Cookie consent for web and HTML5 games

This guide is general information, not legal advice. Cookie and tracking rules differ by country and change over time, so check the rules for the places where your players live.

A browser game page often loads far more than the game. An analytics script, an ad network, a font from a third-party server, a social button, and the game's own embed can each set cookies or collect data about the visitor. This guide explains what needs consent, how to see what your page really does, and how to build a consent banner that works. The privacy pieces behind it are in the COPPA and GDPR guide and the checklist.

What counts

The rules are not only about cookies. They cover cookies and similar technologies: local storage, session storage, IndexedDB, tracking pixels, device fingerprinting, and anything else that stores information on a visitor's device or reads it. In the EU and UK the main rule is ePrivacy, backed by GDPR for the personal data involved. Several other places have their own rules.

The useful split is between what the game needs and what you want to know about it:

• Strictly necessary. Storing a save game, remembering volume settings, keeping a login session, or keeping security tokens. These are generally fine without asking when they do what the visitor asked for, but they should still be described in your privacy policy.
• Everything else. Analytics, advertising, social media trackers, embedded video that sets its own cookies, A/B testing, and anything that follows people across sites. In the EU and UK this needs consent before it runs. In some other places it needs a clear notice and a way to opt out.

If you are not sure which side something falls on, treat it as non-essential and put it behind consent. Asking is cheap. Being wrong is not.

Step 1: find out what really loads

You cannot write a correct banner without knowing this, and most developers are surprised.

1. Open your game page in a private browser window, so there are no saved cookies.
2. Open the developer tools and go to the Network tab, then reload. Note every address that is not yours.
3. Open the Application tab (or Storage) and list the cookies and local storage entries set before you click anything.
4. Do this again after you play for a minute, because many scripts load later.

Write down each third party, what it is for, and whether the game works without it. This is also the list you need for your privacy policy. Remember that a page can inherit trackers from an iframe or an embedded widget you did not write.

Step 2: decide what to keep

The simplest way to be compliant is to need less. Remove anything you do not use, replace a heavy tracker with a simpler analytics tool, and host fonts and files yourself where you can. Fewer third parties also means a faster page and a shorter policy.

If your game is aimed at children, the answer is stricter. Do not run behavioral advertising or tracking for them at all, and configure every ad network in its child-directed mode. A banner does not fix that, because a child cannot give valid consent to tracking. See the COPPA section of the guide above.

Step 3: build the banner so it works

A consent banner is only useful if it changes what the page does. These are the points that decide whether it is real or decoration.

• Nothing non-essential runs first. Do not load analytics or ad scripts, or set their cookies, until the visitor accepts. Loading the script and "blocking" it afterwards is not enough.
• Declining is as easy as accepting. Put "Decline" next to "Accept", with the same size and weight. Do not hide it behind a settings screen, and do not pre-tick boxes.
• Say what it is for. Short plain wording, with a link to your privacy policy. "We use analytics cookies to see how the game is used. They stay off unless you accept."
• Remember the choice, but not forever. Store the answer in the browser, and ask again after a sensible time or when you add a new tracker.
• Let people change their mind. A link in the footer, such as "Cookie settings", that reopens the choice. Withdrawing consent should be as easy as giving it.
• Respect browser signals. Treating a Global Privacy Control or Do Not Track signal as a "no" is good practice, and in some places it is a legal requirement.
• Do not block the game. The visitor should be able to play whichever answer they give, unless the tracking is truly necessary to deliver the game.

An example you can look at

This website works this way. Google Analytics does not load at all until you accept the banner. Declining works the same way as not answering. A browser that sends a Global Privacy Control or Do Not Track signal is treated as having declined, and the footer has a "Cookie settings" link to change your choice. You can read how it is described in our privacy policy.

Step 4: test it

1. Open the page in a fresh private window and look at the Network and Application tabs before you touch the banner. No analytics or ad requests should appear.
2. Click Decline and reload. Still nothing should load.
3. Click Accept and check that your analytics now work.
4. Use the footer link to change the answer, and confirm the cookies and requests stop again.
5. Repeat on a phone, because banners that cover the game or the buttons are a common mobile problem.

Games on other people's sites

If your game is embedded on a platform such as itch.io, the platform controls the page around it, and you control what your game itself loads. Keep your game's own scripts to what it needs, avoid trackers inside it unless you have a way to ask for consent, and say in your store description what the game does. If your game talks to a server or uses online features, link your privacy policy from inside the game. The privacy policy guide shows what to put in it.

A short checklist

• You know every cookie and tracker your page sets.
• Non-essential ones are off until the visitor accepts.
• Declining is as easy as accepting, and the choice can be changed at any time.
• Children's games run no tracking or behavioral ads.
• Your privacy policy describes what is left.

Tick these off with the COPPA and GDPR checklist, choosing "Your own website or HTML5 game" as the platform.