LOT 04-13

Step 3 of 5

Step 3 — Accounts, email confirmation and what you agree to

A sign-up form is a contract with a text box on top of it. This step slows the form down: what is really being asked, which address to give, what the confirmation email is for, and how to read the documents the tick box points at.

What a sign-up form is asking for

Across this category the fields are broadly the same: an email address, a password, a display name, sometimes a date of birth or a country. Each one is there for a different reason, and it helps to separate them.

The email address is the account's real identity. It is how you recover the account if you forget the password, how the vendor reaches you about the account, and — if you let it — how marketing reaches you. The password is the lock. The display name is what other players see, which is a privacy decision rather than an administrative one; it should not be your full name, your school, your suburb or your year of birth. A date of birth is usually collected so that age-appropriate settings and any age-gated features can be applied. A country field may affect which store, currency or servers you see.

Then there are the fields nobody mentions because they are not fields: the tick boxes. There is normally one you must tick to create the account at all — accepting the terms — and often one or more that are optional, offering marketing email. They look alike and they are not alike. Reading which is which takes ten seconds and saves an unsubscribing chore later.

Choosing which email address to use

You are going to hand an address to a company, which will store it and pass it through whatever email delivery service it uses. That is an everyday transaction, but it is worth doing deliberately rather than with whichever address auto-fills.

Three reasonable approaches. Use your ordinary personal address, which is simplest and means account-recovery mail arrives where you will see it. Use a separate address kept for accounts and services, which keeps game mail out of the inbox you use for work and makes it obvious later which companies hold which address. Or, in a household with a young person, use an adult's address for the account while the young person uses the display name — which keeps password resets and any billing notices in adult hands.

What not to do is use a temporary or disposable address for an account you intend to keep. If the address stops working, so does your ability to recover the account, and no amount of correspondence will fix that cleanly.

Why the confirmation email exists

Most services email you a link after sign-up and ask you to click it before the account is fully active. This is routine and has three purposes: it proves the address is real, it proves you have access to it, and it prevents someone creating accounts against addresses that are not theirs.

Practically, three things are worth knowing. The message can take a few minutes, so a missing email is usually just slow. It often lands in a spam or promotions folder, so check there before requesting another one. And confirmation links commonly expire after a set period, so if you leave it until tomorrow you may simply need to request a fresh one — which is a normal thing to do, not a sign that anything went wrong.

One habit worth keeping: confirm from the message in your own inbox, not from a link someone sends you or a page that opens by itself. The confirmation email is also your record that the account exists, so it is worth keeping rather than deleting.

Passwords and a second factor

The general advice for any new account applies here and is published for Australian readers by the Australian Cyber Security Centre, which is the Australian Government's lead agency for cyber security: use a long, unique passphrase rather than a short complicated password, never reuse a password across services, and turn on multi-factor authentication where it is offered.

"Unique" is the part people skip, and it is the part that matters most. A password reused across a game account and an email account links the two: whoever learns one has the other. A password manager, including the one built into most browsers and operating systems, removes the need to remember them.

Multi-factor authentication means a second check beyond the password — usually a code from an app or a message. Not every game offers it. Where it is offered on an account that may later hold purchases, it is worth the two minutes it takes to set up.

Reading the terms and the privacy notice

You will not read every word, and nobody expects you to. What you can do in about five minutes is find the handful of passages that change what you would do.

In the terms of service, look for: whether accounts can be suspended and on what grounds; whether account sharing or selling is prohibited (it usually is); what happens to purchased in-game items if the account closes or the service ends; and whether the vendor may change the terms, and how you are told.

In the privacy notice, look for: what is collected beyond the sign-up fields; whether data is shared with advertising partners; whether it is transferred overseas, and where; and how to request access to or deletion of your data. Australian privacy law is administered by the Office of the Australian Information Commissioner, and the Australian Privacy Principles themselves are published at oaic.gov.au. Reading those thirteen principles once gives you the vocabulary for every privacy notice you will ever open.

A worked example of what a short, specific notice looks like is on this site: our own Privacy Policy walks through all thirteen principles and names exactly two things that are collected. A game's notice will be longer, because a game genuinely collects more — but length is not the same as vagueness, and vagueness is the thing to notice.

What the vendor of this course's example title says about its own sign-up is limited to the mechanics: an account is created, the email address is confirmed, and you log in. Anything beyond that — retention periods, partners, advertising identifiers — is in the vendor's own notice, and we do not restate it here, because restated policies go stale and the vendor's own page does not.

Arriving at the right page in the first place

Sign-up pages are impersonated, which is an ordinary fact about the internet rather than a reason for alarm. Scamwatch, run by the National Anti-Scam Centre, collects reports and publishes descriptions of the kinds of approach currently in circulation; its pages are a calm reference rather than a warning siren.

Three general habits cover most of it. Reach a game's sign-up page from the vendor's own published address or an official store listing rather than from a message. Look at the address bar before typing a password, and read the domain from right to left. And treat unexpected offers of free in-game currency as advertising at best — nobody with a genuine gift needs your password.

The household in Step 3

The hypothetical household agrees that an adult's email address will hold the account and that the teenager chooses the display name, with a rule that it contains no part of a real name, school or suburb. They tick the terms box, leave the marketing box alone, and confirm from the inbox rather than from the browser tab that is already open.

Before the first session, they open account settings and look for two things: who can send messages, and whether multi-factor authentication is available. The eSafety Commissioner, Australia's independent regulator for online safety, publishes general material on chat, reporting and blocking in games, and they read one page of it together. None of this takes longer than making a cup of tea, and all of it is easier before anyone has an emotional stake in the game.