Can a game studio sell its data to AI? Tickets, telemetry and design documents
A game studio holds bug reports, support tickets, design notes and play logs. What an AI lab might want from them, who owns each part and which parts carry player privacy questions.
Written by Jimmy Lin
, 4 min read
A game studio writes down more of its work than most companies. Every bug is reported, triaged, fixed, tested and mentioned in a release note. Every player problem becomes a ticket. Designers keep long documents explaining why a level or a system works the way it does. That trail is a record of how skilled people find and solve problems, which is what AI teams look for.
Whether the studio can sell or license it depends on three things: what the records are, who made them and whose information they hold.
What a studio keeps that an AI team might want
- Bug reports and fix histories. Each one is a small case: what happened, how to repeat it, who looked, what changed and whether the fix held. Researchers already study this kind of record. A study led by Truelove (posted on arXiv in March 2021) read the update notes of 30 popular PC games and examined 12,122 bug fixes, and found that crashes were the bug type with the highest severity. If researchers find the public version useful, a studio's own history, with its internal discussion, holds more.
- Player support tickets. Players write in their own words, agents answer and the ticket closes with an outcome. That structure suits training models that handle customer requests. Our page on support tickets explains what makes an archive valuable.
- Design and balance documents. Reasons for decisions, tests that were tried and dropped, and revisions over time.
- Source history. The commit log shows how code changed and why. This part has limits, covered below.
- Play logs. Records of what players did. These carry the strongest privacy questions.
Who made it
The employer is generally treated as the author of work employees create as part of their jobs. US copyright law says so in its definition of a "work made for hire" (17 U.S.C. sections 101 and 201(b)). That is why a studio can usually license its own documents, tickets and code written by staff.
Three groups of material do not follow that rule:
- Contractors. Work by freelancers and outside studios depends on the written agreement. If the agreement does not transfer the rights, the studio may not be able to license that work.
- Licensed parts. Music, art, fonts, middleware and engine code are licensed to the studio, not owned by it. A studio cannot pass on rights it does not hold. Open-source parts follow their own licenses, which AI teams read carefully.
- Player-made content. Mods and user-made levels usually follow the terms of service players accepted. Those terms vary, so read yours.
The practical step is a short audit: list what you wrote with employees, what you licensed in and what players made. Only the first group is ready to discuss.
Whose information is inside
Support tickets and logs contain players, and some of them are children. The GDPR (Regulation (EU) 2016/679, recital 30) says online identifiers, such as internet protocol addresses and cookie identifiers, can leave traces that identify people when combined with other information. Gameplay telemetry often holds exactly those. In the United States, the Federal Trade Commission enforces the Children's Online Privacy Protection Rule (16 CFR Part 312), which covers online services that collect personal information from children under 13. The FTC announced two settlements with a game maker in December 2022, including one under that rule, so regulators watch this area.
So the order of work is: take names, handles, emails, addresses, voice or text chat content and identifiers out of the records, then check what is left for combinations that could point to a person. We record what was removed. Our de-identification page explains the steps. For data about children, we will say plainly when a set cannot be offered.
What an AI team looks at
Counts, years and a sample. How many bug reports, from which years, across how many titles, with what proportion closed with a fix. Three complete cases, cleaned, tell a lab more than a long description. Our post on what to have ready before you talk to a data broker lists the facts to prepare.
Source code gets a closer look. Teams check the license of every piece, so engine and library code the studio did not write is not offered.
How a deal usually goes
You tell us what you hold. We sort it into what is yours, what is licensed in and what players made. We plan the removal of personal details, prepare a sample and ask AI labs whether they want it. You keep the final decision on every term, and most deals are licenses, so the studio keeps its games and its rights. Ask your counsel to read any license before you sign it.
The slides on this question walk through it, and the list of industries we work with shows the nearest pages, including software companies. The data value calculator takes about a minute. To talk it through, tell us what the studio keeps.
Sources
- United States Code, Title 17, section 201 (ownership of copyright, works made for hire)
- GDPR, Regulation (EU) 2016/679, recital 30 (April 2016)
- US Federal Trade Commission, Children's Online Privacy Protection Rule, 16 CFR Part 312
- Truelove and others, What Do Bug Fixes in Video Game Update Notes Tell Us? (arXiv, March 2021)
Questions people ask
Can we license data from a game that has shut down?
Often yes, if you still hold the rights and the records. A closed title can be easier to discuss because no live service depends on it. See our page on closing companies.
Do we have to include source code?
No. Tickets, design documents and bug histories are valuable without it, and many studios begin there.
Are player chat logs allowed?
They are among the riskiest records. Chat holds personal details and often involves children. They are usually left out unless the consent behind them is clear.
We are a small team. Does that matter?
Size matters less than history and cleanliness. A small team with years of well-kept tickets and a few complete cases is worth a conversation.
Didn't find your question? Ask us directly.
Read next
More articles- For sellers3 min read
What is a CWE, and why do AI security tasks cite them?
CWE explained in plain words: what the list is, how it differs from CVE and OWASP, and why labs ask security datasets to say which weaknesses they cover.
- For sellers3 min read
Black-box versus white-box security tasks for AI, in plain words
What black-box and white-box security testing mean, how they change an AI task, and why labs want both kinds of environment, explained for owners.
- For sellers3 min read
AI red teaming: what an offensive security environment is and why labs want them
AI red teaming explained in plain words, how offensive security environments test models, what the rules ask for, and what a security company can license.