Terrorist and violent extremist networks are increasingly exploiting online gaming environments to disseminate propaganda, recreate terrorist attacks and recruit new followers, including minors. In a coordinated operation involving law enforcement authorities from 16 countries, Europol identified more than 9,000 links to extremist and terrorist content distributed across 47 gaming and social media platforms. The operation highlights a growing European security challenge: the use of interactive digital environments to normalise extremist ideologies and establish recruitment networks beyond conventional online propaganda channels.
Europol has intensified its efforts to counter terrorist and violent extremist activities in online gaming environments. On 3 November 2026, the European law enforcement agency announced the results of an international Referral Action Day coordinated by its European Union Internet Referral Unit (EU IRU) in cooperation with Spanish authorities. Specialised units from 16 countries participated in the operation, identifying and referring more than 9,000 links to content promoting jihadist, violent right-wing, violent left-wing and anarchist extremism and terrorism. The material was distributed across 47 social media and gaming platforms, illustrating the extent to which extremist narratives can circulate between different digital environments. Investigators focused particularly on communities using online role-playing activities to reproduce terrorist organisations, promote violent ideologies and develop networks of potential supporters. The identified links were referred to the respective platform operators for assessment, although Europol has not disclosed how many items were subsequently removed or whether the operation resulted in arrests or criminal proceedings.
Extremist role-playing blurs the boundaries between entertainment and propaganda
At the centre of the investigation was the exploitation of digital role-playing environments, including activities described by Europol as terrorist or violent extremist live action role-playing (LARPing). According to the agency, individuals and organised communities recreate the structures, symbols and narratives of terrorist organisations within virtual environments. Participants may assume the roles of members of extremist groups or reproduce scenarios involving terrorist attacks, with such activities potentially becoming part of coordinated propaganda campaigns designed to promote extremist ideologies and attract new followers. The security concern does not arise from role-playing or gaming itself, but from the deliberate use of interactive environments to glorify violence, reinforce extremist identities and facilitate recruitment.
Unlike conventional propaganda websites, gaming environments allow users to participate actively in simulated events, communicate with others and establish social relationships around shared experiences. This combination of interaction, immersion and community participation can create opportunities for extremist actors to introduce ideological narratives into seemingly recreational activities. Where such content is repeatedly reinforced within a group, it may contribute to the normalisation of extremist violence and strengthen identification with radical movements. For European law enforcement, the distinction between fictional representation, provocative behaviour and organised extremist activity presents an increasingly complex investigative challenge. Assessing the intent, context and distribution of material is therefore essential when determining whether an activity constitutes extremist propaganda or a potential security threat.
Recruitment of minors becomes a growing security concern
One of the most significant aspects of the phenomenon is the potential exploitation of gaming communities to approach young people and minors. Online games and related communication platforms provide opportunities for sustained interaction, often within communities that extend across national borders. Extremist actors may use these environments to establish relationships, strengthen group identities and introduce ideological messages gradually. Recruitment does not necessarily begin with explicit terrorist propaganda. Instead, individuals can encounter increasingly radical narratives through repeated social interactions before being directed towards more ideologically committed communities or other communication platforms.
The European Union Terrorism Situation and Trend Report 2026 (EU TE-SAT), published by Europol in July, identifies the involvement of minors and the exploitation of digital environments among the significant developments shaping Europe’s terrorist threat landscape. The issue also extends beyond established terrorist organisations, as violent extremist networks may operate through decentralised online communities where ideological narratives, personal grievances and the glorification of violence overlap. For investigators, identifying these processes requires an understanding of online group dynamics as well as the content being circulated. However, researchers caution against treating gaming as an inherent cause of radicalisation. A European Commission overview published in September 2026 emphasises that gaming and gaming-adjacent environments are not necessarily more susceptible to harmful influences than other digital spaces. The risks arise from the activities of particular actors and communities rather than from gaming as a medium.
Europol expands coordinated action against online extremism
The latest Referral Action Day forms part of Europol’s broader programme to identify and disrupt the online dissemination of terrorist and violent extremist propaganda. The EU IRU, operating within Europol’s European Counter Terrorism Centre, supports national law enforcement authorities by monitoring relevant online material, analysing emerging trends and coordinating referrals to hosting platforms. The November 2026 operation builds on an earlier coordinated action conducted on 13 November 2025, when authorities from eight countries targeted extremist, racist and xenophobic content distributed through gaming and gaming-related services. During that operation, investigators referred approximately 5,408 links associated with jihadist content, 1,070 links involving violent right-wing extremist and terrorist material, and 105 links associated with racist or xenophobic content.
The earlier findings demonstrated how extremist material can be produced within video games, modified using ideological references or symbolic elements, and subsequently circulated through mainstream social media networks. This cross-platform distribution complicates detection and removal efforts, particularly when content is repeatedly republished or adapted for different audiences. The expansion from eight participating countries in 2025 to 16 in the latest operation reflects broader international involvement in addressing the phenomenon. However, the number of referred links cannot be interpreted as a direct measure of growth in extremist activity, as the scope and methodology of individual operations may differ.
