Privacy-safe analytics
"We might need it someday"
Kai has an idea: "Let's record every tap, with each player's age, town and friend list. We might need it someday."
Theo, the studio's data analyst, says no, and data protection law agrees. Many of Shard Garden's players are 10 to 12. Every piece of data about them is something the studio must protect, and some of it the studio should never collect at all.
Collect what you need
Under the UK GDPR, personal data must be adequate, relevant and limited to what is necessary for its purpose. This is data minimisation.
The UK regulator, the ICO, says you must not collect personal data on the off-chance it might be useful in the future, and should regularly review what you hold and delete what you don't need.
Theo's tracking plan already asks of every event: what question does this answer?
Tracking plan
Which parameters belong in the level_shared event?
- level_id and method
- level_id, the player's town and age
- level_id and the name of the friend it was sent to
Show the answer
level_id and method
The question is how levels are shared, and level_id and method answer it. Town, age and friends' names are personal data the question doesn't need.
The Children's code
The ICO's Children's code sets 15 standards for online services children are likely to use. Two matter here:
- Data minimisation: collect and keep only the minimum personal data needed for the parts of the service a child is actively and knowingly using.
- Nudge techniques: don't use design to lead children to give unnecessary data or turn off privacy protections.
The ICO's example: tracking location on a map is fine while it's used, not after it's closed.
COPPA and analytics
In the US, COPPA covers services aimed at children under 13, or that know they collect personal information from them. That includes a persistent identifier that can recognise a user over time.
The FTC says such IDs need no parental consent when used only for internal operations, like optimisation, statistical reporting and debugging, and no other personal information is collected. They must not be used to contact one person, for behavioural ads, or to build a profile of one person.
Quick check
Under COPPA, the studio may use a child's install ID to build a profile of their habits for targeted ads, because it is only an ID, not a name.
- True
- False
Show the answer
False
COPPA counts persistent identifiers as personal information. The internal operations exception never covers behavioural advertising or building a profile of one person.
Pseudonymous is not anonymous
The ICO says pseudonymised data, where a reference number replaces a name, is still personal data for anyone who can link it back. So user_pseudo_id in the warehouse is personal data.
The ICO also warns about singling out: picking out one person in data, even without a name.
Theo's rules: dashboards show counts of groups, never rows of players. Any group smaller than 20 players shows as "fewer than 20". Raw events with IDs expire after 14 months, and nobody exports them to a laptop.
True story: Xbox and children's data
On 5 June 2023, the FTC announced that Microsoft would pay $20 million to settle charges that it collected personal information from children who signed up for Xbox, without telling their parents or getting their consent.
It also kept the data, sometimes for years, even when a parent never finished setting up the account. The data included names, email addresses and dates of birth. The order requires Microsoft to delete such data within two weeks if consent never arrives.
Data you never keep can't be misused.
Source: FTC: Microsoft to pay $20 million over children's data (2023), ftc.gov
Spot the risk
1eu 10-12 18,4022na 10-12 21,9773oc 10-12 2
What should Theo change before this goes on the dashboard?
- Show the small group as "fewer than 20", so no child can be singled out
- Nothing, these are only counts
- Add the two players' IDs so the team can check them
Show the answer
Show the small group as "fewer than 20", so no child can be singled out
A group of 2 is close to naming two children: anyone who knows a player there could work out what they did. Small groups are hidden or merged.
Players who drift away
The last question is the most tempting to get wrong: spotting players who are about to stop playing, and deciding what to do about it.
Bolt says: Next: predicting churn, kindly.
Fact-checked 11 October 2026
- ICO: Principle (c) data minimisation ico.org.uk
- ICO: Age appropriate design code ico.org.uk
- ICO Children's code: 8. Data minimisation ico.org.uk
- ICO Children's code: 13. Nudge techniques ico.org.uk
- FTC: Complying with COPPA, frequently asked questions ftc.gov
- ICO: Pseudonymisation ico.org.uk
- ICO: How do we ensure anonymisation is effective? ico.org.uk
- FTC: Microsoft to pay $20 million over children's data (2023) ftc.gov