3 ms·

Wouldn't that run afoul of GDPR?

ryanlol 8y ago
The anticheat team at a videogame company might not know/care about this. This has definitely been the case with past European data privacy regulations.
- lucb1e 8y ago
  Or it might be deemed reasonable. E.g. you may not film public road in the Netherlands because of privacy, but you may film the patch that your car stands on it if there have been car fires in your neighbourhood in the past month and you are concerned about your car.
  - hermitdev 8y ago
    > you may not film public road in the Netherlands because of privacy So does this effectively make dash-cams illegal?
    - ahje 8y ago
      License plates contain personal data.
munchbunny 8y ago
Not necessarily. GDPR isn't a blanket ban on collecting/using this info without consent, it's a policy that consent is required for non-essential collection/usage. You could argue that anti-cheat is essential for an online multiplayer game like this. I think it's sketchy to collect this much info, but I don't think it's explicitly illegal.
- mikekchar 8y ago
  It's a bit more complicated than that. You have to do a few things. First you have to tell the customer that you are collecting their data. Then you have to tell them under what lawful basis you are collecting their data. The user then has various rights (depending on the lawful basis you choose) to object, etc. If you must collect and use the data in order to fulfil the contract (i.e., there is no other way to do it -- for example you need to get their address in order to ship them a package), then you can just do it (as long as you tell them that you are doing it). For most other lawful bases, you have to allow them to object, in which case you have to stop using the data. I think the real question is whether or not the information in question is personally identifiable information. If it's not, then GDPR doesn't apply. I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information.
  - civilitty 8y ago
    > I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information. That would entirely defeat the purpose of an anti-cheat system. You have to have some sort of personally identifiable information attached to the data being sent in to the server, otherwise how are you going to ban the cheaters? Even IP addresses are personal identifiers as far as the GDPR is concerned and even if they're not storing it long term, just sending the user data over the wire is enough to trigger the data collection portions of the GDPR.
    - sdoering 8y ago
      Exactly this. The moment you send it via IP you have the IP address and therefore have PII data. And the moment you take screenshots you cannot not be sure what you collected. This does go further beyond GDPR as it is imho an intrusion into the inner most personal space. I believe a German court of law would have a field day ripping this practice apart, if a case would be presented. Esp. if they do not totally make it clear upfront what they are doing. In a way every layman is able to understand.
    - mynameisss 8y ago
      Instead of using an IP address to identify cheaters the game could assign a unique random generated ID to players. Then they could ban that id without using IP. I think this scheme complies with the GDPR if you take care of not binding that ID with other user personal information.
      - lwansbrough 8y ago
        If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.
        mynameisss 8y ago
        You can apply a one way function to an IP to obtain an ID and then maintain a database of bad IDs. For example you could compute this ID by the SHA256(IP + secret salt). Since way one function don't allow you to recover the IP, the ID is not PII. If you detect an IP which has bad ID the connecting ban that IP from the game. I think this respect the GDPR, you don't maintain a list of IPs or any other PII.

The anticheat team at a videogame company might not know/care about this. This has definitely been the case with past European data privacy regulations.

lucb1e 8y ago
Or it might be deemed reasonable. E.g. you may not film public road in the Netherlands because of privacy, but you may film the patch that your car stands on it if there have been car fires in your neighbourhood in the past month and you are concerned about your car.
- hermitdev 8y ago
  > you may not film public road in the Netherlands because of privacy So does this effectively make dash-cams illegal?
  - ahje 8y ago
    License plates contain personal data.

munchbunny 8y ago

Not necessarily. GDPR isn't a blanket ban on collecting/using this info without consent, it's a policy that consent is required for non-essential collection/usage. You could argue that anti-cheat is essential for an online multiplayer game like this. I think it's sketchy to collect this much info, but I don't think it's explicitly illegal.

mikekchar 8y ago
It's a bit more complicated than that. You have to do a few things. First you have to tell the customer that you are collecting their data. Then you have to tell them under what lawful basis you are collecting their data. The user then has various rights (depending on the lawful basis you choose) to object, etc. If you must collect and use the data in order to fulfil the contract (i.e., there is no other way to do it -- for example you need to get their address in order to ship them a package), then you can just do it (as long as you tell them that you are doing it). For most other lawful bases, you have to allow them to object, in which case you have to stop using the data. I think the real question is whether or not the information in question is personally identifiable information. If it's not, then GDPR doesn't apply. I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information.
- civilitty 8y ago
  > I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information. That would entirely defeat the purpose of an anti-cheat system. You have to have some sort of personally identifiable information attached to the data being sent in to the server, otherwise how are you going to ban the cheaters? Even IP addresses are personal identifiers as far as the GDPR is concerned and even if they're not storing it long term, just sending the user data over the wire is enough to trigger the data collection portions of the GDPR.
  - sdoering 8y ago
    Exactly this. The moment you send it via IP you have the IP address and therefore have PII data. And the moment you take screenshots you cannot not be sure what you collected. This does go further beyond GDPR as it is imho an intrusion into the inner most personal space. I believe a German court of law would have a field day ripping this practice apart, if a case would be presented. Esp. if they do not totally make it clear upfront what they are doing. In a way every layman is able to understand.
  - mynameisss 8y ago
    Instead of using an IP address to identify cheaters the game could assign a unique random generated ID to players. Then they could ban that id without using IP. I think this scheme complies with the GDPR if you take care of not binding that ID with other user personal information.
    - lwansbrough 8y ago
      If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.
      - mynameisss 8y ago
        You can apply a one way function to an IP to obtain an ID and then maintain a database of bad IDs. For example you could compute this ID by the SHA256(IP + secret salt). Since way one function don't allow you to recover the IP, the ID is not PII. If you detect an IP which has bad ID the connecting ban that IP from the game. I think this respect the GDPR, you don't maintain a list of IPs or any other PII.