[reedf1]

From the perspective of someone with some experience in consumer advocacy via the EU is that SKG did not do this the right way, or at least the right way right now. The EU expects radical compromise. The right starting point for SKG was to enter talks with games industry lobby groups to discuss possible solutions. If that fails - you will need to be able to prove that it isn't because you were unable to compromise. Your next step is to find individual game developers and publishers who agree with your proposals and can back them at some (hopefully negotiated) level. Any one-sided proposal is a non-starter.

The EU will view this this from the perspective of balancing the rights of its citizen workers/producers (game developers) and its citizen consumers.

[woolion]

1. The standard of compromise makes no sense because there "the video-game industry" is not a company with a representative. Any compromise you could find would be dismissed on the basis that it's one lobby groups among others anyway.

2. The statements made by somewhat representative groups like the ESA showed any compromise was impossible since their whole premise is "if you don't let us kill games (which we aren't doing) then it's going to kill the industry"; the typical propaganda of "our enemies are insignificant and stupid yet the greatest threat to humanity"

3. The ESA statements were disavowed by some developers, and SKG made a point to have longer videos with developers agreeing and debunking the lies in the ESA statements already. If that's not enough, refer to point 1.

>rights of its citizen workers/producers

The whole point is that the basis of commerce is that you can't sell something and destroy it just afterwards. Sure you can have limited time subscriptions but that's not how video-games are sold. They are changing the definition based on context so they can do the most unethical things as they see fit, and as a result they are entirely destroying the industry by breaking consumer trust.

[eskori]

Completely agree with the first point; it would have been great showing a list of supporters from the game industry. Not that I am an expert in this matter, though.

However:

> The EU will view this from the perspective of balancing the rights of its citizen workers/producers (game developers) and its citizen consumers.

How could SKG be an attack on gamedevs? What changes in the life of someone in gamedev if the online game their company has them working on provides a self-hostable server or offline functionality once they finally stop working on it?

I guess we could argue that game companies may get less revenue because users will keep playing older games that no longer produce money, and I am not keen on "perpetual games," which could impact the workers of that company... But this is a highly abusive practice. Sure, gambling makes salaries for workers around the world, but that is no excuse to keep perpetuating such an abusive industry.

This is no attack; I am genuinely curious, and I might be wrong on everything :)

[drorco]

If you're actually curious, to gate a taste of the cost of compliance, I recommend taking a look into the different standards for website accessibility, GDPR, etc. On paper it sounds great, who doesn't want a accessible websites or privacy? But in practice it's a total drain of resources, real legal risk even if you genuinely try and be compliant, and often you just pay a lot of $$$ for legal, compliance advisors etc. so you could tick off a box and have some sort of insurance in case you're being sued.

Now you probably don't have a lot of empathy for big corps, but those laws often apply for small businesses as well (why wouldn't they?) and now imagine the struggling indie dev now also having to deal with another legal compliance so they won't lose their house to a legal troll, when they just struggle to get a game out there they have no idea if it's even going to ever be successful.

[acron0]

I don't really buy this. From my personal experience, indie devs are more likely to use methods which make their server tech distributable (e.g. Minecraft). Large game publishers appear to go in the opposite direction for control and lineage reasons: "Crew 1 is dead so you need to buy Crew 2 now".

Anyone who gamed before 2005 knows that games do not require magic, expensive, managed remote services. We all used to run our own servers! The GameSpy era!

[drorco]

Well I'm talking from experience as a mobile indie game developer.

Pretty much every year I'm getting warnings from Apple or Google, or 3rd party SDKs, that unless I make sure to update libraries, or comply with a new rule, they are going to take down the game.

One of the latest rules was some sort of a digital services act (again another regulation) that made it very difficult for indie devs not to share their personal address and phone numbers.

[drbscl]

That's not related to SKG though, that's storefront policy.

In principle, as long as _you_ are not blocking using the binary on hardware that supports (i.e. a player already has it installed on an old phone), you're in the clear.

