Kerbal Space Program

Kerbal Space Program

EULA still not compliant with GDPR and privacy shield
Since a mod has closed the information based thread due to trolls hijacking it, here it is in a cleaned up version, please keep it civil and bring factual evidence if you are to dispute the validity of the claims. This thread is supposed to be informational to people who intend to buy the game. They need to know that the company who (sadly) bought Squad does not comply with EU law.

Source for noncompliance of TakeTwo: Kai Bodensiek, lawyer specializing in IT, internet and media. Consultant for licence-contracts and EULA's.

Baseline: "Sobald die neue Verordnung in Kraft ist, muss der Nutzer genau darüber im Klaren sein, welche Daten konkret wann erhoben werden. Das ist bei der neuen EULA von Take-Two nicht der Fall."
Translation: "As soon as the new regulation is in place the user has to be specifically informed about what and when data is collected."

Quote Bodensiek: "The user - as per US standards - is left in the dark about what data is being gathered. By US standards this is "normal", in the EU - and at the very latest since the validity of DSGVO [GDPR] next week also EU-wide - in any case illegal"

Source: https://www.gamestar.de/artikel/kerbal-space-program-spyware-vorwuerfe-neue-softwarelizenz-bringt-spieler-auf-die-palme,3329796.html

Kai Bodensiek
https://bvm-law.de/de/team/profil/99


______________________



Original Post:

Today the deadline for companies to introduce a GDPR-compliant EULA ended.
Take Two has had 2 years to prepare for this day and has actively chosen not to comply.

A little exerpt from the current unlawful EULA:

"The information we collect may include personal information such as your first and/or last name, e-mail address, phone number, photo, mailing address, geolocation, or payment information. In addition, we may collect your age, gender, date of birth, zip code, hardware configuration, console ID, software products played, survey data, purchases, IP address and the systems you have played on. We may combine the information with your personal information and across other computers or devices that you may use."

As for their non-compliance buying this game will severly infringe on your personal rights, rights to your data and your rights as citizens of the EU, specifically under GDPR and Privacy Shield.

Thus I can only summarize: STAY AWAY FROM THIS. THIS IS INDEED SPYWARE. Your data is being transmitted to US marketing services (third-party, non-compliant with privacy regulations). All of it is being used and not anonymised - illegal under privacy shield, and since today also under GDPR.

Also in opposition to what some people pretend to know, your information is personalized and connected to your name and all factors mentioned in the exerpt above.

Your data is being passed over to api.redshell.io, which tracks you by your Steam data, purchase data, real name, address, ip addresses on ALL machines that you might use.
Last edited by LauraSaurusRAWR; May 25, 2018 @ 4:15pm
< >
Showing 196-210 of 293 comments
edorward Jun 1, 2018 @ 3:42pm 
Originally posted by ChillCore:
...what about transfered licenses after you asked the previous owner to remove all personal data.

Would you mind expounding upon this? I'm not following.
ChillCore Jun 1, 2018 @ 4:11pm 
Originally posted by edorward:
Originally posted by ChillCore:
...what about transfered licenses after you asked the previous owner to remove all personal data.

Would you mind expounding upon this? I'm not following.
Sure ... my pleasure.

A while back someone was asking to trade a KSP-site copy for a steam version, who cares what reason, while I was still very much supportive and owning already four licenses and wishing to acquire a fifth anyways, in support, I traded with him but now when I go to their site a download button is not displayed, despite having full ownership of the account (changed password and all) and disabling any and all pugins for my browser to avoid unwanted hiding of said button, with proof of purchase in it.

I was just asking the clown if he could solve my issue as he seems to know everything but clearly does not.
Not that I care very much ... as my steam version if fully operational.

Not to blame steam or anything ... 10 months after the fact my 'friend', who is still in my friendslist, asked for a refund as he could not, supposedly, run he game at all (which his playtime confirmed but is not relevant as my own playtime on other games shows).
I did get that refund in full, even ten months out instead of two weeks, and was able to gift that copy to someone else who wanted the game.

I did compensate the friend who wanted a refund, just saying ... not that it matters, but yeah.

Anyhoo ... proof of purchase on the account, like the amount and everything ... but no download button showing on the KSP site for my legally acquired version. << as in transfer of ownership as allowed by the EULA.
Last edited by ChillCore; Jun 1, 2018 @ 4:16pm
ChillCore Jun 1, 2018 @ 4:13pm 
Originally posted by hbk314:
Originally posted by ChillCore:
Physical copies of KSP? Where? When? I'll buy it yesterday ... LMFAO.
Yes, it is hilarious that your claim was again refuted.
It was?



