What does the Digital Services Act require from video games? What does it mean for Roblox?

What happened with Roblox

Regulation (EU) 2022/2065 reserves its most demanding section for platforms and search engines with an average of 45 million or more monthly active recipients in the Union (Article 33(1)). Roblox reported figures above that threshold (more than 46 million monthly users in the six months to March 2026, according to its own data), and on 31 August 2026 the Commission designated it a very large online platform alongside Reddit, the same day it designated ChatGPT a very large online search engine. Executive Vice-President Virkkunen summed it up in one sentence: they "will now be held to a higher standard of scrutiny and accountability in the European Union".

What it means in practice for Roblox: four months from notification of the designation (Article 33.6) to assess and mitigate the systemic risks of its service, with particular attention to users' physical and mental wellbeing and to negative effects on minors, annual independent audits, data access for vetted researchers and a recommendation option not based on profiling. Supervision is exercised by the Commission in cooperation with the Dutch Authority for Consumers and Markets.

For the rest of the sector the message is different: the Commission considers that a gaming platform with user-generated content is, for DSA purposes, the same as a social network. And the DSA's base regime applies many rungs below 45 million.

The DSA ladder: where your game with user-generated content (UGC) stands

The DSA does not regulate "video games". It regulates intermediary services and classifies them by what they do with their users' information:

• Hosting service: one that stores information provided by the user at their request. A game that keeps on its servers the avatars, messages, screenshots, maps or skins players create is one.
• Online platform: under Article 3(i), a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public, unless that activity is a minor and purely ancillary feature of another service. A game whose UGC hub makes available to all players what others create fits quite clearly. A private chat between two friends does not necessarily.
• Very large online platform: the above, from 45 million EU users and upon designation by the Commission.

The "minor and purely ancillary feature" exception is the one every studio tries to invoke, and it pays to be realistic: if UGC is an advertised feature, with a gallery, search and ratings, it is not ancillary. It is the product. We saw it from another angle with mods and the ownership of what players create: the studio that opens its game to others' creation gains community and gains obligations.

What it does not require: reviewing every upload

The DSA keeps the principle we already knew: the hosting provider is not liable for the information stored if it does not have actual knowledge of illegal activity or illegal content or if, upon obtaining such knowledge or awareness, it acts expeditiously to remove or disable access to it (Article 6(1)). There is no general monitoring obligation.

In other words: you do not have to review every skin before publishing it. You have to be in a position to find out and react quickly. And that is where the DSA adds what the old rules did not spell out.

What it does require: notify, explain, inform

Three obligations every game with UGC accessible from the EU already has (the first two, whatever its size):

• A notice mechanism allowing anyone to flag content they consider illegal, easy to access and use and by electronic means only (Article 16(1)). An in-game report button leading to a form with the minimum data.
• A clear and specific statement of reasons to any user whose content is removed, restricted or demoted, whether as illegal or as incompatible with the terms of service (Article 17(1)). Silently banning a creation no longer works: you have to explain which rule was breached and how to appeal.
• Transparency: clear terms on moderation and a point of contact. Periodic moderation reports are not required from micro and small enterprises (Article 15(2)). Online platforms that are not small add an internal complaint-handling system and the ban on dark patterns in the interface.

If your studio is small, the law lightens the load. The obligations specific to online platforms (Articles 19 to 28, including the protection of minors) do not apply to micro and small enterprises, that is, those with fewer than 50 staff and no more than EUR 10 million in annual turnover or balance sheet (Article 19(1), which refers to Recommendation 2003/361/EC). That covers most independent studios. That said, the notice mechanism and the statement of reasons bind everyone, whatever their size. And the exemption is lost twelve months after the studio stops being small, or straight away if the Commission designates it a very large online platform (Article 19(2)).

None of this is exotic: it is what we already recommended when going through the legal issues of creating a video game in 2026. What is new is that it is now directly applicable law, with an authority behind it.