SKG is explicitly _not_ advocating for lifetime support, compatibility with new devices, etc

[drorco]

But there are 3rd party SDKs that rely on outside servers that will stop working and the app could have unexpected behavior. It doesn't have to be complete crash, but it might be enough to degrade functionality to a point where some players might say the game is unplayable etc.

Being bootstrapped with no investors, there's no extra resources, and no financial benefit in making sure that the app can function well even with these 3rd party services, servers etc. not working.

[JimDabell]

> I recommend taking a look into the different standards for website accessibility, GDPR, etc. On paper it sounds great, who doesn't want an accessible websites or privacy? But in practice it's a total drain of resources, real legal risk even if you genuinely try and be compliant, and often you just pay a lot of $$$ for legal, compliance advisors etc. so you could tick off a box and have some sort of insurance in case you're being sued.

This is a really good analogy, except you made one mistake: it’s not difficult at all to design something to be accessible and respectful of privacy as long as you do it from the start. If you try to build something inaccessible and privacy-invading then get caught and have to retrofit accessibility and privacy at the last minute to avoid fines and lawsuits, that’s when it becomes difficult.

And you see this exact mistake crop up in the Stop Killing Games criticism as well. People say that it’s difficult because they are thinking about taking the status quo and retrofitting longevity. For instance, trying to retroactively obtain licenses to distribute components that they didn’t originally have. When in practice, the effect of a law like this is that it would push game developers to make the right choices up front like picking appropriately licensed components, so there’s no barrier to keeping the game alive when the time comes to cease support.

It might also have escaped your attention that the EU was perfectly willing to create accessibility and privacy regulations, so if you are likening Stop Killing Games to these things then it stands to reason that this is not a reason for the EU to avoid Stop Killing Games legislation.

[drorco]

This is my second business after already having experience with GDPR. Thinking of it in advance does make it easier but it can definitely still break a business and it's not a trivial cost. Moreover, it's still changing frequently, just about 2 years ago there was a major change were asking for simple consent was not good enough and now there's a whole CMP TCF2 protocol you have to implement. From research I made, the tools that provide good coverage are not cheap, I pay a lot of money for these services, and they are also 3rd parties that without them the game experience might degrade. Just a little example, if the privacy consent service times out, the game load time increases to about ~10s at least.

Moreover, I have to also pay a company just to be my representative in the EU and have a stupid email address that is completely useless.

I don't know these things definitely don't make my appreciate regulations, and I think if you want to add more layers of regulation, you have to be really thoughtful about them, because often like DRM, eventually they screw the little guys more than they screw the bad actors.

[JimDabell]

> Thinking of it in advance does make it easier but it can definitely still break a business

If privacy regulations can break your business, then I think there’s a very high chance what you are doing is exactly the sort of thing the regulations are explicitly designed to discourage.

> now there's a whole CMP TCF2 protocol you have to implement.

That’s exactly what I’m talking about. There’s no regulation saying you have to implement that. That’s a consequence of you making the choice to trade user data. Somebody who does not choose to do that has much less work to do. This is an example of the regulations working as intended. You’re supposed to see the friction and make better choices up front to avoid it, not make the same choices then complain about the friction.

> eventually they screw the little guys more than they screw the bad actors.

Little guys are often the bad actors.

[drorco]

If I have to watch ads, I personally prefer personalized ads as they waste less of my time if I happen to see an ad for something I would actually want. I think generally, scaring people with "oh noes they'll have your annonymuized data" is not that dissimilar from scaring about radiation radiation from their wifi router.

Anyway, the discussion was about the harms of regulations and why developers would resist these. I personally know several indie mobile developers that had games that their core business model was ad monetization, and the regulation made these businesses less viable, and it's likely that players who enjoyed these kind of games, will now see less of these indie games.

I personally think this regulation does more harm then good for small businesses and players alike. I think legeslation has to be super careful when it comes to regulating businesses, anytime I had to deal with compliance around accessibility, privacy, transparency etc. I saw how intentions were good, but execution was absolutely terrible, with so many holes that the ones who benefit the most are the big companies that can workaround these clauses, while good intentioned small businesses need to spend money on compliance before they even know if the business is going to be viable.

