Game Privacy Policy Template: COPPA & GDPR Ready (2026)
Game Privacy Policy Template: COPPA & GDPR Ready (2026)
This template was built while writing the privacy policy for a real game in development (Merge Fish 2048, a Phaser 3.90 + Vite 2048-style merge game). It reflects the actual data inventory of that game — no hypotheticals. Regulatory facts were checked against FTC, GDPR (EUR-Lex) and CrazyGames developer documentation in September 2026. This is informational, not legal advice — have a lawyer review before shipping.
TL;DR
- A privacy policy is a data inventory in prose. Before writing a word, list everything your game collects — including what third-party SDKs collect on your behalf. If you collect nothing beyond a local save file and a platform SDK’s standard events, the policy is short and the risk is low.
- COPPA got stricter in 2026: the FTC’s 2025 amendments (compliance deadline April 22, 2026) expanded what counts as personal information, put third-party SDKs and ad networks inside your responsibility, and raised the bar for parental consent. “We don’t ask for age” no longer gets you out of it.
- The cheapest compliant game is the one that collects least. Merge Fish 2048 stores four keys in the player’s own browser (no account, no email, no analytics ID we control) and delegates ad events to the CrazyGames SDK. Data minimization made the policy — and the compliance review — a page and a half, not a legal project.
What a game privacy policy is & why it matters now
A privacy policy is a legally required disclosure of what personal information your game collects, why, it’s shared with whom, and what rights players have. It is not a legal nicety: the FTC publishes a six-step COPPA compliance plan for businesses, and enforcement has reached landmark game cases — Epic Games paid over half a billion dollars in 2022 over Fortnite’s collection of children’s data without parental consent, and in 2025 a Genshin Impact developer settled for $20 million plus a ban on selling lootboxes to under-16s without parental consent.
Why it matters in 2026 specifically:
- The FTC’s 2025 COPPA amendments hit their compliance deadline on April 22, 2026. Biometric identifiers now count as personal information; third-party data disclosures are squarely in scope (you’re responsible for your ad SDK’s compliance, not just your own code); low-friction consent flows like email-plus-confirmation may no longer satisfy the rule; and the “actual knowledge” standard was expanded so that a lack of age collection is not a defense.
- GDPR applies outside the EU. If your game is offered to EU players or monitors their behavior, GDPR applies regardless of where you live — and games process more “personal data” than many developers think. The GDPR text (Regulation 2016/679) defines personal data broadly, and EU regulators’ 2026 video-game guidance (Spanish AEPD + Belgian APD joint recommendations) treats player telemetry, IP addresses and behavioral tracking as personal data.
- Portals require it. CrazyGames’ technical requirements: if your game collects any personal data beyond the SDK’s own events, you must show new players a Terms & Conditions / Privacy Policy notice (they recommend a simple notice, not a blocking pop-up).
Decision framework: do a data inventory first
Before writing policy text, write down everything your game touches. Use this table as your inventory — it’s the one we used for Merge Fish 2048.
| # | Data point | Where it lives | Collected by you or a third party? | Personal data? | Required in policy? |
|---|---|---|---|---|---|
| 1 | Save progress (score, settings, stats) | Player’s browser (localStorage) | You | No (stays on device, no identifier) | Disclose as local data |
| 2 | Ad impressions / rewarded views | Platform SDK events | Third party (e.g. CrazyGames) | Possibly (platform collects) | Yes — name the SDK/platform |
| 3 | Email / account | Your backend | You | Yes | Yes |
| 4 | Analytics / telemetry (session, IP) | Analytics SDK | Third party | Yes (IP, singling-out) | Yes — name the provider |
| 5 | Payment details | Store/payment processor | Third party | Yes | Yes (name processor) |
| 6 | Chat / UGC / social features | Your backend | You | Yes | Yes — plus moderation duties |
| 7 | Device identifiers / advertising IDs | Ad SDK | Third party | Yes (under COPPA 2025 amendments) | Yes |
Rule of thumb: if it’s in the table, it’s in the policy. A row you can’t honestly fill in (e.g. “we don’t know what the ad SDK sends”) is a red flag — go read the SDK’s documentation and fill it in.
The template: copy-ready sections
Below is the structure our policy uses. Keep the exact section order; replace the bracketed parts. Every section exists because a regulation or platform rule requires it — nothing here is decorative.
# PRIVACY POLICY — Merge Fish 2048
Last updated: September 12, 2026
## 1. Who we are
ruofan, contact: youhuanyuan@163.com. We develop and publish Merge Fish 2048, a free-to-play HTML5 game playable in browsers.
## 2. What we collect and why
We collect as little as possible:
- Local game data. Your score, settings and statistics are stored only in your
own browser (localStorage) and never leave your device. We cannot see or
access this data: best score, music/sound settings, and per-mode play counts.
- Ad-related data. The game shows advertising through the CrazyGames SDK.
That SDK may collect information about your device and ad interactions
according to its own policy, linked below.
We do not require an account, email address or payment information to play.
## 3. Third parties
- CrazyGames SDK — privacy policy: https://www.crazygames.com/privacy-policy
We are not responsible for the practices of third parties; their policies
govern their processing.
## 4. Children's privacy (COPPA)
Merge Fish 2048 is a casual game that may appeal to children under 13.
We do not collect personal information from any player, including children.
To the extent the CrazyGames SDK processes data, it operates as an
independent controller under its own policy.
If you are a parent and believe your child has provided us personal
information, contact us at youhuanyuan@163.com and we will delete it.
## 5. Your rights (GDPR)
If you are in the EEA/UK, you may request access to, correction of, or
deletion of personal data we hold about you, and object to or restrict
processing. Email youhuanyuan@163.com. We respond within 30 days.
