More than 8,000 game demos were showcased at Steam Next Fest in October, but some planned demos never made it.


For example, Alliance Arts canceled the public demo of “Drunken Goddess Reflux” just a few days before the event. That same week, Digital Sun, the studio behind “Moonlighter,” canceled a planned public playtest for “ReVamp” and opted instead for a closed Discord test. Both cited the same reason: the fear that someone might recreate the game using AI tools before its release.

The risk is real, as copycats are now feeding demos, trailers, and screenshots into AI tools and rebuilding a game's basic features, sometimes in as little as a day. However, skipping a demo has real drawbacks, as demos have long been one of the most effective ways to build wishlists before release, and events like Next Fest are an important way for indie games to draw attention to themselves.


There is a middle ground. By limiting what you show, who sees it, and how early, you can reduce the risk, and some low-cost legal steps taken before release can make it easier and more cost-effective to stop a clone.

Your mechanics are fair game. Your art is not.

Under U.S. copyright law, game ideas and mechanics are generally not protected. Anyone can develop a “match-three” game or a puzzle game with falling blocks, which is why the industry has always been full of games that look very similar.

What copyright law protects is the expression: code, art, music, characters, dialogue, and the audiovisual presentation. The line between an unprotected idea or game mechanic and a protected expression is not always clear. Courts consider the overall look and feel, and an infringement is generally found only where the copying is close.

This is important when it comes to AI clones. Most are created from scratch based on what is shown in the demo, trailers, and screenshots, so they rarely contain copied code. Your strongest claims arise when a clone copies your actual art, music, or other assets, or, less commonly, when a downloadable demo is decompiled and its code is reused.

Then there is the name of your game. When “Needle in a Haystack Simulator” went viral, titles with similar names and store pages began appearing on Steam even before the game’s release. Here's what a Steam search for the title turned up in November 2026. Only one of these is the original, which is the one marked "Original":

Game titles and studio names can also be protected by trademark law, and a registered trademark puts you in a much stronger position to ask a platform like Steam to remove a game with a confusingly similar title. Earlier this year, the holder of a U.S. registration for "Hidden Cats" filed a trademark complaint with Valve, and other developers were told to retitle their games. That is why it is worth applying for a trademark early on.

Patents can protect a truly new game mechanic, but they are expensive, take years to obtain, and are often difficult to secure. If you plan to apply for a patent, you should file the application before the demo is released, as the release could be considered a disclosure that undermines your patent.

Knowing what is protected is only half the battle. To be able to respond quickly and cost-effectively when a clone appears, you need to prepare before the demo is released.

Five things to do before you hit publish

These measures typically cost only a fraction of what a lawsuit would cost and are affordable for most indie developers.

1. Decide what you show, who sees it, and when. A “vertical slice” or a curated playable trailer limits what can be copied. A closed playtest limits who receives the version and allows you to require everyone to accept your terms first. Timing is also important: Register your rights before the build goes public. However, even a smaller build is still a build. It can be decompiled and its art copied, so the following steps still apply.

2. Make sure you actually own your game. Freelance art designers, commissioned composers, and the friend who designed your user interface may still own their works unless those works have been assigned to you or licensed to you in writing. If they are the owners, you may not be able to enforce your rights. AI-generated assets raise a related issue: purely AI-generated output may not be protected by copyright. If your key art comes directly from an image generator, a copycat could potentially copy it without much risk. Keep records of the human creative work behind your key assets.

3. Register your work before you publish it. In the U.S., copyright arises automatically, but registration is crucial if you need to enforce it. You generally need to register before you can file a lawsuit, and registering before an infringement begins or shortly after publication can entitle you to statutory damages and attorneys’ fees. When fighting a rapidly emerging clone, this can make the difference between a credible threat and an empty one. Register the demo version, key art, and trailer before the demo is released. Also, file trademark applications for your game title and studio name before the announcement so you can take action against similar titles. Registration can take months; the sooner you file the application, the sooner you will have a registered trademark you can rely on.

4. Set specific terms for your demo. A demo EULA, as well as a non-disclosure agreement (NDA) or a playtest agreement for closed playtests, should prohibit reverse engineering, decompilation, redistribution, and the use of the version to train AI or recreate the game. For closed tests, rules regarding streaming can also be established. These terms are binding only on those who accept them; thus, they do not prevent someone from copying content from a YouTube video. However, they do give you a contractual claim against anyone who agreed to them and then violated them.

5. Have an enforcement plan ready. Know in advance who files the takedowns, what evidence you need and how fast you can move. Speed matters when a clone is collecting your wishlists.

Got cloned?

First, find out exactly what has been copied.

