4 ms·

> Wonderful, we have found a way to silently persist a cookie for each player as they join the server. This violates GDPR, no? Edit: It sounds like this took

> Wonderful, we have found a way to silently persist a cookie for each player as they join the server. This violates GDPR, no? Edit: It sounds like this took place before GDPR was being enforced.

kemitche 2y ago
GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r... Fraud prevention is listed as an example of a "legitimate interest." So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprinting used solely for anti-cheat. They'd run into trouble if they use that same ID for marketing/advertising without consent, though.
- Retr0id 2y ago
  They're perhaps not required to gather explicit opt-in consent, but my understanding is that they'd be required to disclose what information they collect/store.
  - phire 2y ago
    The same rules apply to the steam ID and IP address. As far as I'm aware, you can get away with disclosing the fact that you are tracking "unique identifiers for the purpose of anti-cheating" in the terms and conditions, without explicitly explaining the technical details that it's a cookie. Also, this is a server covering the Australia/New Zealand region, so it doesn't have to worry about GDPR compliance.
    - xxs 2y ago
      >the fact that you are tracking "unique identifiers for the purpose of anti-cheating" A person can requests to delete their data at any time, and also can request to provide all the personal data collected.
      - consp 2y ago
        This does not apply to fraud. You can store the data if it is relevant to an illegal act, and since cheating voids the ToS of the server ...
        xxs 2y ago
        fraud is a criminal offense. ToS is in most cases is a wish-washy nonsense talk, legally not enforceable (in the EU) It's rather hard to make any online agreement that's more lax than the law in the EU (and call it ToS)
- newZWhoDis 2y ago
  GDPR is toothless eurotrash. I saw a consent form that had 72 optional, 21 “legitimate interest” cookies. GFB
  - Ylpertnodi 2y ago
    That means gdpr is working.
  - tmtvl 2y ago
    If GDPR were entirely toothless then they wouldn't have shown you the consent form but they would've just served the cookies regardless. The GDPR is not about reducing the cookies served, it's about letting people opt out. Unfortunately it is lacking some teeth because normally opting out of all cookies should be as easy and straightforward as opting in to all cookies, but I've seen quite a few forms that hide 'reject all' behind a 'more info' button type of thing. Maybe I could file a complaint about that, I should look into it.
red_admiral 2y ago
IANAL, but there is a "Legitimate Interest" exception, which gets abused a lot when a consent popup has about 50 of those pre-checked on a hidden tab, but this looks like a valid case to me. The UK DPA (basically a fork of GDPR) has this to say [1]: "the following purposes do constitute a legitimate interest [...] fraud prevention; ensuring network and information security; indicating possible criminal acts". Under the Computer Misuse Act 1990 [2], there's a possible reading under which "hacking" to cheat (even if someone else does the hacking and you jsut install the program) could actually be a crime. [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://www.legislation.gov.uk/ukpga/1990/18/section/3 https://www.legislation.gov.uk/ukpga/1990/18/section/3

> Wonderful, we have found a way to silently persist a cookie for each player as they join the server. This violates GDPR, no? Edit: It sounds like this took place before GDPR was being enforced.

kemitche 2y ago

GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r... Fraud prevention is listed as an example of a "legitimate interest." So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprinting used solely for anti-cheat. They'd run into trouble if they use that same ID for marketing/advertising without consent, though.

Retr0id 2y ago
They're perhaps not required to gather explicit opt-in consent, but my understanding is that they'd be required to disclose what information they collect/store.
- phire 2y ago
  The same rules apply to the steam ID and IP address. As far as I'm aware, you can get away with disclosing the fact that you are tracking "unique identifiers for the purpose of anti-cheating" in the terms and conditions, without explicitly explaining the technical details that it's a cookie. Also, this is a server covering the Australia/New Zealand region, so it doesn't have to worry about GDPR compliance.
  - xxs 2y ago
    >the fact that you are tracking "unique identifiers for the purpose of anti-cheating" A person can requests to delete their data at any time, and also can request to provide all the personal data collected.
    - consp 2y ago
      This does not apply to fraud. You can store the data if it is relevant to an illegal act, and since cheating voids the ToS of the server ...
      - xxs 2y ago
        fraud is a criminal offense. ToS is in most cases is a wish-washy nonsense talk, legally not enforceable (in the EU) It's rather hard to make any online agreement that's more lax than the law in the EU (and call it ToS)
newZWhoDis 2y ago
GDPR is toothless eurotrash. I saw a consent form that had 72 optional, 21 “legitimate interest” cookies. GFB
- Ylpertnodi 2y ago
  That means gdpr is working.
- tmtvl 2y ago
  If GDPR were entirely toothless then they wouldn't have shown you the consent form but they would've just served the cookies regardless. The GDPR is not about reducing the cookies served, it's about letting people opt out. Unfortunately it is lacking some teeth because normally opting out of all cookies should be as easy and straightforward as opting in to all cookies, but I've seen quite a few forms that hide 'reject all' behind a 'more info' button type of thing. Maybe I could file a complaint about that, I should look into it.

red_admiral 2y ago

IANAL, but there is a "Legitimate Interest" exception, which gets abused a lot when a consent popup has about 50 of those pre-checked on a hidden tab, but this looks like a valid case to me. The UK DPA (basically a fork of GDPR) has this to say [1]: "the following purposes do constitute a legitimate interest [...] fraud prevention; ensuring network and information security; indicating possible criminal acts". Under the Computer Misuse Act 1990 [2], there's a possible reading under which "hacking" to cheat (even if someone else does the hacking and you jsut install the program) could actually be a crime. [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://www.legislation.gov.uk/ukpga/1990/18/section/3 https://www.legislation.gov.uk/ukpga/1990/18/section/3