Concern about data collection policies on Steam.

[RoosterAllegory]

Hello!

Sometimes I stumble upon reviews of a game on steam where the publisher is accused of very intrusive data collection of it's customers. A recently example is The First Descendant.

I'm just wondering how at all this is possible especially with GDPR and the like. How can a game be published with so little restrictions and not undergo some kind of review to sell via the steam platform.
I know this is a widely discussed topic and I'm most likely repeating a lot of similar topics. I guess my suggestion if it doesn't already exist is that Steam have a stricter policy against data collection and perhaps address a common concern that customers have about a product.

[✨Saint✨]

By my own "rule of thumb"; I am fine with certain data collection(s). If that is used for malicious purposes, and it can be traced back to the source, action will be taken.

[Nx Machina]

YOU report any game via the store page which YOU believe has intrusive data collection, but that does not mean it is in violation of GDPR which only covers specific data.

[Crazy Tiger]

Originally posted by RoosterAllegory:

I'm just wondering how at all this is possible especially with GDPR and the like.

For starters because people overestimate what GDPR and such really mean and do.

[Start_Running]

WHat data is the game allegedly collecting?

[William Shakesman]

Valve typically has not taken the users side in any of these sorts of issues. Being a corporation themselves, they tend to prefer siding with the corporations and rarely restrict corporate action to benefit the users.

Of course, corporations are not entitled to any of this, but there is no entity that can say no to them. Simple logic suggests that, like most such issues, the user needs to take effort to resolve the issue themselves. There are plenty of methods for the savvy user to discourage, frustrate, stymie, or block these sorts of data collection avenues. The Steam group Penguin Domination is an excellent starting resource for documenting these trackers and providing counter measures. You can be certain the group is good because, if memory serves, several recent posts have been arbitrarily blocked or limited despite meticulous compliance with Valve rules, but don't quote me on that as I forgot what his last update said specifically.

That said, it is right to say we shouldn't have to tolerate a paradigm where you need several pages of blockers to stop corporations from gathering infinite data they are not entitled to, but we do. And people HOWL if you try to put any requirement on their dear corporations to not do such things. (You would think GDPR insulted some of these peoples mothers given how animated they get over it lol)

[Start_Running]

Originally posted by William Shakesman:

Valve typically has not taken the users side in any of these sorts of issues. Being a corporation themselves, they tend to prefer siding with the corporations and rarely restrict corporate action to benefit the users.

Being a corporation they go by the laws rather than the nebulous wants of the users.

[Nx Machina]

Originally posted by William Shakesman:

Valve typically has not taken the users side in any of these sorts of issues. Being a corporation themselves, they tend to prefer siding with the corporations and rarely restrict corporate action to benefit the users.

Valve like any company will take action IF and only IF the data being collected is intrusive and violates GDPR for example.

They have to comply with the law, and not a user who simply types GDPR, when GDPR only covers specific data.

Originally posted by William Shakesman:

And people HOWL if you try to put any requirement on their dear corporations to not do such things. (You would think GDPR insulted some of these peoples mothers given how animated they get over it lol)

Ah! Yes, The age old, "anyone who does not validate my anti-corporation stance must be tagged and labelled as pro-corporation."

[bidulless]

hello
just install a tool or a firewall with "asktoconnect" feature each time any tools on your comp is trying to access the net and just answer no.

[William Shakesman]

Also important disclaimer, Valve doesn't post here and nobody here has any experience with legal issues related to these concepts beyond forum arguments and hasty Google searches. There is no great knowledge of contract law here except for maybe one user.

In essence, this board can never and will never give you an authoritative, useful answer to the question you posed. Completely impossible.

Really, we shouldn't be either in a society where "How does X comply with Y law?" can really only be answered by "Ask the Y law regulatory agency and find out. Its a surprise!" but fixing that is beyond the scope of what we can do here too.

[Nx Machina]

Originally posted by William Shakesman:

Also important disclaimer, Valve doesn't post here and nobody here has any experience with legal issues related to these concepts beyond forum arguments and hasty Google searches. There is no great knowledge of contract law here except for maybe one user.

Citation needed for "nobody here has any experience of legal issues" after all you are both presuming and assuming no one has ever gone to court, nor their career involves any type of legality.

[xBCxRangers]

Well from what posters tell me, Steam does not collect data, though i find it odd s senior citizen like me would be getting Army Recruiting spam, if for the only military related thing i do, is Arma 3 and the mod workshop.

That being said, laws are already being drawn up apparently to stop this type of stuff, particularly with minors under 17...including online games..

https://www.cnn.com/2024/07/30/politics/senate-passes-legislation-protecting-minors-online/index.html

https://www.congress.gov/bill/118th-congress/senate-bill/1409/text

[Start_Running]

Originally posted by bidulless:

hello
just install a tool or a firewall with "asktoconnect" feature each time any tools on your comp is trying to access the net and just answer no.

Windows defender already does that.

[RiO]

Originally posted by Nx Machina:

They have to comply with the law, and not a user who simply types GDPR, when GDPR only covers specific data.

Technically, the GDPR covers anything that is considered personal data, a term that is defined by the regulation itself as meaning any data related to an identified or identifiable natural person. Where such a person shall mean any natural person who can be identified, directly or indirectly, by reference to any form of identifier. In particular name, location, etc. but also online identifiers.

The legal definition does not require that the party collecting and/or processing the data is the same party that can perform the link towards the natural person. Those may be separate.

The consequence of that, is that if any video game sold on Steam collects any type of data related to the hardware or software environment that includes something as trivial as IP address and timestamp, then this is automatically personal data. Because there is another party, namely Valve, who can accurately correlate these to a sign-in on a Steam account, which will have the natural person on file as part of any purchases, where they ask to provide among other things your name and physical address for tax purposes.



Note though, that the fact that such data is classified as personal data doesn't mean a publisher or developer would immediately not be allowed to collect or process the data.

There are various legal grounds under which data may be processed; not just the legal ground of explicit consent. Other potentially compatible legal grounds are necessity for performance of contract, or the age-old standby of 'legitimate interest.'

Though both involve a few caveats.
The former requires strict necessity - i.e. it is absolutely physically impossible to perform what was contractually agreed upon without. For instance: your physical address is pretty darned necessary for ordering fast-food delivered to your doorstep.
While there is some case law wrt legitimate interest which states processing purely aimed at gaining additional commercial profit through e.g. data brokerage, or using the data for advertising purposes can never be done under the grounds of legitimate interest. (In fact, Meta / Facebook was fined for this one.)

And no matter the legal grounds used, the data controller (i.e. the publisher or developer here) is legally required to inform the data subject of the specifics of the collection and processing: which data they're collecting, for what purposes, from where, for how long the data will be kept, where it will be kept and processed, with which subcontracted processors it will be shared, etc.

[bidulless]

Originally posted by Start_Running:

Originally posted by bidulless:

hello
just install a tool or a firewall with "asktoconnect" feature each time any tools on your comp is trying to access the net and just answer no.

Windows defender already does that.

hello
Good to know , w10 or w11 ? Because surelly not on w10 xd

thx @Start_Running

[Nx Machina]

Originally posted by RiO:

Technically, the GDPR covers anything that is considered personal data,

I have read the GDPR and it only covers specific data.