The answer will determine your options for taking action. If they copied your assets, code or branding, you have the clearest and most cost-effective options available: filing copyright and trademark takedown notices through the platform, as well as issuing cease-and-desist letters. This is where your registrations and trademark applications really pay off.

If only the “look and feel” has been copied, you can still submit a takedown request, but you should expect resistance. If the copier challenges this, a look-and-feel claim will usually end up in court. If a tester or player has violated your demo terms of use and can be identified, you may also have a breach-of-contract claim.

A lawsuit is a last resort and is most likely with look-and-feel claims. It is costly and time-consuming, may be impractical against a cloner based abroad, and carries a real risk, as the line between idea and expression is rarely clear-cut. For most indie developers, it only makes sense if the value of the game justifies it. However, the cost and risk cut both ways: the cloner faces them too, along with unwanted publicity. That gives you leverage, so it is usually worth sending a cease-and-desist letter first. Often, that is enough to get the clone taken down or reach a settlement.

The Checklist

Before your demo is released:

1. Scope: Determine what the version will include, who will receive it, and how long before launch it will be released.

2. Ownership: Signed assignment agreements or licenses for each asset.

3. Registrations: Copyright registrations for the demo build, key art and trailer.

4. Trademarks: Applications for your title and studio name.

5. Demo Terms: A demo EULA and a playtest confidentiality agreement tailored to the risks of the AI era.

6. Enforcement Plan: Takedowns and next steps, ready to go.

The studios that pulled their demos and playtests in October made a sensible call. Still, a demo remains one of the best tools you have. Be deliberate about what you show, who sees it and when, protect what you do show, and talk to a lawyer before it goes live.

When a US company receives an Article 15 GDPR access request from an EU individual to disclose information the company has processed about them, full compliance could expose its most valuable trade secrets.


This conflict between transparency and secrecy increasingly exposes unprepared US businesses to a dilemma: comply with the GDPR to avoid penalties or do not comply to protect your trade secrets.

Article 15 access requests increased by 222% from 2021 to 2024. Providing no or insufficient information can expose a company to GDPR fines of up to €20 million or 4% of its global annual revenue. Since 2018, GDPR enforcement has resulted in more than €7.1 billion in fines. From 2021 to 2024, U.S. companies specifically faced an average of €1.15 billion in GDPR fines annually. For example, Clearview AI, a U.S. facial recognition company, was fined €30.5 million for failing to respond to two access requests from EU individuals, among other GDPR violations. Likewise, Spotify was fined €5 million in 2023 for failing to provide sufficiently clear information about its personal data processing.

This article provides U.S. tech companies with a strategic and practical framework for navigating GDPR disclosure obligations while protecting their valuable trade secrets.

EU Transparency versus US Secrecy

While the GDPR’s right of access allows individuals to understand how companies process their personal data, trade secret law protects a company’s proprietary information by keeping it secret. However, because a trade secret is only protected as long as it is actually secret, once a company hands over data in an access response, that information may no longer be protected by law; also allowing competitors to freely use it (if they actually obtain it—for example via discovery in litigation).

Given that the GDPR applies to US businesses and the right of access covers not only the personal data but also how that data is processed, distinguishing personal information from proprietary and secret information can be difficult and often impossible, particularly when attempted after the fact rather than as a preventive measure.

For example, an AI hiring company may receive an Article 15 access request requiring it to explain how an applicant’s data was evaluated. However, providing too much detail could reveal trade secrets, such as how its hiring algorithm ranks candidates or which factors receive the most weight. A streaming platform may receive a request asking how a user’s personal data is used to generate personalized recommendations. Responding to the request could risk disclosing confidential recommendation algorithms or methods for predicting user preferences. Likewise, an e-commerce company may receive a request asking why one customer was shown a higher price than another. Explaining the decision could reveal proprietary pricing models, customer segmentation strategies, or other confidential methods used to determine individualized prices.

In SCHUFA (C-634/21, December 2023), the CJEU held that data subjects requesting access to credit-scoring information are entitled to a meaningful explanation of the logic behind automated decision-making. While the Court recognized that trade secrets must be protected, it cannot justify a blanket refusal to disclose relevant information. Similarly, in Österreichische Post (C-154/21, 2023), the CJEU clarified that data subjects have the right to know the specific recipients of their personal data, not merely categories of recipients.

The critical point is that both regimes are legitimate and enforceable, and neither overrides the other in the GDPR context.

What Data and What Processing?

Upon receiving an Article 15 access request, a US company must confirm whether it processes the individual's personal data and must provide access to that data, along with key information about the processing. This includes the purposes of the processing, the categories of personal data involved, the recipients, the applicable retention period (or the criteria used to determine it), the individual's rights to rectification, erasure, restriction, and objection, the right to lodge a complaint with a supervisory authority, the source of the data (where applicable), and the existence of automated decision-making, including profiling.

