All Discussions > Steam Forums > Suggestions / Ideas > Topic Details
This topic has been locked
Jayleigh Jan 24, 2020 @ 1:06pm
Remove billing information from purchases
Apparently since the start of 2020 Valve needs to ask for billing information during checkout on payment methods that didn't need that before. If it's the law, there isn't anything I can really do. However, I do have a question regarding the fact that phone number seems to be required.

I've been on the internet for a long time and I never needed to give my phone number just to get past the billing information. Usually you can use your shipping address as your billing address which is logical. And for pretty much all online websites and services, a phone number was not required.

Why are phone numbers suddenly required to make a purchase on Steam? It's not part of the "billing" concept.

EDIT: This apparently has nothing to do with the law. So I'm replacing the original thread title "Remove phone number from billing information" with "Remove billing information from purchases". They just want all our info for no apparent reason. I checked other stores and none of them ask for anything even now in 2020. It's just Steam.

EDIT2: Steam has updated their support page (Thanks Danyael133!):

https://support.steampowered.com/kb_article.php?ref=6112-TDHB-4392&auth=99f0bf472b9f241cc83ba56baa54e257

Seems to not really provide much of an explanation, unfortunately. I marked RiO's post as the answer. This post by "Tokrar":

https://steamcommunity.com/discussions/forum/10/1745643248317303563/?ctp=9#c1753525161666029276

Is also a good one.
Last edited by Jayleigh; Feb 1, 2020 @ 2:28pm
The author of this topic has marked a post as the answer to their question.
Click here to jump to that post.
Originally posted by RiO:
Originally posted by brian9824:
Originally posted by Danyael133:
The support send me this Link right now:

https://support.steampowered.com/kb_article.php?ref=6112-TDHB-4392&auth=99f0bf472b9f241cc83ba56baa54e257

Yep, in otherwords as its been said its for tax purposes.

No queue up the handful of armchair lawyers that will proceed to google snippets of various tax laws and codes with no context to claim that they are actually violating the law......


I actually prefer to cite the relevant articles of law directly from the law text that Valve themselves are citing. To avoid giving everyone a headache while attempting to read it, I'll point you to the more user-friendly HTML version[eur-lex.europa.eu] of the same law text for reference. (Compare the document IDs if you won't take my word for it.)

And now without further ado, where it all starts is Article 24b - as Steam is covered by electronically supplied services:

Article 24b

For the application of Article 58 of Directive 2006/112/EC, where telecommunications, broadcasting or electronically supplied services are supplied to a non-taxable person:
[...]
(d) under circumstances other than those referred to in Article 24a and in points (a), (b) and (c) of this Article, it shall be presumed that the customer is established, has his permanent address or usually resides at the place identified as such by the supplier on the basis of two items of non-contradictory evidence as listed in Article 24f of this Regulation.

So, let's move on to Article 24f:

Article 24f

For the purpose of applying the rules in Article 58 of Directive 2006/112/EC and fulfilling the requirements of point (d) of Article 24b or Article 24d(1) of this Regulation, the following shall, in particular, serve as evidence:

(a) the billing address of the customer;
(b) the internet Protocol (IP) address of the device used by the customer or any method of geolocation;
(c) bank details such as the location of the bank account used for payment or the billing address of the customer held by that bank;
(d) the Mobile Country Code (MCC) of the International Mobile Subscriber Identity (IMSI) stored on the Subscriber Identity Module (SIM) card used by the customer;
(e) the location of the customer’s fixed land line through which the service is supplied to him;
(f) other commercially relevant information.


So, Steam legally needs only 2 items of non-contradictory evidence.
Out of those that in particular shall serve as evidence, they always have your IP address.
And for most payment methods, they always have the necessary bank details. EU bank account numbers that follow IBAN have two-letter ISO country codes in them. BIC codes carry the same information.


That's two points of data covered.

Valve only needs a third in case they need to rebute a presumption of a customer's location:

Article 24d

1. Where a supplier supplies a service listed in Article 58 of Directive 2006/112/EC, he may rebut a presumption referred to in Article 24a or in point (a), (b) or (c) of Article 24b of this Regulation on the basis of three items of non-contradictory evidence indicating that the customer is established, has his permanent address or usually resides elsewhere.


However, the presumptions in question are all based on physical location of the provided electronic service; on the service being tightly coupled to fixed equipment or a landline; or on being tied to a specific mobile phone and its SIM data.

