Sign-ups
What actually happens when you sign up for an online game
The sign-up screen is the shortest part of a game and the part with the longest consequences. It creates an account record, attaches an identifier to a person, and sets the defaults for chat, email and purchasing that most players never revisit. This page walks through the sequence, field by field, and explains which requests are ordinary and which deserve a second look.
The usual sequence
Sign-up flows differ in wording, not in shape. Nearly every account-based online game follows the same six moves, and knowing the shape lets you notice when one of them is missing or out of order.
- Collection. An email address, a password, a display name, and usually a date of birth and a country. Some games take the display name later, inside the client.
- Terms. A link to the terms of service and the privacy policy, with a tick box or a statement that continuing means acceptance.
- Verification. A message to the address you gave, containing a link or a code that proves the address is yours.
- Client delivery. A download for desktop, or a redirect to an app store listing for a phone or tablet.
- First launch. The client signs in with the account you created, downloads game data, and begins the tutorial.
- Defaults applied. Chat, friend requests, marketing email and purchase prompts all start at a setting the game chose, not one you chose.
The sixth step is the one worth returning to. Defaults are set to suit the widest audience and the game's own retention interests, and the settings screen is normally reachable only after the tutorial has run. Ten minutes inside that screen, on the day the account is created, prevents most of the problems described elsewhere on this site.
What each field is for
- Email address
- The account identifier and the recovery route. If the address is lost, the account usually is too. For a child's account, an address a parent controls is the difference between a recoverable account and a lost one.
- Password
- The only thing standing between a stranger and an account that may later hold purchases. Games are a frequent target precisely because accounts accumulate value.
- Display name
- Visible to other players. A name that reveals a real name, a school, a suburb or a birth year hands strangers a starting point. The eSafety Commissioner's guidance for parents covers this in more detail at esafety.gov.au.
- Date of birth
- Used to decide which features are available and which protections apply. Entering a false year to bypass a restriction removes protections that were put there for the real age.
- Country or region
- Determines currency, applicable terms and sometimes which servers you are placed on. Selecting Australia is what makes Australian consumer protections the obvious frame for any later dispute.
- Optional marketing tick box
- Consent to commercial email. Separate from the account itself and reversible at any time.
What to look at twice
- A request for payment details before any part of the game has been played.
- A phone number presented as compulsory when no feature on offer needs one.
- A single tick box that bundles the terms, the privacy policy and marketing consent together.
- A sign-up form on a page that is not the vendor's own domain, reached from a link in an email or a social post.
- A prompt to sign in with an existing account from another service on a page you did not navigate to yourself.
Verification and why it exists
The verification email does two jobs. It proves the address works, so account recovery has somewhere to go, and it prevents one person creating unlimited accounts from addresses that do not exist. From a player's side it has a third use: it is the first message the vendor will ever send you, and it shows you what their legitimate email looks like. Keep it. When a later message claims to be from the same game, the genuine article is sitting in the same mailbox for comparison — the sending domain, the formatting and the link destinations should match.
If a verification message does not arrive, the ordinary causes are a typed address, a spam filter, or a mailbox that silently rejects mail from new senders. The unordinary cause is that the sign-up page was not the vendor's. That is worth ruling out before requesting a resend.
Age gates and what they actually do
An age gate is a declaration, not a verification. Typing a year changes what the account is permitted to do — commonly whether chat is open, whether friend requests can be received, whether purchases are allowed, and what marketing may be sent. It does not check anything.
The practical consequence is that a child who enters an adult birth year to reach a feature has also switched off the restrictions attached to their real age, and has done so in a way no parent will see. If an account already exists with a wrong year, the vendor's support channel is the route to correcting it; most will do so on request because the correction reduces their own risk. Classification information for a particular game is published by the Australian Classification Board, and that is where a classification question should be settled rather than from an age gate inside the game.
Setting a password you will not reuse
Game accounts are reused credentials' favourite target. They tend to be created quickly, on a shared family device, with a password that already exists somewhere else, and they later accumulate purchases. The Australian Cyber Security Centre publishes plain guidance on passphrases and multi-factor authentication at cyber.gov.au, and the short version applies here without modification: a long unique passphrase for this account alone, and multi-factor authentication switched on if the game offers it.
Two practical habits cover most of the risk. First, create the account's password inside a password manager rather than inventing one at the keyboard, so it is unique by default. Second, turn on multi-factor authentication during the same sitting as the sign-up. Nearly everyone who intends to do it later does not.
Marketing consent and Australian rules
Commercial electronic messages sent to Australian addresses are regulated under the Spam Act 2003, which is administered by the Australian Communications and Media Authority. In outline, messages of that kind require consent, must identify the sender, and must offer a functional unsubscribe. The authority's own material is at acma.gov.au.
For a player, the useful points are narrow. Declining marketing at sign-up does not affect the account. Unsubscribing later must work, and if it does not, that is a matter the authority takes reports on. Transactional messages — a verification link, a purchase receipt, a security alert — are a different category and will continue regardless, which is as it should be.
What “no payment to create an account” does and does not mean
A game that takes no payment at the sign-up screen has told you one thing only: nothing was charged at that moment. It has not told you whether progression slows to a crawl without a subscription, whether the useful items sit behind a premium currency, or whether a randomised purchase exists. Those answers live in the storefront inside the game, and they are the subject of our page on in-game spending and randomised items.
The honest way to plan is to treat account creation and spending as two separate decisions, made on different days. Create the account, play the part that costs nothing, and only then decide what, if anything, the game is worth in AUD. The storefront is designed to be encountered at a moment of enthusiasm; separating the decisions removes most of that pressure.
Closing an account later
Account deletion is usually available, and usually harder to find than account creation. Look in account settings on the vendor's website rather than inside the game client, and expect a confirmation step by email. Two things are worth knowing before you start. Deleting an account normally forfeits anything purchased on it, with no obligation on the vendor to refund. And deletion of the account is not automatically deletion of every record: billing records in particular are commonly retained to meet tax and accounting obligations, which is legitimate.
If a deletion request is ignored, or if you want to know what personal information an organisation holds about you, the Office of the Australian Information Commissioner explains the access and correction rights available under the Australian Privacy Principles and the route for a complaint once the organisation has had a chance to respond.
The short version
Use an address you control, a unique passphrase, a display name that reveals nothing, and a true birth year. Read the settings screen on day one rather than day ninety. Treat creating the account and spending money as two separate decisions.