Originally posted by PolecatEZ:
Originally posted by ChillCore:
Physical copies of KSP? Where? When? I'll buy it yesterday ... LMFAO.

You posted the agreement snippet where it talked about physical copies and what you could do. I was trying to figure out where and how that would apply.

For sure it wouldn't apply here. Anything you buy on Steam is a "subscription." Steam itself owns the license, game, everything. They can make transferring certain digital goods available through their marketplace, but there's no other ways to transfer ownership of your subscription.

TLDR, if you bought it here, you don't own legally own it.
Not even talking about a steam copy you useless troll. Learn to read.
hbk314 Jun 1, 2018 @ 4:21pm 
Originally posted by ChillCore:
Originally posted by edorward:

Would you mind expounding upon this? I'm not following.
Sure ... my pleasure.

A while back someone was asking to trade a KSP-site copy for a steam version, who cares what reason, while I was still very much supportive and owning already four licenses and wishing to acquire a fifth anyways, in support, I traded with him but now when I go to their site a download button is not displayed, despite having full ownership of the account (changed password and all) and disabling any and all pugins for my browser to avoid unwanted hiding of said button, with proof of purchase in it.

I was just asking the clown if he could solve my issue as he seems to know everything but clearly does not.
Not that I care very much ... as my steam version if fully operational.

Not to blame steam or anything ... 10 months after the fact my 'friend', who is still in my friendslist, asked for a refund as he could not, supposedly, run he game at all (which his playtime confirmed but is not relevant as my own playtime on other games shows).
I did get that refund in full, even ten months out instead of two weeks, and was able to gift that copy to someone else who wanted the game.

Anyhoo ... proof of purchase on the account, like the amount and everything ... but no download button showing on the KSP site for my legally acquired version. << as in transfer of ownership as allowed by the EULA.

Show me where in the EULA that kind of transfer is allowed. The section you copy/pasted earlier doesn't apply to this.



Originally posted by ChillCore:
Originally posted by hbk314:
Yes, it is hilarious that your claim was again refuted.
It was?

Yes. You pasted a section on the transfer of a game purchased physically, as in on a CD or DVD. It has no relevance to a digital copy.
edorward Jun 1, 2018 @ 4:28pm 
Originally posted by ChillCore:
Sure ... my pleasure.

A while back someone was asking to trade a KSP-site copy for a steam version, who cares what reason, while I was still very much supportive and owning already four licenses and wishing to acquire a fifth anyways, in support, I traded with him but now when I go to their site a download button is not displayed, despite having full ownership of the account (changed password and all) and disabling any and all pugins for my browser to avoid unwanted hiding of said button, with proof of purchase in it.

I was just asking the clown if he could solve my issue as he seems to know everything but clearly does not.
Not that I care very much ... as my steam version if fully operational.

Not to blame steam or anything ... 10 months after the fact my 'friend', who is still in my friendslist, asked for a refund as he could not, supposedly, run he game at all (which his playtime confirmed but is not relevant as my own playtime on other games shows).
I did get that refund in full, even ten months out instead of two weeks, and was able to gift that copy to someone else who wanted the game.

I did compensate the friend who wanted a refund, just saying ... not that it matters, but yeah.

Anyhoo ... proof of purchase on the account, like the amount and everything ... but no download button showing on the KSP site for my legally acquired version. << as in transfer of ownership as allowed by the EULA.

Not having bought anything from Squad/Take Two directly, I have nothing worthwhile to contribute to your problem, but are you saying that it's related to the new EULA? Or are you just busting hbk's chops?
Skullmonkey Jun 1, 2018 @ 9:15pm 
If you are so dead set on complaining against the EULA then why doesn't everyone take it over to T2's flag ship title GTAV that still has high sale figures during sales and leave the little developer whom put several years of hard work and dedication into one of the most interesting and amazing games out there.It already worked when GTAV was review bombed for trying to shutdown the modding community so please, please, piss off and leave Kerbal alone, stop helping tarnish it's good name.
Red Jun 1, 2018 @ 9:16pm 
I've been out the game for only a year and look what's happening..