None of these could ever apply to Steam as a distance seller of digital content access via the open internet, so there is nothing to rebute and there will not ever be a need for a third item of evidence.

Period. End of discussion.



That brings us to the GDPR[eur-lex.europa.eu]. Specifically; to article 5, which codifies data minimization and the fact that if a data controller has multiple ways available with which they can within reasonable means fill their needs - whether those be legal requirement; legitimate interest or otherwise - then they are obliged to use the means that result in processing the least amount of personal data. This is partly clarified in recital 39 as well.

Article 5 - Principles relating to processing of personal data
1. Personal data shall be:
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(39) (...) The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. (...)

Now, since Valve always have access to your IP address, because that's how your connecting to Steam, that's one item of evidence accounted for.

That leaves only one more. Valve usually also have access to bank account data via the payment transaction, or can get access to it with minimal effort. They'll either already receive it back via the payment confirmation sent to them from their payment provider, or they can query it from the payment provider, given a transaction ID.

So, only in the limited scenario where a payment method has no associated bank data, do they need to fallback on something else - like asking for a billing address.

In all other instances, the GDPR makes it so that they may not demand your billing address, because they already have other means available.



This doesn't quite cover everything though. Because even in aforementioned case of not having bank details available to them, they still can pick from "other commercially relevant information."

That term is not defined in the law text itself. But we can find its definition in accompanying explanatory notes[ec.europa.eu] as is usual with these type of complex directives:

9.5.1. What is covered by ‘other commercially relevant information’?

(...)

Some of the items which, depending on the circumstances under which the concrete business is conducted, could be used as ‘commercially relevant information’ are the following:

(1) Unique payment mechanisms – When a customer uses one of the methods of payment unique to a particular Member State, it provides accurate information identifying the Member State in which the supply was made. It could be taken as an indication as to where the customer belongs.
(2) Consumer trading history – When a customer has an established relationship with a business, records from prior transactions could provide a reliable indicator for future transactions. This information includes the historical IP address of the customer, billing address, place of predominant consumption, etc.
(3) Gift card point of sale – When a gift card is sold to a customer who is physically present at a retail establishment, it is likely that the customer will be local to the country in which the establishment is located.
(4) Country-locked gift cards – When gift cards are country-locked and can only be used in the country of issue (this restriction is stated clearly on the face of the card), the Member State in which the card is locked could be indicative of where the customer belongs in much the same way that a café or hotel that sells wi-fi access in a public area is treated as being the place of that customer.
(5) Documentation of third-party payment service providers – In many countries, payment service providers verify at least part of the billing address of a payment method before approving a transaction. Usually this information is not shared with the payment service provider’s customer (i.e., sellers of electronic services) for data protection and security reasons. However, when the payment service provider shares the information with the supplier of the service acquired, that information could be used as ‘commercially relevant information’.
(6) Customer self-certification – When the subscriber provides confirmation (e.g.within the online ordering process) regarding his country, his bank details (especially information where a bank account is) and credit card information, this could be taken to be ‘commercially relevant information’.

Interesting here are:
#1 which means the use of a payment method like iDEAL for Dutch people is in and of itself a valid item of evidence.
#2 which means repeat past access and purchases from a consistent IP address counts as a separate and second item of evidence next to the IP address of the current transaction.
#5 which means additional information not related to bank details that Valve may receive back from a payment provider - such as even part of (!!) a registered billing address - counts as an item of evidence next to bank details.

And finally, the big one - #6, which counts any active statement on the customer's part regarding his country; bank details or credit card information. I.e. Selecting your preferred store region; your preferred download region; etc. is an item of evidence as well.



Count all of these and there is absolutely no need for Valve to ever ask for a billing address.





< >
Showing 121-135 of 214 comments
yugiyasha1 Feb 1, 2020 @ 7:46am 
Originally posted by Lifell:
Originally posted by KillahInstinct:
Considering the phone was removed (probably an accident, making the whole form required?) and a good thread discussing the laws and so on, whilst changing the target to billing information- which doesnt appear possible, is it OK to lock this?

Considering the goalposts changed a few times and the information out there did I am not entirely sure (which also highlights why we dislike people changing OP's).

I would like for the thread to be open still. It's still an ongoing thing and most threads even from years ago don't get locked. So I don't see a use to lock this one. I'm still reading everything and following what is happening considering the whole billing information.

My suggestion still stands as well. That they removed the phone number is all well and good but it shouldn't have been there in the first place. When creating this thread I wrongfully assumed that there was an actual concrete law that specifically states that this is all necessary. It's more specific then that and a lot more complicated.

