Cookie Notices and a Privacy Policy for a Site With Embedded Games

Embedding a game puts something new on your page: a frame that belongs to another service. That has consequences for privacy notices. This post covers what the Partner Terms put on you, what PlayKovo says it does inside the embed and how to write the parts of your cookie notice and privacy policy that this changes.

Several statements in the Partner Terms matter here:

• You must have a privacy policy and, where the law requires it, cookie and consent notices on your site for your own data collection.
• When a visitor plays a game, PlayKovo may set cookies or use similar technology inside the embed and process limited data, as described in PlayKovo's own Privacy Policy.
• Where consent is required, PlayKovo only records launch analytics after the visitor accepts cookies.
• You must not pass personal data about your visitors to PlayKovo, or place the embed in a way that makes PlayKovo collect it for you.
• If you register a site, PlayKovo identifies your domain from the referrer of the page that contains the embed.

Your policy should say, in plain language, that the games section includes content from a third party. A fair paragraph covers four things:

1. Who provides the games: "Games on this page are provided by PlayKovo and run on PlayKovo's servers."
2. What may happen when a visitor plays: "When you start a game, PlayKovo may set cookies or use similar technologies and process limited data, as described in the PlayKovo Privacy Policy."
3. A link to PlayKovo's policy.
4. What you yourself collect in connection with the page, for example analytics.

Adapt the wording to your situation and have it checked if you operate in a region with strict rules. Do not describe PlayKovo's processing in more detail than PlayKovo's own policy does, since you might get it wrong. Link to it instead.

If your site shows a consent banner, think about whether the games fall into a category in it. Common categories are "necessary", "analytics", "marketing" and "third-party content". Because the game frame is third-party content and may use cookies, many sites list it under third-party content or functional content. How you categorise it, and whether the frame loads before consent, is a legal judgment for your region.

A cautious approach used by many sites is to load third-party frames only after the visitor accepts the relevant category, and to show a placeholder with a button until then. That has a side effect: the partner dashboard only counts launches from visitors who have accepted cookies anyway. See why the dashboard shows fewer launches.

<div id="game-slot">
  <p>This game is provided by PlayKovo and may use cookies.</p>
  <button id="load-game">Accept and play</button>
</div>

On click, your script inserts the unchanged embed code into the slot. Do not change the embed itself, and do not hide the referrer; see the referrer post. Check with your legal adviser whether a placeholder like this meets the rules where you operate.

• Pre-ticked boxes or hidden reject buttons. They are unlawful in many places and unfair everywhere.
• Passing visitor identity into the page address of a game page. The referrer carries only your origin under a sensible policy, but identifying data in URLs is bad practice anyway.
• Copying another site's policy without checking that it matches what your page does.

Extra rules may apply. See if your site is for children and child-friendly gaming websites.

1. Privacy policy mentions the games and links to PlayKovo's policy.
2. Cookie notice covers third-party content where required.
3. No personal data passed to PlayKovo.
4. Embed unchanged, referrer intact.
5. Policy reviewed by someone qualified if you serve regulated regions.

This post is general information, not legal advice. The authority is your local law, the Partner Terms and PlayKovo's privacy policy.