I don't see how KSP can collect your data, it's not in the position to. I've never put a single bit of personal info into KSP, not even with Steam apart from my VISA and email. Steam is not T2s platform so no they are not gathering it from my VISA either.

At the same time i also couldn't give two #$?! about some of my information, hell the amount of companies that do through me just sharing it alone is quite a lot of companies already. Facebook, Google, Steam, Microsoft etc etc etc..

Go ahead an share my email, i've got half a dozen of them anyway.

Generally though this all sounds like a giant over reaction. Like when T2 took over and half the community was convinced we'd have microtransaction by this point.

Reading it, it sounds more like they are just laying out every potential. Rather then, we are collecting all this data.

Last edited by Red; Jun 1, 2018 @ 9:48pm
LoSBoL Jun 2, 2018 @ 1:16am 
Originally posted by PolecatEZ:
So if you bought a physical copy you can give it to someone else. That might apply to PS4 versions maybe. Wouldn't apply on Steam, as the sale license is superseded.

You can leave out the 'might' and 'maybe', and replace 'PS4' with 'console'. Also very old PC games that don't ask for a serial number and are in need of the CD/DVD (pre licenced) to play the game. I personally don't know any PC games that have been released after 1997 that make use of this, although there might be some, somewhere. In any case a downloaded version of KSP from the official website is not handled in that part of the EULA, only when you take it out of context;

'TRANSFER OF PRE-RECORDED COPY LICENSE:'

When reading up to the above, you could argue that a downloaded digital version of KSP could be considered a pre-recorder copy licence, because KSP doesn't ask for a licence key.

' You may transfer the entire physical copy of pre-recorded Software and accompanying documentation on a permanent basis to another person as long as you retain no copies (including archival or backup copies) of the Software, accompanying documentation, or any portion or component of the Software or accompanying documentation, and the recipient agrees to the terms of this Agreement. Transfer of the pre-recorded copy license may require you to take specific steps, as set forth in the Software documentation.'

At this point that argument falls apart because it gives context, a downloaded version of KSP is not a phycical copy of pre-recorded Software. Also other pre-recorded PC Software can't really be argued after reading this, because most, if not all, don't contain a pre-recorded licence key.

'You may not transfer, sell, lease, license, rent, or convert into convertible virtual currency any Virtual Currency or Virtual Goods except as expressly set forth in this Agreement or with Licensor's prior written consent. Special Features, including content otherwise unavailable without a single-use serial code, are not transferrable to another person under any circumstances, and Special Features may cease functioning if the original installation copy of the Software is deleted or the pre-recorded copy is unavailable to the user. The Software is intended for private use only. NOTWITHSTANDING THE FOREGOING, YOU MAY NOT TRANSFER ANY PRE-RELEASE COPIES OF THE SOFTWARE.'

Console games do have many pre-recorded and pre-licenced physical copy games, and you
can and may trade those freely like the EULA says, I've sold my PS3 version of GTAV, and like the above states, the single-use serial code that came along with that copy, isn't needed for activation of the game, it only unlocked the otherwise unavailable special content, and couldn't be transfered to the new owner.

Anyway, its all unrelated to this topic, and I also fail to see the relation of Chillcore's problem and the new EULA.
Last edited by LoSBoL; Jun 2, 2018 @ 1:19am
LauraSaurusRAWR Jun 3, 2018 @ 3:36am 
Originally posted by SMX87:
If you are so dead set on complaining against the EULA then why doesn't everyone take it over to T2's flag ship title GTAV that still has high sale figures during sales and leave the little developer whom put several years of hard work and dedication into one of the most interesting and amazing games out there.It already worked when GTAV was review bombed for trying to shutdown the modding community so please, please, piss off and leave Kerbal alone, stop helping tarnish it's good name.

Because main market for GTA V is the country where the no-privacy-but-guns-to-everyone policy comes from.
Also noone forced Squad to accept a buyout from Take Two. Especially since Squad isnt as shiny as you might think. The game might be nice, the company behind it not so much. Especially in regards to paying employees.

1) https://www.mcvuk.com/development/squad-devs-blast-kerbal-space-program-studio-for-high-crunch-and-low-pay

2) https://www.reddit.com/r/gaming/comments/55xv60/kerbal_space_program_developers_only_paid_2400/

A large number of devs quit Squad. Because they are such a great indie dev studio, right? ;)
Last edited by LauraSaurusRAWR; Jun 3, 2018 @ 3:36am
edorward Jun 3, 2018 @ 4:27am 
Originally posted by TheCookie:
Because main market for GTA V is the country where the no-privacy-but-guns-to-everyone policy comes from.