Regarding the original post, I've changed the title once and typed the "EDIT:" portion afterwards. If I edit the OP I'll probably just put in a "EDIT2:" portion. I can understand why moderators don't like the thread title or thread specifics being changed though. Kind of makes the thread messy if done intensively.

However, adding extra information while keeping the original post will exactly move the thread forward. Because I think most people don't read 8 pages of comments.
I agree with you Lifell. This discussion needs to stay open because it's far from done. The removal of the phone number is a great first step but I do think they need to reconsider requiring one's entire address if you're not paying with a credit/debit card. In those cases asking for an address is a necessity, but for Steam Wallet and other forms of payment, it shouldn't be. I maintain that all they need is country/state/county of residency.
#121
Danyael133 Feb 1, 2020 @ 8:26am 
The support send me this Link right now:

https://support.steampowered.com/kb_article.php?ref=6112-TDHB-4392&auth=99f0bf472b9f241cc83ba56baa54e257
#122
Brian9824 Feb 1, 2020 @ 8:34am 
Originally posted by Danyael133:
The support send me this Link right now:

https://support.steampowered.com/kb_article.php?ref=6112-TDHB-4392&auth=99f0bf472b9f241cc83ba56baa54e257

Yep, in otherwords as its been said its for tax purposes.

No queue up the handful of armchair lawyers that will proceed to google snippets of various tax laws and codes with no context to claim that they are actually violating the law......
#123
Danyael133 Feb 1, 2020 @ 8:41am 
The EU law in the first Link was written in 2013, after that the law for collecting data was change in 2018. ;)
#124
Brian9824 Feb 1, 2020 @ 8:42am 
and there they go........
#125
cinedine Feb 1, 2020 @ 8:48am 
Originally posted by brian9824:
Originally posted by Danyael133:
The support send me this Link right now:

https://support.steampowered.com/kb_article.php?ref=6112-TDHB-4392&auth=99f0bf472b9f241cc83ba56baa54e257

Yep, in otherwords as its been said its for tax purposes.

No queue up the handful of armchair lawyers that will proceed to google snippets of various tax laws and codes with no context to claim that they are actually violating the law......

That still doesn't explain why it was okay to not have these information for 5(!) YEARS(!!!) and now it suddenly changed. These regulation in the EU have been in place since 2015.
And Danyael133 is completely right that in the mean time data protection laws were introduced.

Also, these "armchair lawyer" at least think about stuff instead of taking everything Valve feeds you for truth.
Last edited by cinedine; Feb 1, 2020 @ 8:51am
#126
Brian9824 Feb 1, 2020 @ 8:54am 
Originally posted by cinedine:
Originally posted by brian9824:

Yep, in otherwords as its been said its for tax purposes.

No queue up the handful of armchair lawyers that will proceed to google snippets of various tax laws and codes with no context to claim that they are actually violating the law......

That still doesn't explain why it was okay to not have these information for 5(!) YEARS(!!!) and now it suddenly changed. These regulation in the EU have been in place since 2015.
And Danyael133 is completely right that in the mean time data protection laws were introduced.

Welcome to the world of laws where they change and get updated all the time and businesses have to adjust.

I mean we had keys and crates in france for more then 5 years yet you saw france's market for crates change because the law got changed.

Hate to break it to you but that's how the world works.....
#127
cinedine Feb 1, 2020 @ 9:43am 
Originally posted by brian9824:
Originally posted by cinedine:

That still doesn't explain why it was okay to not have these information for 5(!) YEARS(!!!) and now it suddenly changed. These regulation in the EU have been in place since 2015.
And Danyael133 is completely right that in the mean time data protection laws were introduced.

Welcome to the world of laws where they change and get updated all the time and businesses have to adjust.

I mean we had keys and crates in france for more then 5 years yet you saw france's market for crates change because the law got changed.

Hate to break it to you but that's how the world works.....

This particular regulation DID NOT CHANGE. Valve suddenly requires additional information to ... what? comply with a law from five years ago? While getting hard into conflict with one from two years ago.

Seriously, why do you even try to defend Valve? You have obviously no knowledge at all about EU legislation.
#128
Jayleigh Feb 1, 2020 @ 9:55am 
1. Steam links to a law from 7 years ago. This law has been there for a long time.

2. Now, so much time later, they ask for "billing information" which consisted of full name, full address and telephone number.