Article 12 GDPR requires a response without undue delay and within one month of receipt, which may be extended by up to two further months for complex requests. The information must be provided in a concise, transparent, intelligible, and easily accessible form using clear and plain language. The first copy of the personal data must be provided free of charge, and companies must facilitate the exercise of data subject rights and cannot refuse to act unless the controller demonstrates that it cannot identify the data subject.

Trade secrets are defined as information that is secret, has commercial value because of its secrecy, and is subject to reasonable steps to maintain its secrecy. In the tech context, trade secrets commonly include proprietary algorithms, credit and risk-scoring models, recommendation engines, ad-targeting logic, data enrichment pipelines, internal ranking systems, and training data methodologies. For example, in Dun & Bradstreet Austria (C-203/22), a credit-scoring company refused to disclose the logic behind its proprietary scoring model, arguing that doing so would reveal trade secrets. The CJEU clarified that companies must provide meaningful explanations for automated decision-making while balancing the protection of trade secrets.

Practical Strategies for Balancing GDPR and Trade Secret Protection

Resolving the tension between GDPR transparency obligations and trade secret protection requires a careful balancing approach. The goal is to provide data subjects with meaningful information about their data and how it is processed, while limiting disclosure to what is necessary. This requires a proactive system and clear internal processes. The most effective strategy is a layered disclosure model, which means:

Establishing internal systems that provide meaningful but calibrated explanations of algorithmic logic without revealing source code, training data, or other core intellectual property.

Separating personal data from proprietary algorithmic information during system design whenever possible, making future access requests easier to handle.

Using existing industry practices as guidance. Major U.S. tech companies provide useful examples. Companies like Google, Apple, and Meta have developed well-established access request infrastructures, such as Meta’s “Download Your Information.”

Maintaining robust non-disclosure agreements and internal policies that reinforce trade-secret classification and limit exposure risks.

Keeping clear records of what qualifies as a trade secret, why it qualifies, and what protective measures are in place. This documentation is critical for defending refusals before data protection authorities or courts.

Building an internal process to assess each access request for proportionality and balance the data subject’s rights against the company’s legitimate interests.

Furthermore, under the GDPR, a company does not have to comply with requests that are manifestly unfounded or excessive, especially if they are repetitive. However, the burden of proving this rests on the business, and European courts require clear, objective evidence of abusive intent rather than simply a high volume of requests.

Conclusion

GDPR transparency obligations are real and enforceable, but so is the right to protect trade secrets. Neither is absolute. The CJEU has made clear that blanket refusals are insufficient, but calibrated, well-documented responses can satisfy both regimes.

The key message is proactive preparation. If your company processes EU personal data and relies on proprietary algorithms or data-driven systems, now is the time to audit your access-request protocols. Companies that prepare their access-request procedures now will be far better positioned to comply with the GDPR while preserving the trade secrets that underpin their competitive advantage.

More than 8,000 game demos were showcased at Steam Next Fest in October, but some planned demos never made it.


For example, Alliance Arts canceled the public demo of “Drunken Goddess Reflux” just a few days before the event. That same week, Digital Sun, the studio behind “Moonlighter,” canceled a planned public playtest for “ReVamp” and opted instead for a closed Discord test. Both cited the same reason: the fear that someone might recreate the game using AI tools before its release.

The risk is real, as copycats are now feeding demos, trailers, and screenshots into AI tools and rebuilding a game's basic features, sometimes in as little as a day. However, skipping a demo has real drawbacks, as demos have long been one of the most effective ways to build wishlists before release, and events like Next Fest are an important way for indie games to draw attention to themselves.


There is a middle ground. By limiting what you show, who sees it, and how early, you can reduce the risk, and some low-cost legal steps taken before release can make it easier and more cost-effective to stop a clone.

Your mechanics are fair game. Your art is not.

Under U.S. copyright law, game ideas and mechanics are generally not protected. Anyone can develop a “match-three” game or a puzzle game with falling blocks, which is why the industry has always been full of games that look very similar.

What copyright law protects is the expression: code, art, music, characters, dialogue, and the audiovisual presentation. The line between an unprotected idea or game mechanic and a protected expression is not always clear. Courts consider the overall look and feel, and an infringement is generally found only where the copying is close.

This is important when it comes to AI clones. Most are created from scratch based on what is shown in the demo, trailers, and screenshots, so they rarely contain copied code. Your strongest claims arise when a clone copies your actual art, music, or other assets, or, less commonly, when a downloadable demo is decompiled and its code is reused.

