1. Factual background

The subject of this analysis is a marketing model for a physical product based on the use of influencer marketing combined with the environment of the game Minecraft. Online creators promote branded toys containing candy, widely available in retail sale, including in popular discount store chains. The campaign also involves creating and making available within Minecraft virtual counterparts of the promoted products, which function, inter alia, on servers, on maps and through game modifications.

Until now, influencer marketing has relied primarily on the publication of sponsored materials on social media, such as posts, stories or live streams. The marketing model under analysis, however, goes beyond traditional forms of product placement, as it uses the open environment of the game as a space for conducting advertising activities. In this case, the advertisement is not merely an element of a video; it becomes an integral component of the game world with which the recipient can interact.

The recipients of such communications are, in particular, minors. Given how well the attractive environment of Minecraft is matched to the preferences and interests of a young audience, the presented content may significantly influence the purchasing decisions of children and adolescents, which in turn may translate into increased sales of the promoted products, measured even in tens of millions of złoty.

Contemporary consumers remain particularly susceptible to the influence of influencer marketing, because the message created by online creators is often perceived as authentic. Influencers combine entertainment with commercial activity, presenting the promoted products as part of their everyday life or as a natural component of the materials they publish. As a result, recipients may perceive the advertised product as a fragment of the creator’s ordinary activity rather than a commercial communication, which may increase the potential effectiveness of the marketing impact.

The integration of advertising messages with entertainment content may give rise to the risk of exerting undue influence on market decisions, especially where identification of the commercial nature of the message is difficult. The protection of minors takes on particular importance: as market participants with limited experience and a lesser capacity for the critical assessment of advertising messages, they require heightened legal protection.

Another problematic aspect is the regulation of promotional content disseminated in the digital environment, including open-world games and social media. The applicable sectoral regulations on advertising were constructed primarily with traditional media in mind and do not always account for the specific features of modern marketing models. For this reason, the practice of influencer product placement in games has become the subject of increased interest on the part of the Polish Office of Competition and Consumer Protection (UOKiK).

2. Two parallel liability regimes

The practice of influencer product placement in open-world games may give rise to liability on two independent planes – public-law and civil-law. Both regimes operate in parallel, rest on different legal bases and pursue different objectives; accordingly, the application of one does not preclude pursuing liability under the other.

The basis for public-law liability is provided by the Act of 16 February 2007 on Competition and Consumer Protection. Under Article 24 of the Act, practices infringing the collective interests of consumers are prohibited. The competence to conduct proceedings and impose sanctions rests with the President of the Office of Competition and Consumer Protection, whose task is to protect the public interest by eliminating practices capable of infringing the rights of a broad circle of consumers.

In the marketing model under analysis, the potential infringement arises not from the mere fact of promoting a product, but from the manner in which the advertising activities are conducted. The use of the game world as a promotional space, combined with the influencer’s activity, may blur the line between entertainment content and commercial communication. Consequently, the recipient – especially a minor – may be unaware of being exposed to advertising, which hinders the making of an informed purchasing decision. Such conduct may be found contrary to good practices (dobre obyczaje) and in breach of the trader’s information obligations towards consumers.

Marketing materials whose recipients are minors raise particularly serious doubts on the part of the President of UOKiK, given minors’ greater susceptibility to manipulation and unfair practices. In addition to supervising the proper labelling of advertisements on social media, UOKiK also scrutinises conduct that may qualify as aggressive advertising directed at children. Advertisers may not create content which is simultaneously directed at children, direct in character and expressly exhorts minor recipients to purchase a product or to persuade adults to do so.

A practical example of the enforcement of liability under the above regulations is the proceedings conducted against the influencers Wojan and Palion, who publish content devoted to Minecraft, mainly on YouTube. According to the President of UOKiK, the materials posted by the creators could generate purchasing pressure among children by seamlessly combining gameplay elements with the promotion of their own products, such as clothing, school supplies and beverages[1]. For this reason, on 13 July 2026 the influencers were formally charged with conduct capable of infringing the collective interests of consumers. If the infringement is confirmed, UOKiK may impose a fine of up to 10% of the turnover achieved in the financial year preceding the year in which the fine is imposed[2].

Independently of public-law liability, the conduct described may give rise to civil-law liability. In that case, the purpose of the proceedings is not the protection of the public interest, but the protection of the individual interests of parties whose rights have been infringed. An action may be brought both by a competitor and by a consumer, provided the trader’s conduct qualifies as an act of unfair competition or an unfair market practice.

With respect to advertising conducted within the Minecraft environment, particular importance attaches to Article 16 of the Act of 16 April 1993 on Combating Unfair Competition, which governs unfair advertising. If the manner of presenting a product in the game world conceals its commercial character, misleads recipients or exploits the credulity of children, such conduct may qualify as an act of unfair competition. Parties whose interests are thereby threatened or infringed are entitled to the claims provided for in Article 18 of that Act. These include, among others, the right to demand cessation of the prohibited conduct or removal of its effects, compensation for the damage caused, or surrender of unjustly obtained benefits.

Independently of the above, a consumer may also pursue claims under the Act of 23 August 2007 on Counteracting Unfair Market Practices. Such practices include, in particular, the dissemination of unfair information, misleading consumers and the use of surreptitious advertising. Under Article 12, the consumer has the right to demand cessation of the unfair practice or removal of its effects, a price reduction, and compensation for the damage caused, in particular through annulment of the contract subject to the mutual return of performances and reimbursement by the trader of the costs incurred by the consumer in connection with the purchase of the product.