You bought an American product from an American company thorugh an American vendor in the United States. You're lucky they're even attempting to comply with European laws.

Also noone forced Squad to accept a buyout from Take Two.

Oh boy... you might want to drop this line of argument before you make yourself look more foolish.
Last edited by edorward; Jun 3, 2018 @ 4:27am
klesh Jun 3, 2018 @ 8:50am 
At the very least, they need to add the ability to opt-out of RedShell and Unity Analytics information collection to be compliant. We'll see how long it takes them.
primobrainlet Jun 3, 2018 @ 9:20am 
Why don't we just wait and see what happens? If you believe truly not complying then file a complaint or wait for someone else to. It is not up to us to interpert it, our interpertation is meaningless to theirs
Last edited by primobrainlet; Jun 3, 2018 @ 9:20am
hbk314 Jun 3, 2018 @ 9:20am 
Originally posted by klesh:
At the very least, they need to add the ability to opt-out of RedShell and Unity Analytics information collection to be compliant. We'll see how long it takes them.
Why do they need to do that? No personal information is collected.
AoD_lexandro Jun 3, 2018 @ 9:26am 
Originally posted by edorward:

You bought an American product from an American company thorugh an American vendor in the United States. You're lucky they're even attempting to comply with European laws.

Just to correct you here, Its a Scottish product made in Scotland by a Scottish developer and published worldwide by a US publisher.

Thats why it always has the Forth Rail bridge in it somewhere.

Originally posted by klesh:
At the very least, they need to add the ability to opt-out of RedShell and Unity Analytics information collection to be compliant. We'll see how long it takes them.

Redshell is part of the Unity engine. Depending on the wording it may be impossbible to "opt out" if contractual for engine usage.
Last edited by AoD_lexandro; Jun 3, 2018 @ 9:28am
Scott Jun 3, 2018 @ 2:54pm 
Originally posted by AoD_lexandro:
Originally posted by edorward:

You bought an American product from an American company thorugh an American vendor in the United States. You're lucky they're even attempting to comply with European laws.

Just to correct you here, Its a Scottish product made in Scotland by a Scottish developer and published worldwide by a US publisher.

Thats why it always has the Forth Rail bridge in it somewhere.

Partially correct. For legal purposes, Rockstar Games Inc. (the parent company of the entire Rockstar Games group) is registered in California - so although the company is still run from Scotland, it's technically American for legal purposes. However, this point is made moot by the fact that Rockstar Games' privacy policy (from https://www.rockstargames.com/privacy) says the following:


This Privacy Policy applies to all Online Services users and, except as noted, all Online Services are being offered in the United States by the Company. For Online Services offered by Rockstar Games used by residents of the European Union, the company Take-Two Interactive Software Europe Limited, ICO Registration No. Z1336431, is the data controller responsible for your personal information.

This means that for the purposes of GDPR compliance, T2 Interactive's European subsidiary is the data controller responsible for enforcing compliance, while Rockstar Games Inc. are reduced to the role of data processor, and must comply with Take-Two Interactive Software Europe Limited's privacy policy when handling EU data. However, T2 Europe don't have a privacy policy of their own, instead relying on Take-Two Interactive Inc. to provide one for the entire T2 group: https://www.take2games.com/privacy/.

So basically, GTAV is in exactly the same boat, with an identical privacy policy to KSP for the purposes of GDPR compliance. The difference here is that GTAV does have significant data gathering built into the core, as well as social features that rely on Rockstar processing personal information. In the case of GTAV, these personal details are provided at the point of account creation, and a specific opt-in indicating that the privacy policy has been read and accepted must be given before the account can be created. This is sufficient to satisfy the requirements of the GDPR, which only requires that specific, explicit and informed consent is sought each time personal information is provided.

Originally posted by AoD_lexandro:
Originally posted by klesh:

At the very least, they need to add the ability to opt-out of RedShell and Unity Analytics information collection to be compliant. We'll see how long it takes them.

Redshell is part of the Unity engine. Depending on the wording it may be impossbible to "opt out" if contractual for engine usage.

