Spyware in game-code buried?!? (read EULA)

[Atlana]

anyone else read & noticed at the bottom of the end-user licence agreement (before installation of the game) that re-legion has a featured spyware-module incorporated?
at the bottom of the EULA it reads:
-----------------------------
5. CONSENT OF USE OF DATA

You agree that Ice Code Games may anonymously collect and use information gathered in any manner as part of the product support services provided to you, if any, related to Re-Legion. Ice Code Games may also use this information to provide notices to you which may be of use or interest to you.
The information gathered by Ice Code Games may also include:

- in-game data of the users (start time of a mission, completion of the mission, saves, highscores, progress, progress history, items, etc.);
- demographic data of the users (by Google Analytics implemented into Re-Legion).
- session numbers with a timestamp and the detailed session process (e.g., the User entered this level, the User lost this level, the User entered this screen, etc.);
- your unique device ID;
- location-related information (country, time zone, etc.);
- your device model and device properties (GPU, resolution, etc.).
-----------------------------
anyone (looking at you Dev's!) care to explain why?

[Ice Code Games S.A.]

Originally posted by Atlana:

anyone else read & noticed at the bottom of the end-user licence agreement (before installation of the game) that re-legion has a featured spyware-module incorporated?
at the bottom of the EULA it reads:
-----------------------------
5. CONSENT OF USE OF DATA

You agree that Ice Code Games may anonymously collect and use information gathered in any manner as part of the product support services provided to you, if any, related to Re-Legion. Ice Code Games may also use this information to provide notices to you which may be of use or interest to you.
The information gathered by Ice Code Games may also include:

- in-game data of the users (start time of a mission, completion of the mission, saves, highscores, progress, progress history, items, etc.);
- demographic data of the users (by Google Analytics implemented into Re-Legion).
- session numbers with a timestamp and the detailed session process (e.g., the User entered this level, the User lost this level, the User entered this screen, etc.);
- your unique device ID;
- location-related information (country, time zone, etc.);
- your device model and device properties (GPU, resolution, etc.).
-----------------------------
anyone (looking at you Dev's!) care to explain why?

This is standard EULA content for games using Google Analytics software which collects anonymized data.

[Atlana]

Originally posted by Ice Code Games:

This is standard EULA content for games using Google Analytics software which collects anonymized data.

that doesn't explain why you have it in there to begin with...
...so let's tray again: care to explain why (it is in there)?

[Ice Code Games S.A.]

Originally posted by Atlana:

Originally posted by Ice Code Games:

This is standard EULA content for games using Google Analytics software which collects anonymized data.

that doesn't explain why you have it in there to begin with...
...so let's tray again: care to explain why (it is in there)?

It's stated in the EULA itself:

"You agree that Ice Code Games may anonymously collect and use information gathered in any manner as part of the product support services provided to you"

It's pretty standard practice to include analytics in a game and we don't hide it.

[Atlana]

Originally posted by Ice Code Games:

It's stated in the EULA itself:

"You agree that Ice Code Games may anonymously collect and use information gathered in any manner as part of the product support services provided to you"

It's pretty standard practice to include analytics in a game and we don't hide it.

Then let me ask you this:
- how does it work (details)?
- does it run right at the start of the game?
- can it be turned off, respectively can one opt-out?
- why is this not published on the game's store-page that you incorporate this spy-ware module? (some other games actually do)
- what information is gathered in detail (list ALL of them, there are too many "etc.s" in the EULA for my taste)?

[Ice Code Games S.A.]

Originally posted by Atlana:

Originally posted by Ice Code Games:

It's stated in the EULA itself:

"You agree that Ice Code Games may anonymously collect and use information gathered in any manner as part of the product support services provided to you"

It's pretty standard practice to include analytics in a game and we don't hide it.

Then let me ask you this:
- how does it work (details)?
- does it run right at the start of the game?
- can it be turned off, respectively can one opt-out?
- why is this not published on the game's store-page that you incorporate this spy-ware module? (some other games actually do)
- what information is gathered in detail (list ALL of them, there are too many "etc.s" in the EULA for my taste)?

