Give counsel a defined deployment to assess, not a general question about whether free slots are legal. The useful output is a scoped decision covering the game, audience, promotions and data flows.
This guide is procurement research, not legal advice or a 50-state legal survey.
Which three questions must remain separate?
| Question | Evidence owner | Deliverable |
|---|---|---|
| Does the agreement permit this audience and use? | Commercial lead and counsel | Rights/territory schedule |
| Does the game launch in the tested environment? | Engineering and QA | Location-, device- and time-specific test record |
| Are the presentation, promotions and data practices suitable? | Counsel, privacy lead and product | Conditions for deployment and monitoring |
Do not interpret a successful launch as evidence that a linked wagering service is authorised. Michigan’s regulator maintains its own list of licensed internet gaming operators; use relevant state regulator records when reviewing destinations rather than relying on the demo supplier’s availability feed. (michigan.gov)
What should the promotion review cover?
Ask the reviewer to assess:
- Every real-money destination and its intended state audience.
- Whether the publisher’s affiliate activity creates registration or other obligations.
- The wording and location of commercial disclosures.
- Age-related conditions in supplier and operator agreements.
- Claims about bonuses, winning, availability or game configurations.
- Supplier-controlled banners, redirects and in-game promotional buttons.
New Jersey’s 9 September 2024 affiliate due-diligence letter illustrates why this is not merely a game-licensing issue: it imposed affiliate-related certification requirements on internet gaming and online sports wagering platform providers. It does not establish that every independent demo publisher has the same filing obligation. (nj.gov)
For affiliate endorsements, the FTC calls for clear and conspicuous disclosure of the commercial relationship and explains that the label “affiliate link” alone may not be understood. Place disclosures where visitors encounter the relevant recommendation or link, rather than assuming a general footer notice resolves every placement. (ftc.gov)
What should the privacy assessment contain?
Produce a network and data-flow inventory for these states of the page:
- Before any visitor interaction.
- Before optional consent, where your implementation requires it.
- After refusal or an applicable opt-out.
- After acceptance.
- After clicking Play.
- During gameplay and after exiting.
For each third party, record the purpose, request destinations, identifiers, storage, retention information, onward recipients and available controls. Ask the supplier for the relevant privacy and processing terms, not only its general website privacy policy.
Where the CCPA applies, assess sale/sharing and opt-out obligations. California’s privacy agency says covered businesses must honour qualifying opt-out preference signals such as Global Privacy Control. Its guidance for rules effective 1 January 2026 also highlights confirmation of opt-out status and risk-assessment requirements for specified processing activities. Applicability needs assessment; a generic cookie banner is not a complete review. (cppa.ca.gov)
For COPPA, assess whether the service is child-directed or has actual knowledge of collecting personal information from children under 13. Do not treat an adult-content label as the entire analysis. The FTC’s FAQ points readers to the amended rule for current requirements, and the revised rule contains the operative framework for covered services. (ftc.gov)
Suggested release condition: every material data flow must have a named owner and an assessed purpose. If an embedded service introduces unresolved tracking or promotional behaviour, keep the playable component disabled while resolving it.