Two Years After: A Scoping Review of GDPR Effects on Serious Games Research Ethics Reporting

The introduction of the General Data Protection Regulation (GDPR) has failed to catalyze a meaningful shift in research ethics reporting within the serious games industry. Despite the regulation’s broad legal mandate, an analysis of 2,146 serious games studies conducted over the two years following its implementation reveals that transparency regarding data protection remains remarkably low. While there has been a marginal 12% increase in general ethics reporting, this growth does not reflect a substantive engagement with privacy standards. Less than 6% of studies published post-GDPR explicitly address data protection protocols, and a mere 0.5% of the literature references the regulation by name.

These findings indicate that the current academic and development landscape lacks the necessary integration of privacy-by-design principles. The persistent absence of explicit references to data protection suggests that researchers and developers are not adequately adapting their methodologies to meet modern regulatory expectations. This disconnect highlights a significant gap between legal requirements and practical application, as the industry continues to operate without a standardized framework for documenting ethical compliance in digital game-based research.

To address these systemic shortcomings, future efforts must move beyond passive compliance and prioritize the integration of data protection and ethical design toolsets directly into the early conceptual stages of game development. By embedding these protocols into the foundational architecture of serious games, the industry can improve transparency and ensure that research practices align with global privacy standards. Without a proactive shift toward formalizing these ethics reporting structures, the serious games sector risks continued stagnation in its approach to participant data security and regulatory accountability.