ProtectEU places online radicalisation higher on the European security agenda
The operation comes as the European Union develops a more comprehensive response to emerging terrorist threats in digital environments. In February 2026, the European Commission introduced its ProtectEU: Agenda to prevent and counter terrorism, outlining measures to strengthen prevention, improve law enforcement capabilities and address the misuse of digital technologies. The strategy identifies online radicalisation, the exploitation of emerging technologies and the increasing involvement of minors as important challenges for European security. It also calls for closer cooperation with digital service providers, including the gaming industry, to reduce opportunities for extremist recruitment and propaganda dissemination. Among the proposed measures are stronger voluntary cooperation through the EU Internet Forum, enhanced analytical capabilities for Europol and further consideration of the regulatory framework governing terrorist content online.
The European regulatory response currently includes Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online. Under this framework, hosting service providers must remove terrorist content or disable access to it within one hour of receiving a valid removal order from a competent national authority. A distinction must nevertheless be made between legally binding removal orders and voluntary referrals such as those coordinated by Europol’s EU IRU. Referrals alert service providers to potentially problematic content for assessment under their terms and conditions, whereas removal orders create specific legal obligations. For platform operators, this distinction is important in balancing effective action against terrorist propaganda with safeguards for freedom of expression, legitimate gaming activities and other lawful forms of digital communication.
AI-supported monitoring offers new investigative capabilities
Technological developments are also influencing how authorities identify potential extremist recruitment activities across complex digital environments. One example is the EU-funded research project GEMS (Gaming Ecosystem as a Multilayered Security Threat), which examined how extremist actors exploit gaming communities and related communication platforms. Coordinated by Trinity College Dublin and completed in August 2026, the project developed Watchtower, an AI-supported analytical platform designed to assist law enforcement agencies in identifying extremist activity in publicly accessible online communication environments. According to information published by the European Commission in October 2026, the system can analyse material from platforms including Twitch, YouTube Live, Reddit and publicly accessible gaming-related chats. It is being tested under operational conditions in cooperation with Irish police and other European law enforcement partners.
The project also contributed to the establishment of the European Network Against Gaming Related Extremism (ENgaGE), bringing together law enforcement agencies, gaming industry representatives, researchers and civil society organisations. Such initiatives illustrate the growing importance of combining technological analysis with expertise in extremist narratives, online behaviour and recruitment processes. Automated tools may help identify relevant patterns across large volumes of information, but their effectiveness depends on the quality of the underlying analysis and appropriate human oversight. False positives, ambiguous language and the use of fictional or satirical content remain important challenges. Consequently, automated identification should support professional assessment rather than replace contextual and legally grounded decision-making.
Cross-border cooperation becomes essential for digital threat detection
The international scope of the Europol operation demonstrates the difficulties of investigating extremist activity within interconnected digital ecosystems. Gaming communities can involve participants from multiple jurisdictions, while content may be created on one platform, shared through another and discussed within separate online groups. This fragmented structure complicates the identification of coordinated activity and the attribution of content to specific individuals or organisations. It also creates challenges for preserving evidence and exchanging information between authorities operating under different national legal frameworks.
For the wider EMEA security community, the issue illustrates the increasingly transnational nature of online radicalisation. Although the latest operation was coordinated within the European law enforcement framework, the platforms involved frequently operate internationally, and extremist narratives can circulate well beyond the European Union. The EU’s ProtectEU agenda therefore also emphasises cooperation with international partners, including countries in the Western Balkans and the Mediterranean region. Such partnerships are relevant to understanding and responding to extremist networks whose activities are not confined to individual national jurisdictions. Effective prevention requires more than the identification and referral of individual pieces of content. It depends on sustained cooperation between law enforcement agencies, technology companies, researchers, educators and organisations working directly with young people.
From content removal to long-term prevention
The scale of the latest Europol operation illustrates the volume and diversity of extremist material that investigators can encounter across gaming-related platforms. Nevertheless, the identification of more than 9,000 links does not establish the number of individuals involved, the size of extremist networks or the extent to which the material has resulted in actual radicalisation. Nor does the operation, on its own, demonstrate that the reported content has been removed or that specific recruitment attempts have been successfully prevented. The wider security challenge is therefore not limited to restricting access to extremist propaganda. Authorities must also understand how online communities can be exploited to establish trust, promote violent identities and create pathways from digital interaction towards extremist involvement.
For platform operators, this increases the importance of proportionate content moderation, transparent reporting procedures and cooperation with specialised security authorities. For law enforcement, it reinforces the need for cross-border intelligence sharing, contextual analysis and investigative capabilities adapted to rapidly evolving online cultures. Policymakers and prevention specialists must also address the protection of minors through educational initiatives, digital resilience and early intervention, particularly where extremist influence emerges gradually through social interaction rather than explicit recruitment messages.
The latest Europol operation highlights a significant shift in the online security landscape: terrorist and violent extremist propaganda is no longer confined to material that users passively consume. It can also be embedded in interactive digital experiences where participation, identity and community relationships become part of the radicalisation process. Addressing this development requires a coordinated approach that combines law enforcement, responsible platform governance, technological innovation and preventive action. The objective is not to portray gaming communities as a security threat, but to prevent extremist actors from exploiting legitimate digital environments for recruitment, ideological mobilisation and the promotion of violence.