[pdpi]

The GDPR is almost trivial to comply with if you’re not harvesting data willy-nilly.

Likewise, the legal risk for small indie games here rounds to zero. Most such games will, at worst, lose access to online leaderboards if their developers shut them down.

[drorco]

I'm a developer of a mobile indie game and it's not true. Just to get started you need to implement tons of third part SDKs like Meta Ads, AdMob, Google Analytics, etc. These require actual handling of player choices, data sanitation etc. disregarding the loss of revenue with not being able to serve personalized ads, or even ads at all to large segments of players. And I'm talking about strictly optional rewarded ads.

These already harmed a lot of small mobile game companies, while the bigger mobile companies had much better means to deal with these.

I personally paid over $10K for different services just to comply, disregarding the loss of revenue over this compliance.

[acron0]

Maybe don't fill your games with ads and release them on restrictive, exploitative platforms?

[drorco]

Did you ever build a commercial project or any business yourself? The nature of your comment implies to me you haven't. I highly recommend you give it a try, it might actually change your mind!

[hobofan]

aka "don't make games that anyone has the chance of playing"

[archievillain]

Your videogame is a data-harvester for the purpose of ad-serving, why on Earth would GDPR compliance be easy for you? It sucks that the mobile market is essentially just a glittery front over privacy invasion vectors, but just because it's normalized it doesn't mean it's right. "Serving third party ads" is exactly the kind of thing the GDPR exists to regulate harshly.

[drorco]

That's cool and all, I really don't have a problem with the requirement to tell players to their face that if they play the game for free, they are sharing their data and preferences with 3rd parties. Denying content creators the ability to (a) restrict content to free loaders who refuse, (b) forcing companies to pay for services that so they could reasonably comply, mostly because the legal language is so ambiguous and broad, is something I do not appreciate.

[adrian17]

> The GDPR is almost trivial to comply with if you’re not harvesting data willy-nilly.

I buy a VPS. I apt install nginx. Is it okay that by default, opening http://IP/index.html logs the IP address to /etc/log/nginx/access.log? Maybe yes, maybe no, maybe yes but I need a privacy policy (for an empty index.html). Maybe I need to ask a lawyer (who usually errs on side of caution) because people have been arguing about it for 10 years (and please don't answer here). And in the end, even if I didn't need to do anything, it sure is _some_ nonzero drain of my resources to have think about it at all (completely ignoring whether it's justified or not).

[esterna]

This hinges on two misunderstandings:

- That data processing always requires consent. There are exactly six reasons for storing or processing data: consent, contract fulfillment, legal compliance, vital interests of a natural person, public interest/official authority, or legitimate interest. Collecting IP addresses can be a legitimate interest, but:

- The real interesting question is what you do with the IP addresses after they're stored in a file. Securing your server is a legitimate interest. Tracking your users is generally not. Having lawfully collected data is not a carte blanche to do anything you choose with it.

[za_creature]

> Is it okay that by default [...] ?

Yes. IP addresses by themselves are not PII and may be logged indefinitely. It's only after you start correlating them with other shit that you're collecting that they become subject to GDPR.

Same for cookies really. If you *only* operate a shopping cart, you don't have to display a cookie notice for "only technically required cookies". The point of the cookie notice is to dark pattern users into granting more access or just to annoy them enough that they continue not caring about privacy.

[pdpi]

Consider for a moment that end-to-end encrypted messaging protects criminals of all sorts. Surely that’s a bad thing and requiring back doors for law enforcement shouldn’t be considered an attack on anybody?

I absolutely agree that the practices SKG are fighting against are pretty abusive and that it is right and proper to restrict those practices, but I also understand why people see the appeal in anti-e2ee laws.

The thing is, I have a good-enough understanding of cryptography to see why those laws are a terrible idea, and I’m infuriated by how clueless their supporters are. I’m self-aware enough to realise that I might the clueless one here and that me not seeing any legitimate issue with SKG doesn’t mean there isn’t one.