Games should have to post their Privacy Policy (as well as EULA) on the store page

[Drizzt]

i am not sure what the law or Steam's rules currently say about this - but i can only assume there is no firm rule - since many games with EULAs do not post them on the Store Page - and so far as i can tell, none of those with separate Privacy Policies post those on the Store Page at all - requiring the user to browse to an external website in order to even see what the company plans to do with their data - and to whom many if not most users will already have furnished their IP address by the very act of browsing there

Personally - i actually read EULAs for the games i am considering purchasing - and i expect that if a game does not have an EULA posted on the Steam Store page, that they will not be requiring me to accept one after i have purchased it (and if that is the case i would likely instantly refund the game - unless i have some previous level of trust with the company, and the EULA does not contain any egregious privacy violations)

Furthermore - when i read in an EULA that their privacy policy is hosted on an external website then i will not be buying that game - since i find it somewhat disrespectful for a company to expect me to give them some of my personal data prior to informing me how they plan to manage it - especially since they are utilising the storefont of a company with whom i have already entrusted a significant amount of my personal data and access to my PC

and yes, i am advocating mostly for people who do not use VPNs - which is likely many people, since beyond the need to even know what they are and why one might want to use one - a VPN is required to be hosted by a third party who has access to all of your web data - and so requires a significant amount of trust - but anyway - this thread is about consumer friendliness and honest sales practices to provide potential customers with all relevant information required to make their purchasing decision on the Steam Storefront - rather than a debate about the use of VPNs - if that's ok ;-)

and i should note that this issue does affects companies with whom i already have a decent level of trust - but still i found that their EULA was not presented until i went to install the game - and i was not impressed with that

and some companies (not those i trust) have actually added EULAs to existing products that previously didn't have one - that were only presented to the user after they installed and/or loaded the game for the first time since the addition

(a company i did know and trust added their EULA to steam after the fact - i had previously read it on their website - and they did add it to the store page for everyone to see - so new users would be able to view it before purchasing - and existing users could review it before reinstalling or using the game again etc - but their privacy policy was still remote - and many players probably did not even know they were bound by any kind of terms of use)

and as i mentioned - i have yet to find a Privacy Policy hosted on the Steam Store page

we put our trust in Steam - we trust them with our data and our game collections - and we trust them to as much as possible protect us from unscrupulous developers and publishers - and at the very least to provide us with sufficient information before we install software from a developer or publisher - and since they warn us when we are being directed to a site outside of Steam, it makes sense that they should at least mandate that any companies who wish to be hosted on their site do not force users to go to external and potentially dangerous sites to simply view the terms of use and privacy policy for a game before we buy it

anyway - i thought i would mention this - since it has been bugging me for a long time - and i am new to these Suggestions forums - and so it seemed appropriate to suggest it :-)

[RiO]

Seconded.

Within the EU, Valve has an obligation to supply via a durable medium a copy of certain applicable terms of contract to a sale no later than the sale has been finalized.

If we're talking about supplying that digitally then websites under the trader's control don't even qualify as a durable medium according to the EU Court of Justice (ECJ) - let alone websites under the control of a publisher offering their title to be sold through Steam.

Basically, the only way Valve could even come close to guaranteeing they can supply the a copy of the correct terms that apply to the contract and were presented to the consumer as such prior to closing the sale, is if those applicable terms are hosted on an environment under Valve's own control.

Might as well require the privacy policies to be there as well.

I mean... it might actually be mandatory even. The lynchpin question there is if you consider the use of personal data by digital content a "main characteristic, to the extent appropriate to the medium" ( 2011/83/EU, Art 6.1 (a))

[Aachen]

I don’t know — that’s the sort of information that I rather expect to be hosted on a company’s own website. Is there a reason you disdain such primary sources?

[Snapjak]

Well, third party EULAs are already listed on the store page so I don't see why an external privacy policy shouldn't be also. Unless it can be already and it's just not/rarely used.

[RiO]

Originally posted by Aachen:

:rl2shrug: I don’t know — that’s the sort of information that I rather expect to be hosted on a company’s own website. Is there a reason you disdain such primary sources?

The fact that they can change it freely and pull the rug from under you, I'd imagine.

[Drizzt]

Originally posted by Aachen:

:rl2shrug: I don’t know — that’s the sort of information that I rather expect to be hosted on a company’s own website. Is there a reason you disdain such primary sources?

when you visit a website you are granting them access to your personal data - e.g. your IP address - when you install their games you are granting them admin access to your PC - i don't know about you, but i would like to know what a company declares they will be doing with that personal data prior to granting them access to it

Steam are the storefront that are hosting the product - if they want to sell me a product, i would like to know what agreement i am being expected to enter into with the creators of that product before being expected to provide them with my personal information

that is why companies and products have terms and conditions that consumers are supposed to be allowed to study prior to entering into a contract with the company

if i was buying directly from the publisher or developer then i would expect to have to go to their website - but i am buying from Steam - and so i expect Steam to provide me with at least the legal contract for the product they are trying to sell me

as a note - the EULA usually defines what kind of data collection activities a company wants you to agree to - the Privacy Policy defines the data they will harvest and to whom they expect you to agree to let them distribute said data

surely both of these things are important to know before giving them any data? and by visiting a website you are giving them data

for most of the games i own i have never once visited their websites - since why would i want to? i have the game and it gets updated through Steam - i only visits websites for games i really like, from developers with whom i have a level of trust - and certainly not some random company who won't even respect me enough to give me that info at the point of sale

[Aachen]

OK, so the exposed personal data is IP address, then?