Then there is the name of your game. When “Needle in a Haystack Simulator” went viral, titles with similar names and store pages began appearing on Steam even before the game’s release. Here's what a Steam search for the title turned up in November 2026. Only one of these is the original, which is the one marked "Original":

Game titles and studio names can also be protected by trademark law, and a registered trademark puts you in a much stronger position to ask a platform like Steam to remove a game with a confusingly similar title. Earlier this year, the holder of a U.S. registration for "Hidden Cats" filed a trademark complaint with Valve, and other developers were told to retitle their games. That is why it is worth applying for a trademark early on.

Patents can protect a truly new game mechanic, but they are expensive, take years to obtain, and are often difficult to secure. If you plan to apply for a patent, you should file the application before the demo is released, as the release could be considered a disclosure that undermines your patent.

Knowing what is protected is only half the battle. To be able to respond quickly and cost-effectively when a clone appears, you need to prepare before the demo is released.

Five things to do before you hit publish

These measures typically cost only a fraction of what a lawsuit would cost and are affordable for most indie developers.

1. Decide what you show, who sees it, and when. A “vertical slice” or a curated playable trailer limits what can be copied. A closed playtest limits who receives the version and allows you to require everyone to accept your terms first. Timing is also important: Register your rights before the build goes public. However, even a smaller build is still a build. It can be decompiled and its art copied, so the following steps still apply.

2. Make sure you actually own your game. Freelance art designers, commissioned composers, and the friend who designed your user interface may still own their works unless those works have been assigned to you or licensed to you in writing. If they are the owners, you may not be able to enforce your rights. AI-generated assets raise a related issue: purely AI-generated output may not be protected by copyright. If your key art comes directly from an image generator, a copycat could potentially copy it without much risk. Keep records of the human creative work behind your key assets.

3. Register your work before you publish it. In the U.S., copyright arises automatically, but registration is crucial if you need to enforce it. You generally need to register before you can file a lawsuit, and registering before an infringement begins or shortly after publication can entitle you to statutory damages and attorneys’ fees. When fighting a rapidly emerging clone, this can make the difference between a credible threat and an empty one. Register the demo version, key art, and trailer before the demo is released. Also, file trademark applications for your game title and studio name before the announcement so you can take action against similar titles. Registration can take months; the sooner you file the application, the sooner you will have a registered trademark you can rely on.

4. Set specific terms for your demo. A demo EULA, as well as a non-disclosure agreement (NDA) or a playtest agreement for closed playtests, should prohibit reverse engineering, decompilation, redistribution, and the use of the version to train AI or recreate the game. For closed tests, rules regarding streaming can also be established. These terms are binding only on those who accept them; thus, they do not prevent someone from copying content from a YouTube video. However, they do give you a contractual claim against anyone who agreed to them and then violated them.

5. Have an enforcement plan ready. Know in advance who files the takedowns, what evidence you need and how fast you can move. Speed matters when a clone is collecting your wishlists.

Got cloned?

First, find out exactly what has been copied.

The answer will determine your options for taking action. If they copied your assets, code or branding, you have the clearest and most cost-effective options available: filing copyright and trademark takedown notices through the platform, as well as issuing cease-and-desist letters. This is where your registrations and trademark applications really pay off.

If only the “look and feel” has been copied, you can still submit a takedown request, but you should expect resistance. If the copier challenges this, a look-and-feel claim will usually end up in court. If a tester or player has violated your demo terms of use and can be identified, you may also have a breach-of-contract claim.

A lawsuit is a last resort and is most likely with look-and-feel claims. It is costly and time-consuming, may be impractical against a cloner based abroad, and carries a real risk, as the line between idea and expression is rarely clear-cut. For most indie developers, it only makes sense if the value of the game justifies it. However, the cost and risk cut both ways: the cloner faces them too, along with unwanted publicity. That gives you leverage, so it is usually worth sending a cease-and-desist letter first. Often, that is enough to get the clone taken down or reach a settlement.

The Checklist

Before your demo is released:

1. Scope: Determine what the version will include, who will receive it, and how long before launch it will be released.

2. Ownership: Signed assignment agreements or licenses for each asset.

3. Registrations: Copyright registrations for the demo build, key art and trailer.

4. Trademarks: Applications for your title and studio name.

5. Demo Terms: A demo EULA and a playtest confidentiality agreement tailored to the risks of the AI era.

6. Enforcement Plan: Takedowns and next steps, ready to go.

The studios that pulled their demos and playtests in October made a sensible call. Still, a demo remains one of the best tools you have. Be deliberate about what you show, who sees it and when, protect what you do show, and talk to a lawyer before it goes live.

Subscribe to our newsletter

Latest Articles

Q1 2021 Tax Deadlines

2021 Estimated Tax – 2020 Tax Returns