THE INTRODUCTION: RISE OF DIGITAL GAMING AND EMERGING PRIVACY CONCERNS
The exponential growth of digital gaming platforms has transformed the global entertainment landscape into a data-intensive digital ecosystem. From mobile gaming applications to cloud-based multiplayer environments, gaming platforms today rely heavily on the large-scale collection and processing of personal data to enhance user engagement and monetization models.1 Modern games frequently collect behavioural analytics, device identifiers, geolocation data, financial details, and in some cases biometric information, making data privacy and user protection central legal concerns.2 As gaming services increasingly integrate social networking features, in-game purchases, and real-time communication tools, the volume and sensitivity of user data have substantially expanded.
This transformation has raised critical questions regarding informed consent, transparency in data processing, profiling practices, and safeguards for minors who constitute a significant portion of gaming users. While jurisdictions such as India, the United States, and the United Kingdom have developed distinct regulatory responses to emerging digital privacy challenges, the global nature of gaming platforms often results in regulatory inconsistencies and enforcement gaps. The absence of uniform standards enables platforms to operate across borders with varying compliance obligations, potentially weakening user protection mechanisms.
In particular, the evolution of behavioural targeting, algorithmic personalization, and loot-box monetization strategies has intensified concerns about exploitative design practices and excessive data extraction. Consequently, a comparative legal analysis becomes essential to assess how different data protection regimes address the unique risks posed by digital gaming ecosystems. This study examines the legal frameworks governing data privacy and user protection, highlighting regulatory strengths, structural gaps, and the need for harmonized standards in an increasingly interconnected digital gaming environment.3
LEGAL AND REGULATORY FRAMEWORKS GOVERNING DATA PRIVACY IN GAMING PLATFORMS
Digital gaming platforms, whether mobile apps, consoles, PC environments, or cloud, based ecosystems, collect extensive personal data, ranging from usernames and payment information to highly sensitive behavioural, biometric, and geolocation data. Since the gaming audience is mostly comprised of minors and young adults, the regulatory environment has changed a lot in different countries to protect the users from privacy breaches, profiling, and being abused through data practices. Legal frameworks in India, the USA, the UK, and Australia represent different regulatory philosophies, enforcement capacities, and data, protection law maturity levels.
A. India: DPDP Act 2023 and IT Rules Framework
India’s main data protection legislation is the Digital Personal Data Protection Act, 2023 (DPDP Act). 4The law, while being technology, neutral, fully applies to gaming platforms that involve the processing of digital personal data. The key obligations are lawful and clear consent, giving notice that specifies the purpose of data use, data minimization, withdrawal of consent, and children’s data protection via more stringent requirements like verifiable parental consent.
In addition, gaming platforms that are situated in India are required to comply with the Information Technology Act, 20005 and the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021, which lay down the due, diligence obligations of intermediaries, such as grievance redressal, data security practices, and content moderation norms.
Interestingly, India does not yet regulate behavioural profiling, loot, box based data collection, or algorithmic recommendations, though forthcoming rules under the DPDP Act might address these areas.
Cross, border data transfer is allowed but it has to follow government, notified restrictions. A Data Protection Board is at the center of enforcement in charge of issuing penalties for non, compliance. In general, India’s system is halfway there, a transition period where you can see the promise but also the sector, specific clarity for gaming ecosystems is still unfolding.
B. United States: Sectoral, Enforcement-Driven Model
The United States of America does not have any all, encompassing federal law that governs data protection. As a result, the regulatory framework for gaming platforms is composed of a mixture of laws at the federal and state levels, and also the regulatory activities of agencies like the Federal Trade Commission (FTC).6
Key federal laws impacting gaming platforms include:
• Children’s Online Privacy Protection Act (COPPA): This act is very strict about the collection of data about children under 13 years old. It requires a parental consent that can be verified and also has limitations in the targeted advertising directed to children. It is very important, because the majority of users in the gaming environment are children.