3. An act of unfair competition — what does it consist of in this case?

Assessing the marketing model under analysis from the perspective of the Act of 16 April 1993 on Combating Unfair Competition requires, first of all, determining whether the manner of presenting products in the Minecraft environment, through the creation of their virtual counterparts, may qualify as unfair advertising. Under Article 3 of the Act, an act of unfair competition is conduct contrary to the law or to good practices, if it threatens or infringes the interest of another undertaking or of a customer. One form of such an act is unfair advertising, detailed examples of which are set out in Article 16 of the Act.

The essence of the problem presented by the facts at hand is not the promotion of products by influencers as such, but the manner in which the advertising is conducted – embedding the marketing message into the game’s storyline and presenting it as a natural element of gameplay. As a result, the average recipient may fail to notice that they are being exposed to commercial content, which they may take for an ordinary element of the game world or a spontaneous recommendation by the online creator.

The infringement described above is classified as surreptitious advertising (kryptoreklama), included on the so-called blacklist of unfair market practices. It consists in presenting advertising content in a manner that conceals its commercial character, preventing the consumer from making an informed assessment of the message[3]. With regard to Minecraft, examples of such conduct may include placing the advertised product as an element of the storyline, creating its digital counterpart, or using it as a reward for completing specific tasks. In each of these cases, the advertisement ceases to function as a separate marketing communication and becomes part of the player’s experience. From a legal standpoint, it is precisely this integration of advertising with gameplay that may make it difficult for the recipient to recognise its true character.

The general clause contained in Article 3 of the Act of 16 April 1993 on Combating Unfair Competition obliges undertakings to act not only in accordance with the law but also with good practices. These primarily require conducting business in an honest and transparent manner. A breach of those standards – for instance by concealing the advertising character of a publication – could place undertakings applying higher standards of transparency at a competitive disadvantage and thereby undermine fairness in market competition. With respect to the strategy under analysis, good practices also require the influencer to treat their followers honestly and, accordingly, not to exploit their loyalty and susceptibility to the influence of recommendations.

The possibility of holding a person liable for infringing the above regulations depends, however, on whether the influencer is regarded as an undertaking. Under Article 2 of the Act of 16 April 1993 on Combating Unfair Competition, an undertaking includes, among others, a natural person who participates in economic activity by conducting gainful or professional activity, even as a secondary occupation. Today, the main source of influencers’ income is ceasing to be revenue linked to user engagement with published content; increasingly important are fees earned under advertising contracts, sales of products under their own brands, and the provision of other marketing services. Consequently, given the professional and gainful character of their activity, applying the provisions on combating unfair competition to online creators becomes justified.

Following an analysis of the materials published on the entertainment channels of Wojan and Palion, UOKiK found that their online activity involved practices amounting to hidden and aggressive advertising. The President of UOKiK described the situation as follows: “Meanwhile, the influencers I have charged promote their businesses through social media content based on popular computer games for children. One moment they are narrating the course of the gameplay, and the next they are encouraging viewers to buy backpacks, beverages or T-shirts. The advertising message is woven into content of an entertainment character.[4]” The principal charge concerned the use of marketing strategies blurring the line between entertainment and marketing activities, for example by constructing a storyline in Minecraft featuring virtual counterparts of the Żabka store chain offering an assortment of “Wojanek” or “Palionek” branded beverages.

4. Why does a recognisable creator become a subject of interest for UOKiK?

The basis for intervention by the President of UOKiK is an infringement by an undertaking of the collective interests of consumers, which include, among others, unfair market practices, acts of unfair competition, and failure to comply with information obligations towards consumers. An important point is that the collective interest of consumers is not the sum of individual interests; the President of UOKiK therefore does not protect a specific consumer, but the entire group of recipients to whom the commercial communication is addressed.

Influencers who have built up substantial popularity and influence are subject to particular scrutiny by UOKiK. Content published by digital creators may simultaneously reach hundreds of thousands or even millions of users. An infringement committed by an influencer in such circumstances therefore does not harm a single individual, but may mislead a broad group of consumers, thereby constituting an infringement of the collective interests of consumers.

The principal objective of UOKiK’s activity is the protection of the public interest, not the resolution of disputes between specific parties. As a result, proceedings conducted by the President of UOKiK are public-law and administrative in character. For this reason, the imposition of a fine does not depend on the undertaking’s fault; it is sufficient to demonstrate that the infringement occurred. UOKiK’s sanctions are intended, in particular, to have a preventive character and to encourage companies to implement legal-conformity mechanisms, i.e. compliance. In light of the above, an influencer conducting professional and gainful advertising activity should verify the conformity of their publications with the applicable provisions and guidelines, bearing in mind that lack of awareness of an infringement does not relieve them of administrative liability.

The President of UOKiK has the competence to issue a decision finding a practice to infringe the collective interests of consumers and ordering its discontinuation, in which measures may be specified to remove the ongoing effects of the infringements, such as the publication of a statement in the form and with the content specified in the decision[5]. Such a decision is not issued, however, where the undertaking has already ceased the prohibited practice. To prevent proceedings from being automatically terminated merely by removing the advertising material that breached applicable legal requirements or by subsequently labelling the collaboration, Article 27 introduces a decision finding a practice to infringe the collective interests of consumers and declaring that it has been discontinued. On that basis, the President of UOKiK may still order the undertaking to take specific actions to remove the effects of the earlier infringement.