[Drizzt]

Originally posted by Aachen:

OK, so the exposed personal data is IP address, then?

when visiting a website that is the minimum exposed data - but there are hundreds of thousands of games hosted on Steam - i am sure that more than a few of them are created by companies with less than reputable business practices and who's websites seek to harvest as much data as they can from visitors - up to and including trying to push malware onto their machines

thankfully modern browsers and security software are pretty active in defending users against those sort of attacks - but i do not expect to be forced to risk that kind of thing to even read the terms of service for a game

admittedly, a company at the far end of that spectrum would likely have no problem not posting any conditions and simply installing malware as soon as the user install the game

but the big publishers have data harvesting as a normal component of their websites

anyway - in most cases the EULA will tell me if the company is using data collection practices with which i disagree - and so i would want all EULAs to be hosted on the store page

and for those game that don't declare any egregious data collection practices, i would still appreciate being able to review what data they do intend to collect and what they intend to do with it, without being forced to visit their website

the problem with data privacy terms - is that unlike terms about copyright enforcement, and decompiling, and all of the other clauses that EULAs cover - is that those clauses are the company mandating what you are and are not allowed to do with their software - but the data privacy stuff is them telling you what they intend to do with your data - and by the time you have visited their website, your IP address is already gone - once you have installed their game, there goes the rest

would you give the keys to your house to someone you have never met before?

then why would you give them the keys to the contents of your hard drive and every piece of data you ever transmit?

since when you install their game that is what you are doing - and so some due diligence is likely warranted to try and gauge their level of integrity

now tbh - it seems reasonable that if you are considering installing a company's software that you should be ok visiting their website

except companies often have different policies with how they handle data from their games and from their websites - often wanting to distribute data from their websites to slews of advertisers - while maybe not being quite so flagrant with data from their games unless the user engages in certain activities

however - i can accept that maybe my suggestion regarding the privacy policies is a little moot - since the EULA is where they describe what kind of data collection they engage in - and so if you are ok enough with that, then visiting their website to read the privacy policy is not a leap

but i would hope that all EULAs are now posted on Steam - i thought there was a law or rule change, since Project Zomboid recently posted their EULA on Steam - but i know of others games who still do not post theirs

so maybe it is not actually a condition of use for Steam's storefront yet?

[Drizzt]

Originally posted by RiO:

Seconded.

Within the EU, Valve has an obligation to supply via a durable medium a copy of certain applicable terms of contract to a sale no later than the sale has been finalized.

If we're talking about supplying that digitally then websites under the trader's control don't even qualify as a durable medium according to the EU Court of Justice (ECJ) - let alone websites under the control of a publisher offering their title to be sold through Steam.

Basically, the only way Valve could even come close to guaranteeing they can supply the a copy of the correct terms that apply to the contract and were presented to the consumer as such prior to closing the sale, is if those applicable terms are hosted on an environment under Valve's own control.

Might as well require the privacy policies to be there as well.

I mean... it might actually be mandatory even. The lynchpin question there is if you consider the use of personal data by digital content a "main characteristic, to the extent appropriate to the medium" ( 2011/83/EU, Art 6.1 (a))

yeah - i did wander back a little bit in my previous post - since i did concede that if i am considering installing a game from a company due to them having a reasonable EULA, that allowing them to grab my IP address on their website is probably not a massive deal - although if i get there and find out that they have a horrific privacy policy, i will be somewhat unhappy

so i think it still feels way more pro consumer to have it on the store page

but i think the EULA is a deal breaker - if that one is not posted on the store page and then one pops up when i install, i may well consider refunding then and there - although as i mentioned i will probably read it first - but it is a really sour taste with which to start a relationship

but yeah - you are generally way more informed about the actual law :-)

but i guess there are likely loopholes to do with Steam's role as a storefront and/or content host - and possibly to do with regions

either way - it feels like the consumer friendly thing to do is to always post your EULA and Privacy Policy on the store page - ancillary stuff like modding and content agreements i can maybe get behind being not so important (thinking of Project Zomboid here - but mainly coz i know their agreements are really consumer friendly and generous - but i wouldn't know that if i was a new customer - but still, the big hitters are generally in the EULA and Privacy Policy)

anyway - i still find companies hiding things like third party accounts and launchers

and i guess one of the reasons why steam may be holding back as long as they can until they are forced to make companies declare these things - is because that big list of brown and yellow boxes on the store page would likely deter some customers - and they want to prevent that

alas - 'tis hard work and a sad struggle to be a paranoid gamer who values their data more than AAA games lol :-)