• Federal Trade Commission Act (Section 5): Prohibits unfair or deceptive data-processing practices. The FTC frequently investigates gaming companies for misleading privacy notices or unfair data collection.7
State laws, with a major emphasis on the California Consumer Privacy Act (CCPA) and its amendment CPRA, have a substantial impact on gaming platforms as they empower users with the right to view, erase, and refuse the sale of their data. Several other states like Virginia, Colorado, and Connecticut have also passed similar legislations.8
As gaming companies in the U.S. are greatly dependent on behavioural profiling, targeted advertising, and microtransaction data, FTC enforcement continues to be an essential regulatory measure. Nevertheless, the fragmented sectoral approach results in uneven compliance challenges and loopholes concerning algorithmic transparency and tracking of in, game behaviour.
C. United Kingdom: GDPR Framework with Strong Enforcement
The UK operates a stringent data protection system that is based on UK GDPR and the Data Protection Act, 2018, which are binding to gaming platforms that handle personal data. The main requirements include:
• Explicit, freely-given consent for data collection
• Purpose limitation and data minimization
• Special protections for children under 18, including age-appropriate design standards (Age-Appropriate Design Code, 2021)
• Strict governance of automated decision-making and profiling9
The Information Commissioner’s Office (ICO) is a very influential regulator and frequently provides advice for online gaming, mainly in relation to children’s data and targeted advertising. Consent means have to be detailed, and “dark patterns” that encourage users to share their data are not allowed.
In case of cross, border data transfers, there need to be safeguards like adequacy decisions or standard contractual clauses. The UK’s framework is among the top globally for the regulation of gaming platforms, mainly because of the Age-Appropriate Design Code, which has a direct impact on game design, monetization systems, and behavioural, tracking tools.
COMPARATIVE ANALYSIS
The rapid expansion of digital gaming platforms has transformed gaming into a data-intensive global ecosystem. As highlighted in the topic, gaming companies collect vast amounts of behavioural, financial, geolocation, and sometimes biometric data. A comparative legal analysis of India, the United States, the United Kingdom, and Australia reveals significant differences in regulatory philosophy, enforcement strength, and child-protection safeguards.
India represents an emerging data-protection regime under the Digital Personal Data Protection Act, 2023 (DPDP Act). The framework emphasizes consent-based processing, notice requirements, data minimization principles, and verifiable parental consent for children. However, sector-specific clarity for gaming ecosystems remains limited. While the Act prohibits behavioural tracking of children and introduces grievance mechanisms, enforcement is still evolving under the newly constituted Data Protection Board. India permits cross-border data transfers subject to government-notified restrictions, but detailed guidance on algorithmic transparency and profiling in gaming remains underdeveloped. Thus, India is transitioning toward structured privacy governance but lacks mature enforcement mechanisms.
The United States follows a fragmented, sector-specific model rather than a comprehensive federal privacy law. Key laws include the Children’s Online Privacy Protection Act (COPPA), the Federal Trade Commission Act, and state statutes such as the California Consumer Privacy Act (CCPA) and its amendments. COPPA provides strong protections for children under 13 through verifiable parental consent requirements. However, beyond children’s protections, behavioural profiling and targeted advertising remain largely permissible unless deemed “unfair or deceptive” by the Federal Trade Commission (FTC). Enforcement is primarily litigation-driven, leading to variability across states. The U.S. model offers strong oversight in certain areas but lacks uniform nationwide standards, creating regulatory gaps for multinational gaming platforms.
The United Kingdom operates under a comprehensive, rights-based framework grounded in the UK GDPR and the Data Protection Act 2018. It mandates explicit, informed consent, strict data minimization, purpose limitation, and enhanced governance of automated decision-making. Notably, the UK’s Age-Appropriate Design Code provides robust protections for children, requiring high default privacy settings and restrictions on manipulative design (“dark patterns”). The Information Commissioner’s Office (ICO) possesses strong enforcement authority, including substantial monetary penalties. As a result, the UK offers the most structured and enforceable privacy regime among the four jurisdictions, particularly regarding child protection and algorithmic accountability.
In comparative terms, the UK stands out for its comprehensive, design-based child protections and strict profiling controls. Australia occupies an intermediate position with strong foundational principles but moderate enforcement intensity. The United States provides targeted child-specific safeguards but remains fragmented and enforcement-driven. India, though advancing significantly with the DPDP Act, remains in a developmental phase with emerging regulatory capacity.
Across all jurisdictions, unresolved challenges include algorithmic opacity, loot-box monetization systems, behavioural manipulation, and cross-border data transfers. Consequently, while foundational privacy protections exist in each country, disparities in enforcement strength, profiling regulation, and child-focused safeguards result in uneven user protection. Harmonized international standards may therefore be essential to ensure consistent privacy governance in the global gaming ecosystem.