Article 28: minors and the "18+" clause that does not work

For games, the decisive article is 28. Its first paragraph: providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their service. The second bans showing them profiling-based ads where the provider is aware with reasonable certainty that the user is a minor. And the third clarifies that compliance does not oblige processing more data to work out age.

The word that matters is "accessible". The platform is accessible to minors if they can in fact use it, not if the terms say they should not. An "over 18" clause buried in the terms, without any real measure, does not take the game out of Article 28. What takes the game out of Article 28 is minors not being able to get in, and that requires age assurance. It is the same logic we explained in minors' protection in video games and the one the future EU KIDS Act will tighten.

If your studio is a micro or small enterprise, Article 28 does not bind you (Article 19). That said, this does not leave minors unprotected in your game: consumer and data protection law and PEGI age rating still apply, and the Commission's guidelines remain the best guide to what doing it right looks like.

The July 2025 guidelines: what the Commission expects

Article 28(4) allows the Commission to issue guidelines, and it did so on 14 July 2025. They are non-binding and following them does not automatically guarantee compliance, but the Commission uses them to assess Article 28 and national authorities look at them as a reference. What they ask for:

• Age assurance: verification for adult content and gambling, and age estimation in other risk cases.
• Minors' accounts private by default: profile and content hidden from anyone not an accepted contact.
• Recommender systems that reduce exposure to harmful content and give more weight to the minor's explicit preferences.
• Addictive design: features that encourage excessive use, such as streaks, disabled by default, with safeguards for AI chatbots.
• Commercial practices that exploit children's limited commercial literacy, including "certain virtual currencies or loot-boxes" (the same ones PEGI already penalises in its ratings).
• Reporting and moderation with prompt feedback, and parental controls with minimum requirements.

If the list sounds familiar, it is because it is the same one that inspires the KIDS Act and the one the consumer network already applies to virtual currencies. EU regulation of minors is converging, and the studio that complies with one is on its way to complying with the others.

Generative AI multiplies the problem

There is a new factor the rules did not have in mind when drafted: AI creation tools. If your game lets players generate skins, maps or dialogue with a built-in generator, the volume of potentially infringing or harmful content explodes, and a single report button may fall short. Add the AI Act's duty to mark what the tool generates as artificial (its Article 50). A studio with UGC and AI has both rules on top of it at once, and moderation stops being a customer-service cost and becomes a design obligation.

Who supervises in Spain and what the fines are

Each Member State designates a Digital Services Coordinator. In Spain it is the CNMC, which supervises providers established here and cooperates with the Commission in very large platform cases. National sanctions can reach 6 % of the provider's worldwide annual turnover (Article 52(3)), the same cap the Commission applies to the large platforms.

What to do in your studio

• Classify your game on the DSA ladder, feature by feature: what you store from players and what you show to others. It is any authority's first question.
• Measure your size: with fewer than 50 staff and up to EUR 10 million in turnover or balance sheet, you are spared the platform-specific obligations (not the report button or the statement of reasons).
• Report button and form with the minimum data, visible from the content itself.
• Automatic statement of reasons on every removal or restriction, with the rule breached and the route to appeal.
• Terms of use with the moderation policy explained, and the annual moderation report if your studio is no longer small.
• If minors get in: private accounts by default, no profiled advertising, streaks off, parental controls and a serious decision on age assurance.
• If you have generative AI: marking of the content and moderation sized to the volume it generates.

Frequently asked questions

Sources

• Regulation (EU) 2022/2065 (Digital Services Act), Articles 3, 6, 16, 17, 28, 33 and 52 (EUR-Lex)
• European Commission guidelines on the protection of minors under Article 28 DSA, 14 July 2025
• European Commission, designation of ChatGPT, Reddit and Roblox under the DSA, 31 August 2026 (copy of the press release)
• Designation of Roblox, Reddit and ChatGPT under the DSA (PocketGamer.biz)
• CNMC, Digital Services Coordinator in Spain