It does start with the game. The opt-out means not accepting the EULA and not playing the game. We didn't see the need to publish this information as mentioned before - it's a standard practice to include analytics software.

As to what is gathered - everything is stated in the EULA, for more details on how it works I must refer you to Google Analytics support https://support.google.com/analytics/#topic=3544906

[Atlana]

Originally posted by Ice Code Games:

It does start with the game. The opt-out means not accepting the EULA and not playing the game. We didn't see the need to publish this information as mentioned before - it's a standard practice to include analytics software.

As to what is gathered - everything is stated in the EULA, for more details on how it works I must refer you to Google Analytics support https://support.google.com/analytics/#topic=3544906

In other words, with not publishing that this spyware module is part of your game BEFORE a customers purchase, you're practically taking away the option for an informed purchase and susequently the option for a refund. Considering that you have buried your consent agreement within your EULA, which can be agreed or disagreed only after the purchase.

to top things off, you do not even seem to allow a feature for opting-out (and subsequent delete all hithero at start-up collected data). The courteous way would've been to ask the customer at the start of the game, if he/she would like to opt-in to such featured spyware.

as for your "it's standard practice"; just because nearly everyone is speeding on the highway doesn't make it right nor legal.

I do not think that this issue and the way you, as "Ice Code Game" company, are handling this, is how the GDPR is demanding it. Especially considering that you, the company, are located in Warszawa Poland, are subject to the GDPR.


...


Listen, I'm not trying to pull you a fast one. I'd love to play your game, despite the mediocre reviews. But what irks me is how you implemented this and how you're handling the situation about it. The GDPR is clear on this and has been implemented for several reasons, one of them this situation. Google and Valve are just handing the legal liability off to you.

I strongly recommend that you make a patch that allows to disable this spyware-module. Especially considering it's very easy nowadays to digitally fingerprint someone just by the installed hardware and TSRs, "anonymized"-data or not.

[markelphoenix]

Thank you for including Google Analytics in your game and using the data to make the game better! I appreciate you all utilizing a common sense standard adopted in the industry to find accurate data to determine how best to update your game!

[Cosmic Cat]

I'm using add-ons in my Firefox to block Google Analytics on all pages I visit, why would I want this crap into my games as well?
You can collect information from player feedback instead.

[Atlana]

Originally posted by Woob:

I'm using add-ons in my Firefox to block Google Analytics on all pages I visit, why would I want this crap into my games as well?
You can collect information from player feedback instead.

The issue here is, that they do not make this public BEFORE you buy it, therefore you're unable to make an informed decision. It's buried in the End-User Licence Agreement. I asked the Dev's above to give at least an option at start-up to have it disabled.

IMHO that's a violation of the GDPR. I told myself, to give the Devs a couple months to patch this out/correct this issue. It's nowhere mentioned that they patched this out nor corrected this issue.

Meanwhile COVID-19 happened and I gave the Devs more time to correct it.

it's almost half a year ago since this was brought up. I haven't seen any information in this regards in their patches since.
I'm thinking of filing a complaint at the uodo.gov.pl in Warshaw, being a Poland based company

[Ice Code Games S.A.]

As was stated before all necessary information is provided in the End User Licence Agreement that is available on Steam store page and can be reviewed prior to purchasing the game. It is again presented by Steam Client before installing the game. It is standard practice to inform about analytics using tools provided by Steam and it’s in accordance with Steam’s own Terms of Use. Data collected by Google Analytics is anonymized and used to improve performance and enhance player experience which is a standard practice in game development.

However, if you are still concerned with you privacy after reviewing Re-Legion’s EULA and Google Analytics support documents which we provided before you can choose not to purchase/install the game.

[greenche]

Stop calling it spyware. Spyware runs when you're NOT playing the game, and that's not what they're doing here. This is basic anonymous data on their users: what resolution we play at, what hardware we use, etc... This is nothing to worry about.