1. Dr. K.R. Lakshmanan v. State of Tamil Nadu (1966)10 – The Supreme Court crystallized the predominance test and said that, “The courts have reasoned that there are few games, if any, which consist purely of chance or skill, and as such a game of chance is one in which the element of chance predominates over the element of skill, and a game of skill is one in which the element of skill predominates over the element of chance. It is the dominant element – “skill” or “chances” – which determines the character of the game”.
2. R.M.D. Chamarbauhwala v. Union of India (1957) 11 – The Court clarified that “a competition in order to avoid the stigma of gambling must depend to a substantial degree upon the exercise of skill”. The Court held that competitions requiring substantial skill were business activities protected under Articles 19(1) (g).
3. State of Bombay v. R.M.D. Chamarbaugwala (1957)12– The Supreme Court in established the foundational principle that “if even a scintilla of skill was required for success the compeletion could not be regarded as of a gambling nature”. However, this broad interpretation was later refined.
4. FTC v. Epic Games, Inc., No. 22-cv-03381 (N.D. Cal. 2022) (USA)13 – The U.S. Federal Trade Commission imposed penalties on Epic Games for COPPA violations and use of “dark patterns” that led to unauthorized in-game purchases by children. This case highlights U.S. enforcement against manipulative gaming design and child data misuse.
5. State of Andhra Pradesh v. K. Satyanarayana (1967)14, the Court found that rummy requires a substantial degree of skill (memory, strategy and mental alertness) and was not a mere game of chance. These authorities have been central to later arguments that online rummy, poker and similar contests are skill games.
6. R (Bridges) v. South Wales Police [2020] EWCA Civ 1058 (UK)15 – The Court of Appeal discussed the principles of proportionality and lawful processing concerning the use of facial recognition technology. This ruling has implications for virtual reality (VR) and augmented reality (AR) gaming, particularly regarding the processing of biometric data within these immersive platforms.
7. Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 (India)16 – In this case, the court acknowledged privacy as a fundamental right, establishing the constitutional basis for India’s Data Protection and Digital Platform (DPDP) Act and the regulation of digital platforms. This recognition underscores the importance of privacy within the legal framework, ensuring protections for individuals in the digital environment.
8. Dr. K.A. Paul @ Kilari Anand vs. Union of India &Ors. (May 23, 2025)17 – The Court highlights that the urgent need for legal action to classify betting apps as gambling, enforce bans or regulations, and ensure their removal from app stores. The articles examines the legal challenges surrounding online betting in India, current regulatory frameworks, recent Supreme Court decisions, and their implications for digital governance and youth protection.
JUDICIAL APPROACH TO USER PROTECTION IN DIGITAL GAMING
The evolution of data privacy in digital ecosystems, including gaming platforms, has been significantly shaped by judicial interpretations across jurisdictions. Courts have increasingly recognized informational privacy, consent, and protection against exploitative digital practices as essential components of modern legal systems. These judicial precedents provide a foundational framework for regulating gaming platforms that rely heavily on personal data processing.
The judiciary has recognized several games as predominantly skill-based through landmark decisions. Rummy was established as a game of skill in State of A.P. v. K. Satyanarayana AIR 1968 SC 825, while horse racing received similar recognition in Dr. K.R. Lakshmanan v. State of Tamil Nadu (1996) 2 SCC 226. Chess and Bridge have been acknowledged as skill-based games in Manakadu Elainger Nala Sports v. State of Tamil Nadu AIR 2005 MADRAS 214, and Poker has gained recognition through Law Commission recommendations and various High Court judgments.18 Conversely, games of pure chance face strict prohibition under Sections 4 and 5 of the Public Gambling Act, 1867, which forms the foundation of these prohibitions, supplemented by similar provisions in state gaming acts and relevant sections of the Information Technology Act, 2000 for online platforms. Games classified as chance-based include Teen Patti Flush, traditional lotteries (excluding state-run), casino games like roulette and slots, and betting on uncertain events, all of which are prohibited under gambling laws and subject to criminal penalties.
