Step 1 of 5

How an online game account actually works

Before you decide anything about a particular game, it helps to know what the moving parts are. There are only three of them, and almost every later question in this course is really a question about one of the three.

The three parts: client, account, servers

The first part is the client. This is the program that sits on your laptop, phone or tablet and draws the pictures. You download it, it takes up space, and it updates itself from time to time. Some games have no separate client at all and run inside a web browser instead, which is simply a client you did not have to install.

The second part is the account. This is a record held by the publisher — the company that operates the game — tying a username and an email address to everything you have done, bought and earned. It is not stored on your device. If your laptop dies tomorrow, the account is untouched; if the publisher closes the account, a working laptop does not help you.

The third part is the servers. These are the publisher's computers, somewhere in the world, running the shared world that you and everyone else connect to. They decide what is true in the game. Your client only shows you what the servers tell it.

Why the split matters to you

Three practical consequences follow from that diagram, and they are the reason this step comes first.

You do not own your progress in the way you own a book. What you have in an online game is a record on someone else's computer, held under the terms of a licence agreement you accepted when you signed up. Those agreements usually let the publisher close accounts, change the game, or eventually shut the service down. That is not a scandal and it is not hidden; it is simply what you are agreeing to, and Step 3 shows you where to read the particular wording.

The account is the valuable thing, so the account is what gets attacked. People trying to steal from players rarely bother with your laptop. They go after the email address and password that open the account, usually by sending a message that looks like it came from the publisher. The Australian Cyber Security Centre's guidance on passphrases and multi-factor authentication is written for exactly this situation, and Step 4 applies it.

What happens in the game happens live, with other people. There is no pause, no undo and often no editorial control over what a stranger types. That is a social question rather than a technical one, and it is why the eSafety Commissioner appears in Step 5 rather than being treated as an afterthought.

The four ways online games take money

Almost every online game uses one of four charging models, or a mixture. Recognising which one you are looking at tells you most of what you need to know about the cost.

The two things that catch people out are not the headline price. They are in-game currency and automatic renewal. In-game currency puts a layer between dollars and purchases, so a child spending "three hundred coins" is not obviously spending anything. Automatic renewal means a subscription continues until someone deliberately stops it, which is easy to forget three months after the household stopped playing.

In Australia, services sold to consumers come with consumer guarantees under the Australian Consumer Law, and the ACCC explains what those guarantees cover and how to complain when a business does not meet them. It is worth knowing that exists before you need it, rather than after.

What a game account knows about you

Signing up to an online game means handing over some information. Typically that is an email address, a username, a date of birth or age bracket, and — if you buy anything — payment details, usually handled by a payment company rather than the publisher. Beyond that, the servers record what the account does: when it connects, from roughly where, what it buys, who it plays with, and often what it types in chat.

Publishers describe this in a privacy policy, and that document is worth four minutes of your time before you sign up rather than four months after. The things worth finding are: what is collected, whether it is shared with advertisers, whether it leaves the country, and how to delete the account and the data with it.

If an Australian business mishandles personal information, the Office of the Australian Information Commissioner is the regulator you would go to, and it publishes the Australian Privacy Principles that set the standard. Many game publishers are based overseas and are governed by other regimes as well, which is one reason their policies are long.

The part that is other people

An online game is a room full of strangers. Most of them are ordinary; some are not. Games handle this with a mixture of tools — text filters, the ability to block or report another player, friends-only chat, and sometimes no chat at all for younger accounts.

You do not have to research moderation policy in depth to make a sensible decision. You need to know two things: what the chat and contact settings are, and how to report someone. Step 4 covers finding both, and Step 5 covers what to do when reporting inside the game is not enough. Australia's eSafety Commissioner runs the national complaint schemes for serious online harms and publishes guidance written for parents and carers.

Spending money is also where strangers get involved. A great many scams aimed at players offer cheap currency, free items or account services, and ask you to log in somewhere that is not the publisher's site. Scamwatch publishes descriptions of current scam types and takes reports. The general rule that survives every change in technique: if an offer requires you to type your game password into a site that is not the publisher's own, it is not an offer.

Words you will keep meeting

Step 1 checklist