Where a marketing strategy relies on influencers publishing advertising materials using Minecraft, the infringements typically consist in failing to communicate unambiguously that the content is commercial in character. This requirement is set out, among others, in the Recommendations of the President of UOKiK on the labelling of advertising content by influencers, in which the President of UOKiK emphasises that every commercial collaboration – regardless of the form of remuneration (barter, monetary, or a free product) – should be labelled in a manner comprehensible and clearly legible to the average recipient. Moreover, clearly indicating the advertising character of the message at the recipient’s very first contact with the material is an obligation resting not only on influencers, but also on advertising agencies and advertisers. Two-level labelling is recommended, consisting in the simultaneous placement of a proper disclosure by the author of the publication and the use of the tools offered by the platform for labelling advertising content. The mere use of hashtags – especially in abbreviated form, or forms that do not highlight the fact that the influencer received a benefit, such as #ad, #gifted or #współpraca – may be found insufficient. Preference is given to annotations that are clear to recipients and legibly indicate the commercial character of the content, such as #reklama (#advertisement), #prezent (#gift), #autopromocja (#selfpromotion) or #współpracabarterowa (#bartercollaboration).

5. Directing communications at children – the strictest regime

The principal problem for businesses interested in using influencer marketing and open-world games for marketing purposes is the rigorously regulated protection of minor recipients. Advertisers creating content that is by design directed particularly at a young group of potential consumers are obliged to exercise exceptional caution and to take into account additional restrictions arising from the law.

The fundamental role of regulations protecting children against prohibited marketing strategies is evidenced by the inclusion, on the blacklist of aggressive market practices, of advertising containing a direct exhortation to children to purchase the promoted products or to persuade adults to buy them for them[6]. This means that practices of this kind are deemed unfair in all circumstances. When watching, for example, a television advertising block, a child is usually aware of its commercial character. In the case of product placement carried out by an influencer in the Minecraft environment, however, the marketing message is incorporated into the narrative of the gameplay. The young recipient focuses on the course of the game rather than on assessing the nature of the communication, which increases their susceptibility to the advertising’s influence. Beyond hidden promotional messages, it is also prohibited to use tactics classified as aggressive, i.e. influencing the consumer’s behaviour towards a product through pressure or physical or psychological coercion[7].

Examples of communications that raised the doubts of the President of UOKiK and were found to be aggressive are statements made by the influencers Wojan and Palion during their publicly streamed Minecraft gameplay: “Get down to the Żabka stores while these Wojanki are still around.” “Come to Palion Style and order while it lasts, because it’s selling like hot cakes, and school is just around the corner.” “Do you have a box like this? Over 500 people already have one – and you don’t? Come on in, hurry, because school is starting any moment.” These statements are not limited to a neutral presentation of the product. They simultaneously deploy the scarcity mechanism (“while they last”), time pressure (“school is just around the corner”) and social proof (“500 people already have one”), which in the case of minor recipients may lead to manipulation of purchasing decisions that is impermissible under the law.

When publishing advertising content, it must be borne in mind that a child does not possess the capacity for critical analysis of digital content or a level of life experience comparable to the awareness of adults. As a result, conduct which, in relation to adult recipients, could be regarded as a permissible form of marketing communication may, in relation to minors, constitute an unfair market practice.

Owing to the long-term relationships they build with their audiences, influencers commonly come to act as online idols or authority figures. Advertising in the digital environment – for instance within a game – frequently relies on psychological mechanisms characteristic of the information and consumer society, described as the FOMO phenomenon (fear of missing out), compounded by the effect of identification with the influencer or their idealisation, and by pressure resulting from a perceived urgency of purchase and group behaviour. These instruments act considerably more strongly on children than on adult consumers, which provides the basis for a stricter standard for assessing the lawfulness of such practices.

Product placement – the broadcasting regime

In order to reinforce the authenticity of a commercial message, advertisers use product placement, i.e. the natural incorporation of a good, service or trademark into another publication, as an element of the storyline or set design. Product placement is usually better received by consumers than classic advertising, since the promotional message is less intrusive and does not create an impression of direct purchasing pressure. Owing to the greater degree of integration of the advertisement with the presented material, this practice creates conditions conducive to abuse.

The conditions for the admissibility of product placement are set out in Article 17a of the Act of 29 December 1992 on Broadcasting. The practice is acceptable in all programmes, subject however to the specific exceptions provided by the legislator, such as programmes for children. Minors, whose cognitive maturity is not yet fully developed, require reinforced protection against marketing content whose form is less obvious to the recipient. A particularly problematic issue has become product placement in games with an open structure, such as Minecraft. Where the principal entertainment offered by the game is the unlimited possibility of building new worlds and creating the elements that compose them, it is exceptionally difficult to determine whether the actions taken by influencers constitute merely part of the gameplay or already take on the character of paid collaboration.

The protection of recipients is reinforced by obligations imposed on broadcasters. It is prohibited, by means of product placement, to give undue prominence to a product or to directly encourage its purchase through promotional actions. It is also necessary to appropriately mark the programme with a graphic symbol[8]. Product placement is therefore a lawful strategy, provided its transparency is maintained and excessively direct promotional messages are avoided.