The Supreme Court in Chamarbaugwala ruled that skill-based competitions are not gambling but legitimate business activities protected under Article 19(1)(g) of the Constitution. This decision safeguards the gaming industry’s ability to operate, ensuring that states cannot arbitrarily prohibit skill-based games without infringing on fundamental rights. It grants operators of these gaming platforms constitutional protection against unreasonable state interference.
In India, the landmark judgment in Justice K.S. Puttaswamy v. Union of India firmly established the right to privacy as a fundamental right under Article 21 of the Constitution.19 The Supreme Court emphasized informational self-determination and held that individuals must retain control over their personal data. This principle is particularly relevant in gaming ecosystems where users unknowingly share behavioural and financial data. The judgment laid the groundwork for subsequent legislative developments, including the Digital Personal Data Protection Act, 2023.
Further strengthening privacy protections, the Court in Karmanya Singh Sareen v. Union of India addressed concerns regarding data sharing by digital platforms like WhatsApp.20 The case highlighted the importance of informed consent and transparency in data-sharing practices. Although not directly related to gaming, the principles apply equally to gaming platforms that integrate third-party analytics and advertising systems.
In the United States, enforcement-driven jurisprudence has played a crucial role. In FTC v. Epic Games, Inc., the Federal Trade Commission penalized the company for violating children’s privacy laws and using deceptive interface designs that led to unauthorized purchases.21 This case is particularly relevant for gaming platforms as it recognizes “dark patterns” as a form of unfair practice, thereby expanding the scope of user protection beyond traditional privacy violations.
Similarly, in In re Facebook, Inc. Consumer Privacy User Profile Litigation, U.S. courts examined unauthorized data sharing and emphasized accountability for digital platforms handling user data.22 The case reinforced that companies must implement adequate safeguards and cannot exploit user data without explicit consent. This reasoning directly applies to gaming companies engaged in behavioural profiling and targeted advertising.
In the United Kingdom and European context, the decision in Google LLC v. CNIL clarified the territorial scope of data protection laws and the application of the “right to be forgotten.”23 The ruling is significant for gaming platforms operating globally, as it underscores obligations regarding cross-border data processing and user rights. It also highlights the importance of jurisdictional compliance in multinational digital services.
There is another case law which knows about the online gaming in foreign countries Murphy v. National Collegiate Athletic Association24 that the U.S. Supreme Court ruled 6–3 that the Professional and Amateur Sports Protection Act (PASPA) violated the Tenth Amendment’s anti-commandeering doctrine. This landmark decision allowed states to legalize sports betting, directly facilitating the boom in digital sports wagering.
Another important judgment is R (Bridges) v. South Wales Police, where the Court of Appeal addressed the legality of facial recognition technology.25 The court stressed proportionality, necessity, and safeguards in processing biometric data. This has direct implications for virtual reality (VR) and augmented reality (AR) gaming platforms that increasingly rely on biometric inputs.
In the U.K. Judgment was observe in gambler, Flutter Entertainment (Betfair) – 2024/2025 High Court/Appeal: In November 2024, the High Court sided with Betfair in a high-profile case where a customer sought to recover over £1.4 million, alleging the operator failed to protect him as a problem gambler. The court upheld a clear distinction between regulatory duties (which are for the Gambling Commission to enforce) and contractual duties, arguing that operators do not generally owe a duty of care to prevent a customer from gambling.26 This decision is being contested in the Court of Appeal in late 2025.
Collectively, these judicial decisions demonstrate a shift toward stronger accountability for digital platforms. Courts across jurisdictions are increasingly recognizing the risks posed by data-driven ecosystems and are expanding legal protections to include transparency, informed consent, and protection against manipulative digital practices. For gaming platforms, these rulings underscore the necessity of adopting privacy-by-design principles and ensuring compliance with evolving legal standards.