The thing about this is that the information gathered does not require consent. Unity Analytics and Red Shell both use "Legitimate Interests" as the basis for gathering and processing data. This allows them to gather and process this data without first seeking consent, provided they a) give appropriate and proportional consideration to user privacy when planning their data-gathering operations; b) can justify their data-gathering and processing as being somehow integral or essential to their business operations in such a way that the data-gathering and processing activities may be reasonably expected by the user; and c) offer users a means to object to their data being gathered and processed in this way. The latter of these is satisfied by presenting users with a per-game opt-out option with an explanation of what data is being collected, what opting-out means, and a link to the relevant privacy policy. Both Unity and Red Shell have also taken steps to anonymise personally identifiable information (such as IP address or Social ID's) wherever feasible by hashing or encrypting them, thus meaning they can still be used as unique identifiers in most cases.

Source: https://unity3d.com/legal/gdpr and https://blog.redshell.io/gdpr-and-red-shell-57f9c03b5769

Lastly, T2 Interactive's own privacy policy (https://www.take2games.com/privacy/) also reaffirms this approach to collection of non-personally identifiable information:


WHAT GAMEPLAY INFORMATION DOES THE COMPANY COLLECT?

When you use products or services on internet-capable hardware, the Company may receive information regarding your gameplay without any additional notice to you or actions taken by you. The Company will not receive personal information such as your name and address, but may receive other information such as a console ID, gaming service ID, game achievements, game scores and performance, IP address, MAC address, or other device ID, other console/device use information, or other information and statistics regarding your usage of the games. Information about gameplay may be collected while you are offline and transmitted to the Company when you next connect to the Internet whether or not you are currently logged into your Internet Connection from your console, handheld, mobile device, computer, or other gaming platform. The Company may combine the information with your personal information and use such information as set forth in this Privacy Policy whether or not you register for or use the Online Services. The Company may also monitor gameplay information by automated means to ensure that software and services are used in accordance with applicable policies, including the Terms of Service and the End User License agreement. The Company reserves the right to terminate your license if you violate these policies.

I will concede here that this section is outdated and should be updated - at the very least the GDPR does consider IP addresses, MAC addresses and other such information to be personally identifiable information now. Additionally, there isn't much clarity around it as the additional guidance hasn't been published yet, but it is highly likely that social ID's and gaming ID's may also be considered personally identifiable too. However, this can be easily negated as described above - by gathering the data on the basis of legitimate interests (with an opt-out to make it easy for users to object) and by anonymising personally identifiable information to make it difficult to link back to the original user unless absolutely necessary. Unity does the first and last items for them, and the opt-out has been in KSP since almost the very beginning (remember the pop-up you get when you first install the game, asking about analytics data?)

So there you have it - no consent needed unless you are specifically providing personally identifiable information on grounds of consent (rather than legitimate interests). If the only data collection T2/Squad are doing is being handled via the Unity tools, they are already covered by Unity's own privacy policy for their analytics packages. If they have additional data-gathering above and beyond this, it is covered by T2's privacy policy. The much-quoted section dealing with data submitted voluntarily (which I won't paste here as it's been thrown around all over this thread and this post is long enough already - if you're desperate to read it, just scroll up, you'll find it eventually) covers instances where the data is being explicitly requested on a voluntary basis (e.g. creating a forum account) and doesn't cover anything to do with the game itself. And the EULA has absolutely nothing to do with the GDPR - it's a seperate document with no bearing on the GDPR and which probably wouldn't hold up for more than a day if actually challenged in court anyway. The privacy policy is what matters - and it is explicitly referenced in the EULA (https://www.take2games.com/eula/):


THE SOFTWARE IS LICENSED, NOT SOLD. BY OPENING, DOWNLOADING, INSTALLING, COPYING, OR OTHERWISE USING THE SOFTWARE, AND ANY OTHER MATERIALS INCLUDED WITH THE SOFTWARE, YOU AGREE TO BE BOUND BY THE TERMS OF THIS AGREEMENT WITH THE UNITED STATES COMPANY TAKE-TWO INTERACTIVE SOFTWARE, INC. ("LICENSOR," “WE,” “US, OR “OUR”), AS WELL AS THE PRIVACY POLICY LOCATED AT www.take2games.com/privacy AND TERMS OF SERVICE LOCATED AT www.take2games.com/legal.

Can we please put this to bed now?
Last edited by Scott; Jun 3, 2018 @ 3:05pm
< >
Showing 196-210 of 293 comments
Per page: 1530 50

Date Posted: May 25, 2018 @ 4:11pm
Posts: 293