Games driven by personal data have the potential to change the medium in exciting new ways, but they also have the potential to cross boundaries. What laws regulate a game's ability to harness player data, and what responsibility do devs have to use that information wisely?