CONCLUSION AND POLICY RECOMMENDATIONS FOR HARMONIZED GLOBAL STANDARDS
The rapid expansion of digital gaming platforms across mobile, console, cloud, and metaverse-based environments has significantly transformed the global entertainment industry. With millions of users interacting daily, sharing personal information, and engaging in in-game economic systems, data privacy and user protection have emerged as central governance challenges. While India, the USA, the UK, and Australia have taken several steps to regulate digital privacy, the fragmented nature of these frameworks leads to inconsistencies in user rights, compliance expectations, and enforcement mechanisms. This difference in standards is a major issue for gaming platforms that are operating across borders as they are more likely to engage in regulatory arbitrage resulting in unequal user protection and the existence of loopholes that can be utilized by sophisticated companies for their benefit. The comparative analysis reveals that the UK and Australia have rights-based privacy regimes that are well-established, the USA follows a sectoral and enforcement-driven model, and India is at a transitional stage with the DPDP Act 2023. Moreover, as gaming technologies are to incorporate behavioural analytics, AI-driven personalization, augmented reality, and virtual currencies, the existing laws are still far from sufficient to deal with the depth and sensitivity of data that these platforms process.27
It is, therefore, necessary to have a comprehensive, harmonized global standard that would set minimum benchmarks of privacy, transparency, and accountability rather than replacing domestic laws. The vulnerabilities of young users, the widespread use of manipulative design patterns, and the opacity of algorithmic profiling are some of the reasons why there should be universal safeguards regardless of location. Since gaming is a global phenomenon, its regulation should be beyond the jurisdiction of individual countries and capable of addressing cross-border digital ecosystems. The following policy recommendations offer a systematic route towards the harmonization of global standards that focus on the rights of users and at the same time facilitate the innovation in the gaming sector.
A. Establish a Universal Baseline Privacy Framework for Gaming Platforms
The involved countries should agree on a shared baseline that would be close to the core principles of GDPR such as: lawful processing, purpose limitation, data minimization, transparency, and accountability. An internationally recognized standard would be effective in setting up the rules for obtaining consent, data collection, and user rights like access, correction, and deletion. India, USA, UK, and Australia need to be part of a multilateral forum maybe under the OECD or G20 that would be responsible for working out the minimum global privacy norms specifically for the gaming ecosystems.28
B. Strengthen Protections for Children and Young Users
With the consideration that a huge portion of online gaming communities consists of minors, the children’s privacy should be provided with rigorous and reinforced safeguards. The accepted standards should require that technologies for age verification are implemented without causing infringements on privacy, behaviour advertising should be strictly prohibited for children, information about in-game purchases should be easy to understand, and there should be obvious warnings about loot boxes and gambling-like mechanisms. Limitations on children’s rights such as those in COPPA, the UK’s Age-Appropriate Design Code, and Australia’s Online Safety, are some of the resources on which a global child-protection standard can be built.
C. Mandate Algorithmic Transparency and Accountability in Gaming Platforms
The use of algorithms for personalization, matchmaking, targeted ads, or loot box reward distributions should be limited to the required level and such algorithms must be open to the public for inspection. Regulatory bodies must be allowed to compel gaming companies to give full disclosure on how their algorithms gather and analyze user behavior, usage of manipulative design practices, and the ways by which addiction or exploitative monetization risks are alleviated. Independent audits by certified cybersecurity and ethics organizations, should be obligatory for high-risk algorithmic systems especially those that have an impact on children.
D. Adopt a Standardized Cross-Border Data Transfer Mechanism for Gaming Platforms
Some of the reasons behind the increasing tension between data-localization policies (e.g., India) and liberal data-flow regimes (e.g., USA) are the difficulties encountered by global operations. A harmonized mechanism like adequacy decisions, standard contractual clauses, or region-specific secure data-transfer protocols would make it easier for companies to comply with regulations and at the same time protect users’ data from being misused for surveillance or from coming from weak jurisdictions. Agreements signed by more than two parties could be the solution for balancing the security of a nation and the privacy of its people.
E. Enhance Enforcement Capacity and Create a Global Gaming Privacy Observatory
Regulation is only as effective as enforcement. In order to enforce regulations more effectively, countries have to support data-protection authorities by equipping them with technological know-how, providing them with more funds, and encouraging them to collaborate with other authorities across borders in investigations. The establishment of a “Global Observatory for Digital Gaming Privacy and Safety” can be instrumental in keeping track of the latest industry trends, writing up reports on the breaches, making safety scorecards available to the public that shows how safe different gaming companies are, and facilitating the implementation of coordinated measures.
F. Promote Industry Self-Regulation Through Privacy-by-Design and Safe-Game Certification
Gaming companies should, apart from government regulations, build privacy features into the basic structure of their games. A worldwide independent certification like that of the ISO standards can be the major incentive for companies to achieve higher levels of user privacy. The certification can serve as a tool for companies to be recognized if they have implemented safe design practices, have provided transparent in-game economics, have collected only minimal data, and have used AI in a responsible manner.