[Lucriseo]

Originally posted by greenche:

Stop calling it spyware. Spyware runs when you're NOT playing the game, and that's not what they're doing here. This is basic anonymous data on their users: what resolution we play at, what hardware we use, etc... This is nothing to worry about.

i worry that more people become as ignorant as OP and this other chum up here.

it's always has been like this for DECADES and is NEEDED to speed up the process of improving the game and making fixes for related issues. It's not a spyware , and steam itself has it. delete steam if you don't want your "data" stolen.

[Atlana]

Originally posted by Luluthe:

Originally posted by greenche:

Stop calling it spyware. Spyware runs when you're NOT playing the game, and that's not what they're doing here. This is basic anonymous data on their users: what resolution we play at, what hardware we use, etc... This is nothing to worry about.

i worry that more people become as ignorant as OP and this other chum up here.

it's always has been like this for DECADES and is NEEDED to speed up the process of improving the game and making fixes for related issues. It's not a spyware , and steam itself has it. delete steam if you don't want your "data" stolen.

I'm afraid you both are very mistaken:
https://www.itgovernance.eu/blog/en/gdpr-when-do-you-need-to-seek-consent
The GDPR clearly states the requirement of an opt-in solution. This isn't given with this game - especially it isn't a necessary function to execute/operate this program.
GDPR states, that examples of lawful consent requests include:

- Signing a consent statement on a paper form;
- Clicking an opt-in button or link online;
- Selecting from equally prominent yes/no options;
- Choosing technical settings or preference dashboard settings;
- Responding to an email requesting consent;
- Answering yes to a clear oral consent request;
- Volunteering optional information for a specific purpose (such as optional fields in a form); and
- Dropping a business card into a box.

Since I can neither opt-in nor opt-out, it is in violation of the GDPR and therefore illegal. Burying it inside an EULA is not an automatic consent.

The actual killer in this mess is, that the developers seem to be deliberately unwilling to make changes their code-base - even after a whole years' time - to actually have the options to opt-in and defaulting to an opt-out feature of such telemetry-spyware.
The idea of the game itself is decent and refreshing, but the execution about Google's telemetry-spyware is utter shít

Google doesn't give a rat's ass - they're only providing the tools and can not be made liable. As much liable as a Caterpillar earth-mover being used to breaking into a bank, and you're tying to sue the Caterpillar manufacturer that a vehicle of theirs is used to rob a bank.

Other, much bigger and much more complex games do have these opt-in - respectively defaulted opt-out - option right from the get-go: Cyberpunk 2077, to name a modern, also a polish dev-team based title.

https://steamcommunity.com/sharedfiles/filedetails/?id=2369151180

But hey - thanks for reminding me for filing the complaint at the uodo.gov.pl in Warshaw, being a Poland based company. It fell off the radar, me being busy to run a company.

[Starfall]

Question: How is it spyware? Oxford Languages states that it's "software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive." If the EULA outright states what it does, then it doesn't fulfill the definition of spyware, as it's not being done "covertly". Further questions: Are you vegan that vehemently hates people who eat meat? Do you believe the earth is flat? And lastly, do you believe that everyone is out to get you? If you answered yes to any of those, then your opinion on any of this doesn't matter to me.

Sorry you have to deal with these kind of people, devs. Not gonna lie, the game isn't my cup of tea (to me, the voice lines seem extremely cringy) but that's just my thoughts, good work otherwise :)

[Defective Dopamine Pez Dispenser]

The EULA is openly linked on the store page, and readable prior to purchase. It is incumbent upon the purchaser to do their due diligence. The entire point of an EULA is that it protects the publisher from liability, since the onus is on you, the purchaser, to read, understand, and consent to the EULA, which you do by virtue of purchasing and installing and playing the software in question. That's why it's called an end user license agreement. You are agreeing to it by virtue of using the software. The data collected, incidentally, in this instance - as the dev explained - is entirely anonymized. This is extremely standard practice today.