This regime, however, covers above all the activity of broadcasters within the meaning of the Act of 29 December 1992 on Broadcasting. An influencer does not, generally speaking, have the status of a “broadcaster”, and the content they publish is not covered by the obligations arising under Article 17a of the Act. Under the current legal framework, the high standard of protection of young recipients covers, among others, television and radio materials; yet where the same content is published by a digital creator, for example as a video on YouTube, only soft-law recommendations apply.

Recognising the growing popularity of mass social platforms, the EU introduced Directive (EU) 2018/1808 of the European Parliament and of the Council of 14 November 2018 amending Directive 2010/13/EU on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive, AVMSD) in view of changing market realities. The act extended the scope of regulation to video-sharing platform providers, which, however, does not mean that the boundary between influencers and broadcasters has been entirely erased. The requirements arising from the Directive focus mainly on platforms’ responsibility for creating mechanisms to protect minors, such as age verification and enabling creators to unambiguously label commercial content. The act does not, however, fully equate online creators with broadcasters in terms of the rights and obligations arising from competition and consumer protection.

A legal gap thus arises which allows influencers to publish content containing product placement directed at children on social media or in the gaming environment discussed here. The very same materials, if presented in the form of a television programme or radio broadcast, would simultaneously be found impermissible and in breach of the Act. The same advertising communication is therefore subject to different standards of scrutiny solely on account of the entity distributing it.

This produces a paradoxical legal situation in which the highest level of protection for minors is provided for content published via traditional media. Under contemporary marketing strategies, by contrast, children and adolescents are most exposed while using online platforms and video games, whose product-placement activity is governed by soft-law instruments such as the guidelines and recommendations of the President of UOKiK or platform terms of service. Article 17a of the Act of 29 December 1992 on Broadcasting should nevertheless serve as a normative benchmark illustrating the level of protection of minors that the legislator considers desirable. The legal gap described – as it reveals the lack of full coherence in protecting children against hidden advertising messages – should form the basis for further amendment of the provisions relating to influencer marketing and commercial materials published on video-sharing and gaming platforms.

Advertising of food and sweets to children – a liberal regulatory model and its limitations

The Polish legislator has not decided to introduce a statutory prohibition on the advertising of food – particularly sweets high in sugar, fat or salt (HFSS – high fat, sugar, salt) – directed at children. The protection of minors in this area takes the form of liberal regulation, based on self-regulatory solutions developed by the media market. The state has thus laid down only a general legal framework, leaving detailed restrictions and rules to the will of market participants, chiefly broadcasters.

Provisions in this area are contained in the Agreement of television broadcasters on the principles of disseminating food advertisements directed at children, in force since 1 January 2015. This self-regulation came into being through the active cooperation of, among others, the National Broadcasting Council (KRRiT), the Advertising Council, the Polish Federation of Food Producers, the Ministry of Health and the television broadcasters who undertook to sign it voluntarily[9]. The Agreement aims to counteract the formation of undesirable eating habits among young audiences and to clarify and extend the duties arising from Article 16a(3a) and (3b) of the Act of 29 December 1992 on Broadcasting. Under those provisions, programmes directed at children should not be accompanied by content advertising foodstuffs or beverages whose excessive consumption may be harmful. KRRiT has, moreover, been granted the competence to designate such foods by regulation, after consulting the minister responsible for health. That body may also indicate preferred ways of publishing advertisements for foodstuffs questioned from a health perspective, so that such messages do not accompany children’s programmes.

Supervision of the operation of this self-regulatory system is exercised by the National Broadcasting Council. The authority analysed the activity of sixteen children’s channels and eight general-audience channels over the period from July 2020 to June 2023. Its key findings, contained in the report “Television channels and programmes for children free of advertisements for sweets and salty snacks”, indicate a high level of compliance with the commitments undertaken by the parties to the agreement. Appropriately constructed self-regulatory mechanisms may therefore sometimes prove equally or even more effective than rigidly imposed hard law. Particularly in relation to a flexible and dynamic media market, greater decision-making autonomy for broadcasters with respect to practical rules may contribute to a more efficiently functioning system.

The protection system is further supplemented by instruments of advertising ethics, in particular the Code of Advertising Ethics and the activity of the Advertising Ethics Commission operating within the Advertising Council. The Code contains guidance on responsibly directing marketing communications at children and prohibits advertisers from exploiting their natural trust and lack of experience[10]. In assessing the admissibility of food advertisements, the principal reference point is the HFSS criterion (high fat, sugar, salt), on the basis of which products are classified as requiring particular marketing caution owing to their content of ingredients potentially harmful in large quantities.

The effectiveness of the self-regulation flowing from the Agreement of television broadcasters on the principles of disseminating food advertisements directed at children is nevertheless limited in both its personal and material scope. The rules bind only the voluntary signatories of the agreement, who are primarily traditional television broadcasters. Moreover, they apply to marketing materials broadcast in television programmes or radio broadcasts falling within the scope of the agreement. Its provisions do not, however, constitute binding guidelines for online creators publishing content on platforms such as YouTube or TikTok, or for persons conducting advertising activity in the computer-game environment. An influencer, remaining essentially outside the reach of the regulations analysed, may thus use Minecraft to present a sponsored toy containing sweets, use it as an element of the gameplay, and so on.