G. Encourage User Awareness and Digital Literacy as Complementary Measures
No piece of legislation, however, is complete without the presence of knowledgeable users. Privacy settings, phishing risks, safe gaming habits, and recognizing manipulative monetization practices are some of the topics that should be covered via educational initiatives, which would then be embedded not only in gaming interfaces but also in national digital-literacy campaigns. In a nutshell, aligning worldwide standards on data privacy and user protection in digital gaming is not just a case of regulatory idealism but rather a practical requirement in a borderless digital ecosystem. By combining legislative harmonization, algorithmic accountability, child safety norms, cross-border enforcement, and robust industry cooperation, India, USA, UK, and Australia can together pave the way for a safer and more transparent gaming future.
FINAL CONCLUSION
The comparative study of data privacy and user protection measures in digital gaming platforms in India, the USA, the UK, and Australia demonstrates a quickly changing but uneven regulatory landscape. The UK and Australia, with their comprehensive, principle-based privacy regimes, are ahead of the curve, while the USA still depends on a fragmented, sectoral model. India is on its way to a structured framework under the Digital Personal Data Protection Act, 2023. However, all four jurisdictions grapple with the same issues of over-collection of data, algorithmic profiling without explanation, monetization through loot boxes, and increased risks of minors who make up a large part of the gaming audience.
Gaming platforms are today part of a global digital ecosystem in which data flows beyond national boundaries, thus making traditional regulatory models inadequate. The enforcement of stronger mechanisms, standardization of age-verification, and more disclosure of behavioural tracking and game monetization are the major steps towards the protection of users’ rights. Besides that, the quick acceptance of immersive technologies like VR/AR gaming calls for a regulatory innovation that protects consumers and allows the industry to continue growing. Countries should collaborate on cross-border data governance, breach notifications, and ethical design principles if they want to have real global harmonization. For India, the alignment of its emerging privacy framework with international best practices is a way to increase user trust and attract responsible gaming innovation. In the end, safeguarding data privacy in the gaming sector goes beyond merely fulfilling compliance requirements it is the basis for maintaining user autonomy, stopping exploitation, and creating a safe and reliable digital gaming environment for the future.
*****
Footnotes
1. Paul M. Schwartz & Daniel J. Solove, Information Privacy Law (7th ed., Wolters Kluwer 2021).
2. Digital Personal Data Protection Act, 2023 (India).
3. General Data Protection Regulation, Regulation (EU) 2016/679; Data Protection Act 2018 (UK).
4. Digital Personal Data Protection Act, 2023 (India).
5. Information Technology Act, No. 21 of 2000 (India).
6. Federal Trade Commission Act, 15 U.S.C. §§ 41–58 (USA).
7. hildren’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506 (USA).
8. California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100–1798.199 (USA).
9. Data Protection Act 2018, c.12 (United Kingdom).
10. (1966) 2 SCC 226
11. AIR 1957 SC 628
12. AIR 1957 SC 699
13. No. 22-cv-03381 (N.D. Cal. 2022) (USA)
14. 1968 AIR 825 (India)
15. [2020] EWCA Civ 1058 (UK)
16. (2017) 10 SCC 1 (India)
17. W.P.(C) No. 299/2025.
18. State of A.P. v. K. Satyanarayana AIR 1968 SC 825
19. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (India).
20. Karmanya Singh Sareen v. Union of India, (2017) SCC OnLine Del 10885 (India).
21. FTC v. Epic Games, Inc., No. 22-cv-03381 (N.D. Cal. 2022) (USA).
22. In re Facebook, Inc. Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767 (N.D. Cal. 2019) (USA).
23. Google LLC v. CNIL, Case C-507/17 (CJEU 2019).
24. 584 U.S. (2018)
25. R (Bridges) v. South Wales Police, [2020] EWCA Civ 1058 (UK).
26. Flutter Entertainment (Betfair) – 2024/2025 High Court/Appeal
27. World Economic Forum, Advancing Digital Safety: Global Approaches to Platform Governance (2022).
28. United Nations Conference on Trade and Development (UNCTAD), Data Protection and Privacy Legislation Worldwide (2022).