3. These are things that are simply not required. That's a fact by now. A lot of people have proven this.

@brian9824, you're the ONLY person who keeps saying it's required and "it's just how it works" while not having ANY proof at all. You just keep repeating. I'm getting a bit tired of it. Where is the law in question (or the change) besides from the generic one Steam linked that they suddenly need this information. We all know they need information and we've provided that to them for so many years. Are you trying to say that Steam did all of this incorrectly for so many years? Because my preferred payment method, iDEAL already sends out information. My full identity is in there, including my location. Combined with my IP, my Steam account, my bank number my full name and my country which I reside in. If they wanted to dig deeper, they can still go and check for even more information.

I checked the document in question and the last updates that were applied in 2015 and 2017. Still 3 years ago. If you really know how all of this works, why aren't you providing us with that valuable information? I started this topic with a desire to be educated. But you're not providing us with what we want to know and neither does that very old law that Steam linked.

4. Telephone is the very obvious nonsense and that got removed as a mandatory thing.
Last edited by Jayleigh; Feb 1, 2020 @ 9:59am
#129
Tokrar Feb 1, 2020 @ 10:03am 
Originally posted by brian9824:
Originally posted by cinedine:

That still doesn't explain why it was okay to not have these information for 5(!) YEARS(!!!) and now it suddenly changed. These regulation in the EU have been in place since 2015.
And Danyael133 is completely right that in the mean time data protection laws were introduced.

Welcome to the world of laws where they change and get updated all the time and businesses have to adjust.

I mean we had keys and crates in france for more then 5 years yet you saw france's market for crates change because the law got changed.

Hate to break it to you but that's how the world works.....

Let's perhaps first read the document, I guess that is what arm-chair lawyers do (sorry :steamhappy: )

They need two pieces of non-contradictory evidence, listed as
1) Billing adress
2) IP adress (>> something you keep on claiming is not evidence)
3) Registration details of the means of transportation
4) Other commercial information

Point 4 is clarified via the below link, page 69/92

https://ec.europa.eu/taxation_customs/sites/taxation/files/resources/documents/taxation/vat/how_vat_works/telecom/explanatory_notes_2015_en.pdf

With "other commercial" information including:
1. Unique payment mechanism
2. Consumer trading history, with specific mention of our historical IP adress
3. Gift Card point of sale where the customer was physicially present
4. Country locked gift card
5. Documentation of third party providers
6. Customer self-certification

In my case they already should have
> IP adress
>Historical IP adress
> Gift Card point of sale as they should be able to connect my steam gift card redeem code to the card located in the salespoint.
> Customer self-certification with me indicating my country.

You could argue they went with a very broad approach of collecting all the info listed instead.


#130
Jayleigh Feb 1, 2020 @ 10:10am 
Originally posted by Tokrar:
Originally posted by brian9824:

Welcome to the world of laws where they change and get updated all the time and businesses have to adjust.

I mean we had keys and crates in france for more then 5 years yet you saw france's market for crates change because the law got changed.

Hate to break it to you but that's how the world works.....

Let's perhaps first read the document, I guess that is what arm-chair lawyers do (sorry :steamhappy: )

They need two pieces of non-contradictory evidence, listed as
1) Billing adress
2) IP adress (>> something you keep on claiming is not evidence)
3) Registration details of the means of transportation
4) Other commercial information

Point 4 is clarified via the below link, page 69/92

https://ec.europa.eu/taxation_customs/sites/taxation/files/resources/documents/taxation/vat/how_vat_works/telecom/explanatory_notes_2015_en.pdf

With "other commercial" information including:
1. Unique payment mechanism
2. Consumer trading history, with specific mention of our historical IP adress
3. Gift Card point of sale where the customer was physicially present
4. Country locked gift card
5. Documentation of third party providers
6. Customer self-certification

In my case they already should have
> IP adress
>Historical IP adress
> Gift Card point of sale as they should be able to connect my steam gift card redeem code to the card located in the salespoint.
> Customer self-certification with me indicating my country.

You could argue they went with a very broad approach of collecting all the info listed instead.