The example described reveals a visible regulatory asymmetry. Advertising of sweets or other foodstuffs questioned from a health perspective, broadcast via traditional media, is subject to a range of extensive restrictions and to the supervision of KRRiT. An analogous communication published by a digital creator using instruments at the frontier of new technologies remains covered only by the general principles of consumer law and the Recommendations of the President of UOKiK.

A model based on the combination of liberal statutory regulation and broadcaster self-regulation therefore does not guarantee full protection of minors, given its mismatch with the way in which the youngest internet users consume content today. Marketing communications concerning food and sweets are increasingly being shifted by advertisers from traditional television to social media and gaming environments, where the existing protective mechanisms have a much narrower scope of application. The resulting regulatory gap constitutes one of the most significant arguments in favour of developing more coherent rules on influencer marketing directed at minors, irrespective of the communication channel used.

Open-world games, crypto and blockchain – the most rapidly developing layer

A relatively significant regulatory challenge is also posed by the use of blockchain technology and economic mechanisms linked to the environment of digital games. The issues of advertising and product placement are already subject to relatively well-established regulation, but areas based on the use of newer technologies remain at a stage of dynamic legislative development. Under the current legal framework, the prevailing part of the provisions in this area merely indicates the desirable directions in which the law should develop, i.e. takes the form of de lege ferenda postulates.

A subject of particular debate is so-called loot boxes, i.e. in-game elements containing randomly selected items or other mechanisms facilitating gameplay. They can be purchased using in-game currency or by paying with real money. Their similarity to games of chance is contested, in particular because the player pays a fee in order to gain access to a previously unknown reward, the value of which depends on chance rather than skill. This kind of exploitation of psychological propensities – human susceptibility to addiction to randomised outcomes and variable-ratio reward systems – provides grounds for the development, among children, who constitute the dominant group of game users, of tendencies towards compulsive and gambling behaviour.

Polish law contains no provision that directly regulates the practice of loot boxes. Of fundamental relevance here is the Act of 19 November 2009 on Gambling Games, Article 2 of which defines games of chance as games offering monetary or material prizes whose outcome depends on chance. Loot boxes, however, are not expressly listed among the games falling within that category, which leaves online creators and game producers facing legal uncertainty as to whether their activity might be found to promote gambling.

Increasingly, elements functioning within computer games do not remain merely digital items used during gameplay. Thanks to blockchain technology, they can be transformed into tokens or non-fungible tokens (NFTs), which exist independently of the game itself and can be traded on external platforms. This practice means that activity conducted within the game environment may begin to fall within the scope of Regulation (EU) 2023/1114 of the European Parliament and of the Council on markets in crypto-assets (MiCA). Where a token is not used solely within the game environment but becomes the object of trading on a secondary market or performs an investment function, it may be deemed a crypto-asset within the meaning of MiCA. Consequently, issuers and entities promoting such solutions may become subject to obligations concerning transparency of information, publication of information documents (whitepapers) and the conduct of marketing communications in accordance with the requirements of the Regulation.

A factual situation thus arises in which the same product may function simultaneously as a physical toy available in retail sale, an item used during gameplay in Minecraft, and a token recorded on a blockchain. Each of these forms is subject to different legal regimes, including consumer law, the rules on counteracting unfair market practices, the Gambling Games Act, digital services legislation, and the crypto-asset market rules arising from the MiCA Regulation.

The case under analysis clearly demonstrates that contemporary legal regulation, both national and European, has not been updated sufficiently to provide advertisers and consumers alike with a clear position in relation to the multi-layered commercialisation model that is now widespread. The dynamic impact of new technologies on traditional legal institutions has created a need to develop more coherent solutions encompassing consumer law and the protection of minor participants in the media market, without divisions into different modes of regulation depending on the entity disseminating the advertising content.

Conclusions

The analysis conducted does not mean that the practice of influencer product placement in the open environment of Minecraft is, under the current legal framework, subject to no regulation at all. Of key importance are, above all, statutes containing general clauses, such as the Act on Combating Unfair Competition, the Act on Counteracting Unfair Market Practices and the Act on Competition and Consumer Protection. The use of the concept of good practices, the prohibition on misleading consumers, and the model of the average recipient of advertising content means that these provisions can impose certain duties even on relatively novel marketing strategies, for instance those employing new technologies. Confirmation of this thesis may be found in the activity of the President of UOKiK, who has brought formal charges against influencers, such as Wojan and Palion, for infringing the legal norms presented above.

Considerably less flexible, by contrast, are the sectoral regulations designed with traditional media in mind. The provisions of the Broadcasting Act, including those on product placement, and the self-regulatory mechanisms relating to food advertising directed at children, are built around the concepts of “broadcaster”, “programme” and “transmission”. These terms correspond to traditional media but do not fit the dynamically growing internet platforms, streaming services and gaming environments of today. As a result, an identical marketing communication may be subject to different standards of protection solely on account of the manner of its dissemination.

A regulatory gap also appears with respect to the protection of minors. Television and radio broadcasters are bound by extensive restrictions, whereas in the social media environment protection rests primarily on self-regulation, guidelines of administrative authorities and platform terms of service. These solutions, though important, do not provide a level of protection comparable to the regulations binding traditional broadcasters.

New monetisation models employing randomised mechanisms, tokenisation of items and blockchain technology in turn create a problematic situation of simultaneous subjection to consumer law, the rules on unfair market practices, the Gambling Games Act, the MiCA Regulation and digital services legislation. What emerges is a multi-layered regulatory system in which a single product or service may be assessed concurrently from the perspective of several separate legal regimes.