## 6. Data retention and security
Local game data stays on your device until you clear it. We apply reasonable
technical and organizational measures appropriate to the data we hold.
## 7. Changes
We may update this policy; the date above changes, and significant updates
are notified in-game or via the platform.
## 8. Contact
Questions: youhuanyuan@163.com. We aim to reply within 5 business days.That’s the whole policy for a data-minimal game. Notice what’s not in it: no section on cookies (we set none), no account deletion flow (no accounts), no international transfers (nothing leaves the device except SDK events).
COPPA vs GDPR: the comparison table
| Dimension | COPPA (US) | GDPR (EU/EEA) |
|---|---|---|
| Who it protects | Children under 13 | Everyone, incl. children under 16 (13-16 per member state) |
| When it applies | Child-directed service, or actual knowledge of under-13 users | Offering services to EU users or monitoring their behavior |
| Core obligation | Verifiable parental consent before collection | Lawful basis (consent, contract, legitimate interest), transparent notice |
| Data minimization | Explicitly required (2025 amendments) | Explicitly required (Art. 5(1)(c)) |
| Third-party SDKs | Your responsibility (2025 amendments) | Controllers/processors framework — you must have DPAs in place |
| Enforcement examples | Epic >$520M (2022), Genshin $20M (2025), record penalty $275M | National DPA fines (up to €20M or 4% of global turnover) |
| Practical posture for indies | Collect nothing from under-13s, or gate + VPC | Name everything, give rights, keep the policy honest |
Hands-on: Merge Fish 2048’s actual data inventory
Here is the real inventory the policy above was built from — every line is checkable in the codebase.
What the game stores (localStorage, four keys):
| Key | Content |
|---|---|
mergefish_best_score | Highest score |
mergefish_music_on | Music toggle |
mergefish_sfx_on | Sound toggle |
mergefish_game_stats | Per-mode play counts |
All four live in the player’s browser only (see our localStorage guide for the storage pattern). There is no server, no account, no email, no analytics ID that we control — so the “what we collect” section is short by design, not by accident.
What the SDK does: the game runs the CrazyGames SDK for rewarded ads (RewardManager — see our monetization guide). The SDK transmits standard platform events; the CrazyGames privacy policy governs that processing. We don’t add our own tracking on top.
Three lessons from doing this for real:
- Data minimization is a design choice, not a cost. Because the game never had an account or analytics layer, the compliance review was: check the four localStorage keys, check the SDK link, done. Removing a feature to avoid a regulation is almost always cheaper than complying with that regulation.
- SDK documentation is part of your privacy review. We read CrazyGames’ technical requirements before writing the policy: if we collected data beyond SDK events, we’d be required to show a privacy notice to new players. Our design (no extra collection) kept that requirement off the critical path — but we still link the platform’s policy because ad events are processed by them.
- Don’t copy a “universal” template. Most online game-privacy templates are written for games with accounts, analytics, chat and payments. Copying one means your policy promises things you don’t do (or — worse — fails to disclose things you do). Build from your own inventory; the template above is the minimal skeleton, not a wall of text to fill.
FAQ
Q: Does a small HTML5 game really need a privacy policy? A: If it’s on a platform like CrazyGames, yes — their developer terms require a notice when you collect personal data beyond SDK events, and even the SDK’s own event processing is governed by their policy. If your game collects nothing and runs no third-party SDK, a short policy is still good practice and often required by portals or ad networks regardless.
Q: Can I use a free online privacy policy generator? A: You can, with two caveats: (1) generic generators write for apps with accounts/analytics/payments — you’ll be disclosing things your game doesn’t do, which is a legal liability in the other direction; (2) generators can’t know what your SDKs actually collect, and that’s exactly what COPPA 2025 now holds you responsible for. A short, honest, game-specific policy built from your own data inventory beats a long generated one.
Q: My game doesn’t ask for age. Does COPPA still apply? A: Possibly yes. The 2025 amendments expanded the “actual knowledge” standard, and regulators look at factors like art style, theme and features (chat, social) to judge whether a service is child-directed — not just what your age gate asks. If your game is casual and cartoony, assume COPPA applies and design accordingly (collect nothing, or gate + verifiable parental consent).
Q: Is the ad SDK’s data collection my responsibility? A: Under the 2025 COPPA amendments, largely yes — third-party integrations are explicitly in scope. You should know what your ad SDK transmits, disclose it in your policy, and ensure the ad network’s configuration doesn’t serve personalized ads to under-13 users if your game is child-directed.
Q: Can an individual developer actually be fined? A: Yes — COPPA penalties and GDPR fines apply to natural persons, not just companies. That said, enforcement history shows regulators prioritizing the largest harms (the record cases are Fortnite and Genshin-scale). For an indie, the practical risk management is: collect nothing you don’t need, be honest in the policy, and fix a complaint fast.
Conclusion: a 3-step action plan
- Inventory first, write second. List every data point your game touches (including SDKs), fill in the table from the decision framework above. If a row says “we don’t know”, go read the SDK docs — that’s your homework.
- Write the short honest policy. Use the template, delete the sections that don’t apply, add the rows that do. Have a lawyer skim it if you can — it’s a 30-minute review for them and real protection for you.
- Wire it into the game. Link the policy where players can find it (in-game menu, platform submission, your website). On CrazyGames, add the required notice if you collect beyond SDK events — and keep it a simple notice, not a blocking pop-up.
Written by ruofan, an indie HTML5 game developer documenting the journey of building his first game. Regulatory facts from FTC guidance and press releases, EUR-Lex GDPR text, and CrazyGames developer documentation (September 2026); verify before relying on them. This article is not legal advice and contains no affiliate links.