Step 3 of 5

Reading the account, email and privacy terms before you agree

The sign-up form is the only part of this process where you are asked to agree to something legally meaningful, and it is the part people click through fastest. This step slows it down. Reading time is about eighteen minutes.

What a sign-up form is actually asking

A registration form for an online game typically asks for an email address, a password, a display name, and sometimes a date of birth and a country. Each of those fields is there for a reason, and the reasons are different from one another.

The email address is the account's real identity. It is how you recover access when the password is lost, how the publisher reaches you about the account, and in most cases how the publisher would reach you with marketing if you let them. Everything else about the account can usually be changed; the email address is the anchor.

The password is the only thing standing between your account and anyone who knows your email address. More on it below.

The display name is what other players see. It is public. Treat it as public in the fullest sense: it should not be your full real name, your workplace, your suburb or anything else you would not put on a noticeboard. This is a point the eSafety Commissioner makes in its general online safety material, and it costs nothing to follow.

The date of birth is usually collected so the publisher can apply age-related rules — what content is shown, what communication features are available, and in some jurisdictions whether certain purchases are allowed. It is a real field with a real function, not a formality.

The country determines which version of the service you receive, which currency prices are shown in, and sometimes whether the service is offered to you at all. Some games are not made available in every country. For the example game used in this course, the vendor's promotion is not offered in a number of countries; Australia is not among the excluded ones.

Why the confirmation email exists

After you submit the form, most services send a message to the address you gave, containing a link. Clicking it tells the service that the address exists and that you can read it. Until you do, the account usually sits in an incomplete state and may not let you sign in.

This step exists for the service's benefit and for yours. For the service, it filters out invented addresses and makes automated mass registration more expensive. For you, it means a stranger cannot create an account against your address and lock you out of it, and it means account recovery will actually work when you need it.

The example game follows this pattern: the vendor's own description of what completing registration involves is creating an account, confirming the email address, and then signing in. Those three actions are the whole of it. If you have done them, registration is complete; there is no further step the course is holding back.

Two practical points. The confirmation message sometimes lands in a junk or spam folder, which is the first place to look before concluding that it was never sent. And the link usually expires — often within a day or so — after which you request a new one rather than reusing the old link.

Visit the Crossout websitePaid affiliate link. Blank Index is paid a commission if an account is created and confirmed after following it, which is also why this step tells you what the confirmation email is for rather than hurrying you past it.

Choosing a password you will not reuse

The single most useful habit in this entire course is not reusing a password between a game account and anything that matters. The reason is mechanical rather than alarming: if any service you have an account with is breached, the addresses and passwords from it circulate, and automated systems try those pairs against other services. A unique password on your game account means a breach anywhere else does not reach it, and a breach of the game does not reach your email.

A password manager — a program that generates and stores passwords for you — is the straightforward answer, and both operating systems and all major browsers now include one. If you would rather not use one, a long passphrase made of several unrelated words is far stronger than a short password with substituted characters, and much easier to type.

If the service offers two-factor authentication — a second check, usually a code from an app or a message, in addition to the password — turning it on is worthwhile on any account you would be annoyed to lose. The Australian Cyber Security Centre publishes general guidance on passphrases and multi-factor authentication, written for the public rather than for specialists.

Nothing in this paragraph implies that you are currently at risk or that anything is wrong with your computer. It is ordinary hygiene, like locking a bike.

Six paragraphs worth reading slowly

A privacy notice is long, and reading every word of one is not a realistic ask. Reading six specific parts of it is. Use your browser's find function to jump to them.

1. What is collected. Look for the list of categories. Account details and gameplay data are expected. Note anything that surprises you — device identifiers, contacts, location — and decide whether it is explained.
2. Why it is collected. Each category should have a stated purpose. “To improve our services” is a purpose in form only; something specific is a better sign.
3. Who it is shared with. Look for categories of recipients: payment processors, hosting providers, advertising partners, analytics providers. Advertising partners in this list means your activity contributes to targeting.
4. Where it goes. An international service stores data outside Australia, which is normal and is not in itself a problem. What matters is that the notice says so.
5. How long it is kept. Look for a retention period. A notice that gives one is being more candid than a notice that says data is kept “as long as necessary”.
6. How to get it deleted. Look for how to close the account and what happens to the data when you do. Find this before you sign up, not after you want out.

If you are in Australia and the organisation is covered by the Privacy Act 1988 (Cth), you have rights to ask for access to your personal information and to ask for corrections. The Australian Privacy Principles are published in plain English by the Office of the Australian Information Commissioner, and reading them once is a good use of twenty minutes for reasons well beyond games. Whether any particular overseas publisher is covered depends on its circumstances, which is a question for the publisher's own notice and, if it matters to you, for the OAIC rather than for this site.

The terms of service, in ten minutes

The terms of service are the contract. Four sections repay a look.

What you get. Almost always a licence to use the game, not ownership of anything. This applies to purchased items too: you are buying a licence to use an item within the service.

What ends the account. Look for the conduct that leads to suspension, and whether accounts can be closed without a stated reason. This matters more once you have spent money.

What happens to purchases. Look for what the publisher says about refunds and about the service being discontinued. In Australia, the consumer guarantees under the Australian Consumer Law apply to goods and services supplied to consumers and cannot be excluded by a contract term, whatever the terms say; the ACCC explains those guarantees.

Changes. Nearly all such terms allow the publisher to change them. Look for whether you are notified and whether continuing to play counts as acceptance.

Telling the real sign-up page from a copy

Game accounts are worth money to criminals, which makes fake sign-in pages worth building. The defence is habit rather than vigilance.

• Reach the sign-up page by typing the publisher's address yourself or from a link you chose to follow, rather than from an unexpected message.
• Read the address bar before typing a password. Look at the domain itself — the part just before the first single slash — not at how official the rest of the page looks.
• Treat any message promising items, currency or a prize in exchange for signing in as a sign-in harvesting attempt until proven otherwise.
• If you have given a password to a page you now doubt, change that password on the real site, and change it anywhere else you used the same one.

Scamwatch, run by the National Anti-Scam Centre, publishes current examples and a way to report what you have seen. It is worth knowing where it is before you need it.

The example household, at Step 3

Checklist 3 — before you move to Step 4