Legal change in the areas described could be introduced by extending the sectoral regulations and redefining concepts such as “broadcaster”, “programme” and “transmission” so that they also cover online creators and communications carried out in gaming environments. Alternatively, the less flexible legislative acts could be transformed along the lines of statutes with a broader personal scope, through the use of general clauses.

Given the dynamic development of new technologies, the second path of legislative change appears the more prudent. Statutes based on general clauses display considerably greater durability, as they make it possible to assess new phenomena regardless of the mechanisms employed.

[1] https://uokik.gov.pl/reklama-skierowana-do-dzieci-uokik-sprawdza-media-spolecznosciowe

[2] Act of 16 February 2007 on Competition and Consumer Protection, Article 106.

[3] Act of 23 August 2007 on Counteracting Unfair Market Practices, Article 7.

[4] https://uokik.gov.pl/presja-zakupowa-na-dzieci-zarzuty-dla-dwoch-influencerow-youtubowych

[5] Act of 16 February 2007 on Competition and Consumer Protection, Article 26.

[6] Act of 23 August 2007 on Counteracting Unfair Market Practices, Article 9.

[7] Ibid., Article 8.

[8] Act of 29 December 1992 on Broadcasting, Article 17a.

[9] https://www.gov.pl/web/krrit/krrit-chroni-dzieci-przed-reklamami-tzw-niezdrowej-zywnosci

[10] Code of Advertising Ethics, Article 24.

Artykuł Influencer Product Placement in Open-World Games and Competition and Consumer Protection Law pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are pleased to share that Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, one of Poland’s leading legal and financial publications, devoted to one of the most intriguing regulatory phenomena of the digital economy: loot boxes in video games.

“Loot boxes in video games: between gambling law and consumer protection – a regulatory analysis under Polish and European Union law”

The article goes far beyond the classic “are loot boxes gambling?” debate. By analysing the actual monetisation models used in modern games — particularly microtransactions involving paid acquisition of virtual packages with randomised content — we examine how these mechanisms interact with:

• Polish gambling law and the statutory definition of a game of chance,
• EU consumer protection rules,
• digital services regulation,
• taxation and compliance considerations,
• and emerging concerns related to behavioural design and dark patterns.

One of the key conclusions is that the regulatory importance of loot boxes stems not only from their possible resemblance to gambling mechanisms, but also from the fact that such systems are frequently used by inexperienced consumers, including minors, who may be especially susceptible to manipulative design techniques aimed at increasing engagement and spending.

This is precisely the type of cross-sector regulatory issue in which our team has extensive experience — combining expertise in technology law, highly regulated industries, digital services, compliance, consumer protection and EU regulatory frameworks. We are proud that this experience is reflected in publications appearing in professional journals such as Infor.

Read the article here: Infor – Loot boxes in video games: between gambling law and consumer protection

Artykuł Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, devoted to loot boxes in video games pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Act amending the Act on the National Cybersecurity System aims to implement Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS Directive 2) and the partial application of Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council.

The amendment to the KSC Act significantly expands the scope of the regulations and introduces new obligations in the field of cybersecurity management. The changes include, among other things, the implementation of risk management systems and expanded incident reporting requirements. The new regulations also strengthen the powers of supervisory authorities and significantly increase the maximum amount of financial penalties. It also introduces liability for the management staff (manager) of an entity. In practice, this requires certain entities to take steps to comply with the new regulations.

The first experiences of entrepreneurs after the amendment came into force – practical conclusions

The few months that the amended Act on the National Cybersecurity System has been in effect demonstrate that the biggest challenge for businesses is no longer the analysis of the new regulations, but their practical implementation. For many organizations, the adaptation process began with a seemingly simple task: determining whether a given entity is even subject to the new regulations. In practice, this step proves to be one of the most problematic.

Under the previous legal framework, many businesses awaited a formal administrative decision confirming their status as an essential service operator. This approach is no longer appropriate. The status of a key or important entity stems directly from the Act, and obligations arise regardless of whether the business has already been entered on the register. This means that the responsibility for properly assessing their own situation rests primarily with the business itself.

Practice also shows that many companies focus solely on the issue of being entered into the register of key and important entities. However, entry itself is not the purpose of the regulation. The greatest challenges remain the actual implementation of an information security management system, conducting a risk analysis, developing incident response procedures, and adequately documenting the actions taken. In the future, supervisory authorities will primarily assess an organization’s actual level of compliance with the Act, not merely the formal fulfillment of registration obligations.

Another significant change is the significant increase in management responsibility. Management can no longer treat cybersecurity as a matter solely within the purview of IT departments. The Act requires active management involvement in the organization of the cybersecurity management system, oversight of its operation, and provision of adequate organizational and financial resources. In practice, this requires regular reporting on cybersecurity issues at the management level and documentation of decisions made.

Supply chain security is also becoming increasingly important. Businesses are required not only to secure their own IT systems but also to consider the risks arising from collaboration with IT service providers, cloud computing operators, software vendors, and outsourcing providers. In practice, this means reviewing supplier contracts, verifying the security measures in place, and implementing appropriate provisions for incident management and crisis cooperation.

