The Case of the Missing Privacy: how the EU's DSA made my games free

I was ready to roll. A shelf of games under my new label, ARKD BOX, almost ready to ship. One of them, Mummy Scape, already had its price set: €0.99. Testers enrolled, store listing half written, launch on track.

And then… DSA!

Meet the suspect

The Digital Services Act is the EU’s big rulebook for online platforms. Most of it is aimed at giants, which sounds great. But tucked into Article 30, “traceability of traders”, there’s a rule for everyone who sells anything through an online marketplace, app stores included.

The store has to collect your name, address, phone number and email, a copy of your ID, your bank details and a signed promise that you’ll behave. Then it has to show the name, address, phone and email to the public, right next to your product.

The law just says “address”. It doesn’t say “home address”. But here’s how it plays out for a solo developer:

• Google Play, for personal developer accounts, shows your legal name, country and email. If you charge money, through a paid app or in-app purchases, it displays “your full address”, taken from your payments profile. For a one-person studio working from the kitchen table, that address is home.
• Apple at least accepts a P.O. box, if you upload a bill proving it’s yours. Credit where it’s due.

So the deal is simple. Charge €0.99 for a game and your home address goes on a page anyone in the world can open. I live with children. The internet is not a gentle place these days. That’s not a trade I’m willing to make.

Remember when the EU loved privacy?

This is the part that makes me laugh, in the way you laugh when the alternative is screaming.

The EU is, rightly, the world’s privacy sheriff:

• €1.2 billion fine for Meta in 2023, over data transfers to the US.
• €50 million for Google from France’s CNIL in 2019, and another €325 million in 2025.
• Billions more for Google in competition cases: €2.42 billion (Shopping), €4.1 billion (Android, now final), €2.95 billion (adtech).

And here’s my favourite. When GDPR arrived in May 2018, the public WHOIS records of domain names had to start hiding owners’ street, city, postcode and phone. Publishing private people’s addresses for anyone to look up was, correctly, considered a problem.

Same continent. Same kind of data. Opposite answer.

Your privacy is a fundamental right. Unless you’re an indie developer, in which case it’s a fundamental requirement to give it up.

Small platforms get a pass. Small developers don’t.

Article 29 of the same law says these duties don’t apply to marketplaces that are micro or small enterprises. Fair enough, small businesses shouldn’t drown in red tape.

Now look for the matching exemption for micro and small traders: the one-person studio, the hobbyist selling a puzzle game for less than a coffee. I’ll wait.

There isn’t one. A tiny platform is protected from the paperwork. A tiny developer is not protected from strangers knowing where they live.

When Apple’s deadline hit in February 2025, about 135,000 apps went inactive on its EU storefronts in roughly a day and a half, according to Appfigures data reported by TechCrunch. Some of that was abandoned clutter. Some of it, I’d bet, was people like me who looked at the form and thought: no thanks.

”But accountability!”

Sure. Accountability matters. Scam sellers exist, counterfeit chargers exist, and buyers deserve to know who they’re dealing with.

But look at who sits between me and every buyer. Google and Apple. They:

• take a cut of every sale;
• verify my identity, my bank account and my phone number;
• own the refund button, the complaint form and the dispute process;
• can suspend me, remove my apps and hand my details to any court or authority that asks.

If you buy my game and something goes wrong, you won’t come to my house. You’ll press a button in the store, and the store will contact me. My home address adds nothing to that process. The only thing it adds is a way to find my front door, and the only person who needs that is exactly the person I don’t want there.

To be fair, the duty to give a “geographic address” isn’t new. EU e-commerce law has required it since 2000. What the DSA changed is that the stores now have to collect it, check it and publish it automatically, on every listing, for everyone. An old rule nobody noticed became a rule nobody can avoid.

The fix is boring, which is why it would work

Verified, not published.

The store checks who you are and where you are, and keeps it. Courts, regulators and consumer authorities get it on request, instantly. The public sees your name or trade name and a way to contact you. That’s basically how domain records have worked since GDPR, and the sky hasn’t fallen.

Same accountability. No stalkers.

Silver linings (still to be voted)

It’s not all gloom. A few things are moving, slowly:

• EU Inc., the “28th regime”. In March 2026 the Commission proposed an optional EU-wide company you could set up online in 48 hours, for under €100, with no minimum capital. It’s still waiting for its votes: Parliament’s legal affairs committee, the plenary, then the Council. Even if it passes, it’ll probably take a couple of years to be usable. And a company still has a registered office, so it isn’t a privacy fix by itself. It would just make “become a company” a lot less painful.
• Spain already has a cheaper company. Since 2022 you can set up an SL with €1 of capital, online. The setup isn’t the problem anymore. The monthly social security payment and the accounting are.
• A report on small businesses is due in February 2027. The DSA requires the Commission to report by 18 February 2027 on how the law affects small and medium-sized businesses, with a full evaluation in November 2027. That’s the window for developers, associations and anyone else annoyed by this to make some noise.
• The complaint is on record. Back in 2021, Europe’s game developers’ and publishers’ federations (EGDF and ISFE) asked for an exception for “small traders who operate their businesses from their homes”. The law passed without it, but the argument isn’t new and it isn’t just me.

What I didn’t find: any actual proposal to change Article 30. The Commission’s November 2025 review called the DSA “fit for purpose”. So if you want this fixed, the reports in 2027 are where it gets argued.

So my games are free now

I’m not forming a company just to have an office address to publish. In Spain that’s slow, expensive in monthly costs and, for games that might sell a handful of copies, impossible to justify. Not yet, anyway.

So the ARKD BOX games are free. No price, no ads, no in-app purchases. If I don’t sell anything, I’m not a “trader”, and my address stays mine. Here’s what that did to the plans:

• Mummy Scape: was €0.99 on Google Play. Now free.
• Kick or Treat: was going to be €0.99. Now free.
• MoonBeat: was going to be a paid game. Now free.
• Tabletop Racing Simulator: was going to be free with paid add-ons and sponsors, on tablets too. Now it stays free and web-only, in your browser.
• Joel Football: was always free. Nothing to dodge there.

Honestly? Free games are easier to share, so maybe this turns out fine. But I’d like it to be my choice, not the price of keeping my family safe.

Case closed. For now.

Read everything about the DSA data: who voted, who was warned, and the full list

---

Sources: DSA Articles 29–31 · Google Play: developer information shown · Apple: DSA trader requirements · ICANN Temporary Specification (WHOIS) · Irish DPC: Meta €1.2bn · CNIL: Google €50m · CNIL: Google €325m · CJEU: Android fine upheld · TechCrunch: Apple purges apps from EU App Store · e-Commerce Directive 2000/31/EC · Commission DSA review, Nov 2025 · EU Inc. proposal, March 2026 · EU Inc. legislative file · EGDF/ISFE DSA position paper, 2021 · Spain: €1 SL under Ley 18/2022 (Uría Menéndez)

Back to the blog