California just signed AB 1709 – Game Industry Take Notice

I teach a session at USC on government regulation and the games business. In it I talk about CCPA, which arrived after GDPR in 2020. So here is my prediction … AB 1709 will be applied to games and distribution platforms like Steam!

AB 1709 was signed September 10 and it bars social media platforms from serving under-16’s features designed to maximize engagement in ways that foreseeably lead to compulsive use, at up to $50,000 per affected minor. It calls out notifications, feeds, endless scrolls, autoplay "and their functional equivalents," and lets the attorney general add to that list by regulation rather than by another bill.

The industry is reading it as a social media law. I’m telling you now it’s not only that.

GDPR moved data protection out of legal and into game design, because you cannot bolt consent onto a live-ops pipeline after the fact.

Then Apple deprecated the IDFA. Apple announced at WWDC in June 2020, delayed in September after industry pushback, and enforced App Tracking Transparency the following April. Opt-in landed below 20%, under 10% in tier-one markets, and worldwide mobile gaming spend fell roughly $8-10B a year from a 2021 peak near $120B to about $108B by 2023.

Per data.ai (Sensor Tower), mobile has not matched the number of new game releases seen in 2021. When acquisition becomes unpredictable, the rational move is to defend an existing game with first-party data rather than launch a new one. A privacy change repriced user acquisition and then quietly changed which games got greenlit.

The EU is already onto the next one, with the Digital Fairness Act, aimed at dark patterns and addictive design, loot boxes, due to be tabled this quarter.

Two things I take from eight years of this.

The change that hits your P&L usually comes from a platform, not a legislature. IDFA cost mobile games far more than GDPR did, and Apple was pre-empting a rule that did not exist. AB 1709's mechanic list is public now, and the platforms (Steam and others) have read it too.

The real cost lands on the roadmap, not the compliance budget. Post-IDFA the downturn was due to UA inefficiency, and the result was five years of fewer new games.

The definitions here are vague, and vagueness produces over-correction, since a daily streak or a battlepass can serve a player who wants a ritual rather than trap one who doesn't.

The studios that came through 2021 intact had already asked what their acquisition looked like without a device identifier. The question now is which retention mechanics you would defend and what changes now will you make to your live service games in anticipation of platform changes.