It’s also noticeable that a growing number of businesses are choosing to conduct internal compliance audits before the statutory deadlines expire. This approach allows for early identification of organizational and technical gaps, reducing the risk of subsequent violations and costly remedial actions.

In practice, the best solution is to treat the implementation of the Act’s requirements not as a one-time project, but rather as a process encompassing regular risk analysis, procedure updates, employee training, and ongoing oversight of the organization’s security. This approach not only increases compliance but also significantly reduces the risk of cybersecurity incidents.

It’s worth emphasizing that the current transition period should be used to calmly prepare organizations for the full application of the new regulations. Postponing implementation until the final months before the statutory deadlines expire can be risky, especially for large organizations where implementing information security management systems requires the involvement of multiple departments and adequate time to prepare procedures and documentation.

Change in the circle of entities to which the Act applies.

Under the previous wording of the Act, an administrative decision was required to recognize an entity as an essential service operator (Article 5 of the Act before the amendment). Currently, the group of key and important entities is determined automatically (ex lege). The criteria for qualifying an entity as essential are found in Article 5, Section 1, and as an important entity in Article 5, Section 2 of the Act. It is possible that an entity meets the criteria for both key and important entities; such an entity is considered a key entity under Article 5, Section 4. When attempting to qualify entities, the Act also refers to EU regulations, particularly Regulation 651/2014/EU, which defines SMEs. Therefore, the primary criteria taken into account will be the number of employees and annual turnover. It is also necessary to refer to Annexes 1 and 2 of the Act, which precisely define the categories of entrepreneurs in specific sectors and subsectors.

The added Article 5a in paragraph 1 provides that key and important entities are subject to the obligations arising from the Act if they reside in the territory of the Republic of Poland or conduct their business in the territory of the Republic of Poland.

Articles 7 et seq. regulate matters related to the list of key and important entities. Before the amendment, the list contained only operators of essential services; now it includes key and important entities. Unlike the previous legal status, in which entry was made at the request of the authority responsible for cybersecurity (former wording of Article 7, paragraph 3 of the Act), entry is now made at the request of a key or important entity within six months of the occurrence of the conditions (Article 7c, paragraph 1 of the Act). Ex officio entry will generally only apply to existing operators of essential services, trust service providers, telecommunications companies, and public entities. This means that for entities meeting the conditions on the date the amendment comes into force, the deadline for submitting an application is October 3, 2026. Pursuant to the Announcement of the Minister of Digitization of April 8, 2026, regarding the schedule for submitting applications for entry in the register of key and important entities and for key or important entities to commence using the ICT system , self-registration on the list is possible from May 7, 2026, to October 3, 2026. The platform operating in the S46 system is available at https://wykaz-ksc.gov.pl/ . By April 3, 2027, key and important entities are required to commence using the ICT system specified in Art. 46 sec. 1 of the Act. This deadline begins depending on whether the entities were parties to agreements regarding the use of the ICT system referred to in Art. 46 sec. 1 of the Act concluded before April 3, 2026. For the former, the possibility of using the system was opened on April 8, 2026, and for the latter, this possibility will be available from June 12, 2026 (point 2 of the Communication of the Minister of Digital Affairs).

If an entity that meets the criteria for being considered a key or important entity fails to submit an application for entry, the authority responsible for cybersecurity may enter the entity on the list ex officio (Article 7j, paragraph 1 of the Act). Failure to comply with certain obligations related to the list (failure to timely complete missing data on the list or failure to correct data despite a request or failure to submit an application for entry) may result in the imposition of a substantial fine (Article 73, paragraph 1, point 1 and Article 73, paragraph 1a, point 1 of the Act). The catalogue of data to be included on the list has also been changed (expanded) (Article 7, paragraph 2).

In practice: The expansion of the scope of entities and the shift from administrative decision-making to automatic regulation mean that many entities may be subject to the Act without formal confirmation of this status. In practice, independent qualification analysis and continuous monitoring of compliance with statutory criteria become crucial. An incorrect assessment (or failure to comply) may result in exposure to sanctions (severe fines).

New responsibilities for cybersecurity management.

Duties

Chapter 3, which governs the obligations of key and important entities, has been expanded, and Chapters 3a and 3b have been added, addressing domain name registration service providers and public entities. Article 8 of the Act governs obligations related to the implementation of an information security management system. Compared to the previous legal framework, numerous obligations have been added. The responsibility of the manager of a key or important entity for the performance of its cybersecurity obligations has been introduced (Article 8c of the Act), and the manager’s responsibilities have also been defined (Articles 8d–8f of the Act).

The regulations regarding incident reporting have also changed. A key or important entity classifies a given incident as serious (after meeting the requirements of Article 2, Section 7 of the Act), then issues an early warning, reports the incident, and finally submits a final report on the handling of the serious incident to the CSIRT (a three-step reporting model instead of the previous one-step model – Article 11 of the Act).

Deadlines

Pursuant to Article 15 of the Act, key entities must conduct a security audit of the information system used in the service provision process at least once every three years. For key entities that were not previously classified as key service operators, the first audit should be conducted within 24 months of the date the conditions are met (Article 16, point 2, therefore, for these entities, the deadline for conducting the audit is April 3, 2028).

The Act amending the KSC Act establishes a 12-month transition period during which key and important entities have time to fulfill the obligations specified in Chapter 3 of the Act (except for the obligation to conduct the first audit, which entities have 24 months to conduct). Therefore, with respect to obligations such as implementing an information security management system, risk assessment, implementing technical and organizational measures, reporting and managing incidents, and verifying personnel’s criminal records, the deadline for compliance with these regulations expires on April 3, 2027.

