ROM files are game or system software copies you can run in emulators, but downloading them involves real legal and security risks you need to understand before you start

A ROM file is a digital copy of the software that originally ran on old gaming consoles, arcade machines, or computer systems. When you download a ROM, you're getting a file that contains the exact data from a cartridge or disc — the game code, graphics, and sound. An emulator then reads that file and simulates the original hardware so you can play the game on your computer or phone.

The catch: downloading ROMs of games you don't own is copyright infringement in most countries. The copyright holder — usually Nintendo, Sega, Atari, or another publisher — owns the right to distribute that software, and they almost never give permission for free downloads. Even if a game is decades old and out of print, the copyright still exists and is still enforced. You can face legal action, though individual downloaders are rarely targeted compared to sites that host the files.

There are legal ways to play old games: buying cartridges or discs secondhand, purchasing digital re-releases on modern platforms, or using official emulators and ROM collections that publishers have released. Those routes avoid both legal risk and the malware that often comes bundled with ROM downloads from untrusted sites.

Key Takeaways

  • Downloading ROMs of copyrighted games you don't own is illegal in most countries, even if the game is old or out of print.
  • ROM download sites frequently host malware, fake files, and adware alongside legitimate-looking downloads.
  • Legal alternatives include buying used cartridges, purchasing digital re-releases, or using official emulator releases from publishers.
  • If you own physical media, creating your own ROM backup is legal in some jurisdictions, but downloading someone else's copy is not.
  • Emulators themselves are legal to download and use; the legal problem is only the ROM files.

Why ROM download sites are dangerous

Sites that host ROM files operate in legal gray areas or outright illegally, which means they have little incentive to protect your security. These sites make money through aggressive advertising, and that advertising often includes malware. A file labeled "Super Mario Bros.zip" might contain the actual ROM, but it might also contain a trojan, a keylogger, or adware that hijacks your browser.

The infection happens because ROM sites don't verify what they're hosting — anyone can upload a file with any name. A user uploads what looks like a game but is actually malicious code. The site's operators either don't notice or don't care, because they profit from the traffic either way. Your antivirus may catch some of these, but not all, and by the time you realize something is wrong, the malware is already running.

Even "clean" ROM files from these sites can come with hidden tracking or bundled software installers that you didn't consent to. The download page itself often has fake download buttons designed to trick you into installing something else entirely — a browser toolbar, a fake antivirus, or cryptocurrency mining software.

Legal ways to play old games

The safest route is to buy used cartridges or discs from secondhand markets like eBay, local game shops, or Craigslist. You own the physical media, you can play it on original hardware or on an emulator (by creating your own ROM from your cartridge), and no one is breaking the law. Prices vary widely — some old games are cheap, others are expensive — but you're not risking malware or legal trouble.

Many publishers now re-release old games on modern platforms. Nintendo offers NES and SNES games through its Switch Online subscription service. Sega has released Genesis games on Steam and other platforms. Atari, Konami, and others have done similar re-releases. These versions are legal, safe, and often include features the originals didn't have — save states, rewind buttons, or online multiplayer. The downside is you're paying a subscription or per-game fee, but you're getting a legitimate product.

Some publishers have released official emulator packages with ROM collections included. The Atari 2600+ is a modern console that comes with 10 built-in games and can play original cartridges. Nintendo's Classic Edition consoles (NES Classic, SNES Classic) came with 30 pre-loaded games each. These are legal, safe, and ready to play out of the box, though they're only available secondhand now since Nintendo discontinued them.

If you own the original media

In some countries, including the United States, you have the legal right to make a backup copy of media you own for personal use. That means if you own a physical Super Mario Bros. cartridge, you can legally create a ROM file from it using a cartridge reader device. You own that ROM, and you can play it in an emulator.

The key word is "own." You must have purchased the original cartridge or disc yourself. Downloading a ROM file that someone else created from their cartridge is not legal, even though the original game is the same. The copyright holder still controls distribution, and downloading from someone else's backup is distribution without permission.

Creating your own ROM requires hardware: a cartridge reader that connects to your computer. These devices cost between $50 and $200 depending on which systems they support. If you own multiple old cartridges and want to preserve them, the investment might make sense. If you just want to play one game, buying a used cartridge and a reader is usually more expensive than buying a digital re-release.

How to find and use legal emulators

Emulators themselves are legal software. Programs like RetroArch, MAME, Dolphin, and PCSX2 are open-source projects that simulate old hardware. You can download them from their official websites or from legitimate software repositories without legal or security risk. The emulator is just a tool — it's the ROM files that determine whether you're breaking the law.

Once you have an emulator installed, you point it to a ROM file and it runs the game. If that ROM file is one you created from media you own, or one you obtained through a legal channel like a publisher's re-release, you're in the clear. If it's a file you downloaded from a ROM site, you're not.

Some emulators come with built-in game libraries that are legal to use. RetroArch, for example, can download and play games from the Libretro core library, which includes public-domain games and games released by their creators for free distribution. These are completely legal and safe.

The real cost of downloading ROMs

Beyond the legal risk, downloading ROMs costs you in ways that aren't obvious. Malware infections can slow your computer, steal your passwords, or use your machine to mine cryptocurrency without your knowledge. Removing malware takes time and often requires professional help. A single bad download can compromise your security for months.

There's also the time cost. Searching for reliable ROM sites, waiting for slow downloads, troubleshooting compatibility problems with emulators, and dealing with corrupted or fake files — it all adds up. Buying a used cartridge or paying for a digital re-release is often faster and less frustrating than the ROM download process.

If you're caught downloading copyrighted material, the legal consequences depend on your country and the copyright holder's enforcement practices. In the United States, copyright holders can sue for damages ranging from $750 to $30,000 per work infringed, though individual downloaders are rarely targeted. ISPs can also send cease-and-desist letters or throttle your connection. The risk is real, even if it's not always enforced.

Frequently Asked Questions

Is downloading ROMs of old games that are no longer sold legal?

No. Copyright doesn't expire just because a game is old or out of print. The copyright holder still owns the right to distribute it, and downloading without permission is infringement. The age of the game doesn't matter legally.

Can I download ROMs if I own the original cartridge?

You can legally create a ROM from a cartridge you own using a cartridge reader device. Downloading a ROM file that someone else created is not legal, even if it's the same game, because you're not making your own backup.

Are emulators themselves illegal to download?

No. Emulators like RetroArch, Dolphin, and MAME are legal software. The legal problem is only the ROM files. You can download and use emulators without any legal risk.

What's the safest way to play old games legally?

Buy used cartridges or discs from secondhand markets, purchase digital re-releases from publishers, or subscribe to services like Nintendo Switch Online. These options are legal, safe from malware, and often cheaper than dealing with ROM download sites.

Can ROM download sites give me malware?

Yes. ROM sites frequently host malware, adware, and fake files. Even if a download looks legitimate, it might contain a trojan or keylogger. The sites profit from traffic and have little incentive to verify what users upload.