Ubisoft Accused Of Violating EU Privacy Laws Via “Secret Data Collection” In Single-Player Games Like ‘Assassin’s Creed’ And ‘Far Cry’
In the latest spot of trouble for the embattled Assassin’s Creed and Far Cry series developer, a noted European privacy group has authored a formal legal complaint accusing Ubisoft of violating established EU laws – specifically the GDPR – and secretly collecting single-player gameplay without the explicit consent of their users.
Filed on April 24th by the Austria-based privacy rights NGO noyb (None Of Your Business), the complaint alleges that while playing the Steam release of Far Cry Primal late last year, a player (whose name is currently being withheld by the group out of privacy concerns) discovered that they were unable to launch the game in off-line mode, instead being asked to login to a Ubisoft account in order to allow the publisher to collect a variety of user data, including “their user ID, [when they] launched the game, when they quit playing and exactly how long they kept the game running,” which they were then passing on to larger corporations like Google and Amazon.
Upon inquiring with Ubisoft about said data collection, the company told the player that “the data sent when launching one of [our] games is an ownership check on our serves to validate that the player’s account owns the game they’re trying to launch”, but as pointed out by noyb, did not provide any actual explanation “regarding what [exact] data is collected for metrics or why data packets are sent back and forth between the player and, for example, Google servers when the player is playing the [single-player] game.”
To this end, noyb believes that due to both the data in question concerning player behavior and the inability for players to opt out of participation, the Far Cry dev is actively violating the EU’s General Data Protection Regulation (GDPR) law, whose Article 6 specifically holds that outside of issues pertaining to national security and threats to public safety, a given party must get consent from a user in order to collect their info.
“Crucial in the balancing test [between user rights and data collection allowances] is to recognize that collecting data from the data subject, as they play a video game, is tantamount to monitoring their behaviour in their private sphere,” the organization argued. “The controller [aka Ubisoft] has not considered that the complainant might not want to be monitored, especially not secretly. Due to the inadequate information provided to the data subject it is not even possible to assess the scope and type of collected data. Unless a connection between the controller and the complainant is strictly necessary for the service, this kind of violation of the data subject’s privacy and intrusion into the private life can only be considered a direct violation of the data subjects right to respect for his private life and home as expressed in Article 7 of the Charter and of his right to protection of personal data under Article 8 of the Charter.”
“If you want to enter someone’s home, you should be invited, otherwise you’re trespassing,” they added. “If the behaviour is illegal in the physical sphere, it should be illegal in the digital one as well. There is no reason to apply a different standard.”
Filed with the Austrian data protection authority (DSB), nyob is calling for the regulatory body to “investigate the data processing practices”, order Ubisoft “to bring its data processing in compliance with the provisions of the GDPR”, and also hit them with “an administrative fine”.
As of writing, Ubisoft has yet to publicly respond to noyb’s GDPR claims.
[Editor’s note: While the specific term “Secret data collection”, as quoted in this article’s headline, does not appear in the complaint itself, it is used on nyob’s official update regarding the case. Rest assured, we’re not making up words!]
More About:Video Games