In practice: The imposed obligations require the implementation of an information security management system. Furthermore, the single-tier incident reporting system has been changed, replaced by a more complex three-tier system. Essential entities will be required to conduct audits. Importantly, entities that were not previously considered essential service operators will be required to conduct an audit within two years of the amendment’s entry into force. However, most of the new obligations will have to be implemented by April 3, 2027. Failure to comply with these obligations will result in the manager of the relevant entity being held liable.

Change in the amount and grounds for imposing fines.

Until April 2, 2026, the maximum amount of the fine imposed on entities (only for the most serious violations) was PLN 1 million (former wording of Article 73, paragraph 5 in fine). Currently, the maximum amount of the fine is, as a rule, EUR 10 million (Article 73, paragraph 3 of the Act), and for the most serious violations, up to PLN 100 million (Article 73, paragraph 5 in fine of the Act).

With the imposition of a large number of obligations on key and important entities, the list of violations for which a fine may be imposed has also been expanded (Article 73 of the Act).

The new provisions on fines come into force only two years after the entry into force of the Act (i.e. from April 3, 2028).

In practice: Increasing the amount of fines disciplines key entities and important entities to take their cybersecurity obligations very seriously. It is worth emphasizing, however, that the amended regulations on fines will not enter into force until April 3, 2028.

Changes in the supervision and control of key and important entities.

Chapter 11 of the Act, which deals with the supervision and control of key and important entities, has been significantly expanded. Some provisions remain unchanged (the requirement to apply the provisions of the Entrepreneurs’ Law or the Act on Audit in Government Administration, the powers of the person conducting the audit, most of the obligations of audited entities, and provisions regarding audit protocols and post-audit recommendations).

Important changes

The most important changes in the scope of supervision include a significant expansion of Article 53, which describes the powers of the authority responsible for cybersecurity regarding supervision and oversight of key entities. It empowers the competent authority to issue various types of administrative decisions aimed at enforcing the provisions of the Act. This article also contains a number of procedural provisions defining the nature of the proceedings. Generally, the regulations contained in this article apply only to key entities, but as stated in Article 53, paragraph 17, certain provisions also apply to inspections of important entities. Article 53, paragraph 3 states that supervision of key entities is both post-empty and preventive, while for important entities, supervision is only post-empty.

A new obligation for both key and important entities is the information obligation specified in Article 53c, which requires a key or important entity to provide certain data at the request of the authority responsible for cybersecurity.

A new institution is the ad hoc review added in Article 59c, which may be carried out only if the conditions specified in the cited Article are met.

In practice: Strengthening the powers of supervisory authorities and introducing ad hoc inspections means increased risk of inspections and the need to maintain constant readiness to demonstrate compliance with regulations. Entities should also prepare for more frequent requests for information from authorized bodies.

Minor changes

Chapter 10 has been amended and Chapters 10a – 10c have been added, but they do not contain any standards addressed to entities and are therefore not relevant from a practical point of view.

Several changes concern Chapter 12 concerning the Government Plenipotentiary for Cybersecurity and the Cybersecurity Board, but these changes do not have any significant impact on the entities.

Article 12a has been added, addressing specific measures to ensure cybersecurity at the national level. It primarily contains provisions on recommendations from the Government Plenipotentiary for Cybersecurity (Article 67a), the procedure for designating a supplier as a high-risk supplier (Articles 67b–67f), and a safeguarding order in the event of a critical incident (Articles 67g–67i).

Minor changes also apply to the Cybersecurity Strategy of the Republic of Poland (Articles 68–72). The changes primarily concern the content and method of developing the strategy, as well as the frequency of strategy reviews (2.5 years instead of the previous 2 years).

The amendment to the Act on the National Emergency Response Plan creates the basis for the adoption of the National Emergency Response Plan (Articles 72a – 72f of the Act).

Recommended actions.

In light of the amendments to the Commercial Companies Code, entities subject to the new regulations should take steps to ensure their operations are in compliance with the law. It is recommended that:

1)      Self-identification in order to determine whether a given entity qualifies as a key or important entity within the meaning of the Act.

2)      Implementation or update of an information security management system.

3)      Development of procedures for identifying and reporting incidents, taking into account the new procedure.

4)      Ensuring the involvement of management staff, e.g. the manager’s implementation of the obligations under Article 8d or 8e.

5)      Preparing the organization for potential supervisory activities, e.g. inspections.

• Action:

ex officio entries carried out by the Minister of Digital Affairs (current key service operators, trust service providers, telecommunications companies and public entities)

• Deadline:

April 13 – May 6, 2026

• Action:

self-registration in the list of key and important entities

• Deadline:

May 7 – October 3, 2026

• Action:

launching the possibility of using the S46 system for new entities

• Deadline:

June 12, 2026

• Action:

end of the deadline for starting to use the S46 system and implementing obligations (end of the adjustment period)

• Deadline:

April 3, 2027

• Action:

the first ISMS audit (for key entities that were not key service operators) and the beginning of the application of the provisions on penalties

• Deadline:

April 3, 2028

Artykuł NIS2 in Poland: Practical Implications of the New Cybersecurity Framework for Businesses pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.