because a parent theoretically could set spending limits, any more than a dangerous fairground ride becomes safe because there is a sign advising parents to supervise their children.
The Ofcom commissioned report on children's financial harm and persuasive design features identifies gaming as a significant site of risk, identifying categories of harm-creating features relevant to gaming monetisation: risk-based (mystery rewards, features that visually resemble gambling mechanisms); dissociative (virtual currency systems that obscure spending); misleading (features that misrepresent the probability of obtaining desired items); impulsive (countdown timers, limited-time offers, flash sales); and social influence (squad mechanics, stark differences between default and paid cosmetic items).
Terms of service
Terms of service constitute the contract between the service provider and the user. In gaming, they should reflect the full reality of the service, including how monetisation features are designed and what psychological mechanisms they employ, not merely a list of prohibited player behaviours. A terms of service that says nothing about how loot box probabilities are calculated, or how virtual currency systems are designed, is failing in its transparency obligations.
Robust age assurance mechanisms
Age assurance in gaming presents distinct challenges compared to social media. Many games that children play regularly have no age restriction; a child of seven may legitimately play a PEGI-3 title. The safety risk is not access to the game itself but access to features within it: voice chat, direct messaging, in-game purchasing, and social features that enable contact with strangers.
An effective age assurance strategy for gaming must therefore operate at the feature level, not just the service level. A child's account on a gaming platform should carry protections that limit access to high-risk features regardless of the age rating of any individual game; those protections should be technically robust, not merely nominal.
Moderation
Moderation in gaming is meaningfully different from moderation in social media. The primary risks are often not in user-generated content but in the behaviour of users during gameplay, in real-time voice communications, and in direct messaging. Detecting grooming in a live voice chat during a multiplayer session is a significantly harder technical and operational challenge than detecting harmful content in a post or image.
The gaming industry has historically treated player safety as primarily a player behaviour problem, to be managed through terms of service, player reporting, and account bans. A safety-by-design approach requires services to also address the design of social features that create the conditions for harm, and to resource moderation commensurate with the scale and nature of risk.
User tools
Parental controls in gaming have historically been ineffective: technically complex to set up, easily circumvented, inconsistently implemented across platforms and titles, and poorly understood by parents. A safety-by-design approach requires parental controls to be genuinely effective by design: the default position for a child account should be the safest position, and changing that position should require active parental consent, not just parental inaction.
The ICO's Age-Appropriate Design Code sets a clear standard: services likely to be accessed by children should provide high privacy settings by default, with any less protective settings requiring clear parental consent. The same principle applies to spending controls, communication settings, and social features.
Transparency
Transparency in gaming has been notably poor, particularly around monetisation. Many gaming companies do not publish loot box probabilities, spending data, or information about how their monetisation systems are designed. Some jurisdictions, including China and several EU member states, have required mandatory disclosure of gacha and loot box probabilities. The UK has no such requirement, but this code treats such disclosure as a baseline transparency obligation.
Transparency about the design of engagement mechanics is equally important. A service that publishes how its matchmaking algorithm is designed, and what role (if any) spending history plays in matchmaking outcomes, is providing materially useful safety information. A service that refuses to disclose this information while its monetisation mechanics remain opaque should be treated with appropriate regulatory suspicion.
Redress mechanisms
The current state of redress in gaming is inadequate. Many companies have poor or no processes for addressing financial harm caused by their own monetisation design; parents who discover their children have made hundreds of pounds of in-game purchases often find refund requests rejected, and have limited recourse. A safety-by-design approach requires companies to take responsibility for harms created by their design choices, not merely for harms caused by player behaviour.
Decommissioning in gaming raises specific issues that do not arise in the same way for social media. Users of games often have substantial economic value tied to in-game purchases: virtual items, currencies, and progression that may be lost when a service shuts down. The practice of discontinuing "live service" games without adequate notice or compensation to players who have spent significant sums is a significant consumer harm, particularly where children are affected.
Services should ideally commit at the design stage to policies for handling player assets in the event of decommissioning, and should be transparent with users about those policies from the outset.
A note on references
The original Safety by Design Code of Practice (May 2026), on which this adaptation is based, contains a full set of footnotes and endnotes referencing the academic research, regulatory guidance, and case law underpinning its provisions. Those references have not been carried over into this gaming adaptation, as many cited sources relate specifically to social media contexts and would require replacement with gaming-specific equivalents before they could be relied upon.
Readers who wish to consult the underlying evidential and legal basis for the framework should refer to the original document:
Online Safety Act Network, Safety by Design: Code of Practice, May 2026
Available at: onlinesafetyact.net
This is an adaptation of the Safety by Design Code of Practice (May 2026), produced by the Online Safety Act Network, 5Rights Foundation, NSPCC and others, led by Professor Lorna Woods OBE. That document was written primarily with social media services in mind. This version applies the same framework, including the lifecycle approach, hierarchy of control, and governance structures, to online gaming services, which present a related but distinct risk profile. Where the original code applies without significant modification, it has been retained substantially unchanged. Where gaming presents different risks, different mechanisms, or different gaps in the regulatory framework, the text has been amended, expanded, or replaced. New sections with no equivalent in the original (particularly on monetisation design, in-game social features, and psychological design risks) have been drafted from scratch, informed by cross-referencing against the documented dark pattern taxonomy at darkpattern.games. Deletions and substitutions are not individually marked; this document is intended to stand on its own as a gaming-specific code.