He's basically claiming that an IP isn't evidence because "it's so easily circumvented". But most pieces of information are easily circumvented. Think of a random name with a random address with a random phone number (prior to the change).
#131
Brian9824 Feb 1, 2020 @ 10:17am 
Originally posted by Lifell:
Originally posted by Tokrar:

Let's perhaps first read the document, I guess that is what arm-chair lawyers do (sorry :steamhappy: )

They need two pieces of non-contradictory evidence, listed as
1) Billing adress
2) IP adress (>> something you keep on claiming is not evidence)
3) Registration details of the means of transportation
4) Other commercial information

Point 4 is clarified via the below link, page 69/92

https://ec.europa.eu/taxation_customs/sites/taxation/files/resources/documents/taxation/vat/how_vat_works/telecom/explanatory_notes_2015_en.pdf

With "other commercial" information including:
1. Unique payment mechanism
2. Consumer trading history, with specific mention of our historical IP adress
3. Gift Card point of sale where the customer was physicially present
4. Country locked gift card
5. Documentation of third party providers
6. Customer self-certification

In my case they already should have
> IP adress
>Historical IP adress
> Gift Card point of sale as they should be able to connect my steam gift card redeem code to the card located in the salespoint.
> Customer self-certification with me indicating my country.

You could argue they went with a very broad approach of collecting all the info listed instead.

He's basically claiming that an IP isn't evidence because "it's so easily circumvented". But most pieces of information are easily circumvented. Think of a random name with a random address with a random phone number (prior to the change).

It's not even that its easily circumvented, its not precise at all. it can be off by several CITIES. It's not a precise location, and is even less precise then zipcode.
#132
Tokrar Feb 1, 2020 @ 10:22am 
Please read evidence nr 2: IP is explicitly accepted as evidence. I know it can be off, you are completely right about that. But nonetheless, there it is.
#133
Jayleigh Feb 1, 2020 @ 10:28am 
Originally posted by brian9824:
Originally posted by Lifell:

He's basically claiming that an IP isn't evidence because "it's so easily circumvented". But most pieces of information are easily circumvented. Think of a random name with a random address with a random phone number (prior to the change).

It's not even that its easily circumvented, its not precise at all. it can be off by several CITIES. It's not a precise location, and is even less precise then zipcode.

Ok, so? They got evidence on where I live. They don't NEED pinpoint accuracy on where I, my home and my PC resides. And that doesn't answer all of the other questions that people keep asking you.

They want to know where I approx. live so they know the amount of tax and where it needs to go right? Every piece of information can be considered to not be "precise". That's why they need more of them.

We provide them with more than 2 for the most part. So there is no problem. IP is still pretty accurate in general.

Lasty, zipcode is in a lot of countries more accurate than IP. I don't CARE about US. I live in the Netherlands.
Last edited by Jayleigh; Feb 1, 2020 @ 10:35am
#134
RiO Feb 1, 2020 @ 10:52am 
Originally posted by brian9824:
Originally posted by Lifell:

He's basically claiming that an IP isn't evidence because "it's so easily circumvented". But most pieces of information are easily circumvented. Think of a random name with a random address with a random phone number (prior to the change).

It's not even that its easily circumvented, its not precise at all. it can be off by several CITIES. It's not a precise location, and is even less precise then zipcode.

And the EU doesn't care.
According to the EU, the IP address qualifies. Period.

As do any "unique payment methods" - like iDEAL, which is limited to Dutch customers; or any other payment scheme bound to nationalities.

Those would be 2 data points readily available to Valve, and all they need.

Then, as per the GDPR's tenets regarding data minimization, if they can fill their need - be that legal requirement; legitimate interest; whatever... - via any other reasonable means that requires processing less of a data-subject's personal data, then THEY MUST DO SO.

This is not optional. There have been cases of employers being ordered to change all their newly installed biometric locks with keycard based locks because of this, for crying out loud.

And now you'd tell me Valve could skirt around it, WHEN IN FACT THEY ALREADY HAVE THE OTHER DATA THEY'D NEED AVAILABLE ?!

No. Just no. This explainer page written by Valve is exactly what I thought it would be; an ill-conceived blanket-statement.

It's especially ironic, because the law-text they are referring to expressly does mention THE VERY SAME MEANS OF AND RULES FOR IDENTIFYING LOCATION that other posters in this thread have been citing. (Well; duh? It's the same law text on which everyone has been basing their argument. Except Valve's lawyers apparently have problems with reading comprehension.)
Last edited by RiO; Feb 1, 2020 @ 11:01am
#135
< >
Showing 121-135 of 214 comments
Per page: 1530 50

All Discussions > Steam Forums > Suggestions / Ideas > Topic Details
Date Posted: Jan 24, 2020 @ 1:06pm
Posts: 214
Start a New Discussion

Discussions Rules and Guidelines