Err..isn't the point of this exercise to have enough data to identify who bought the game and why? I feel the exact kind of computer I use and the various customizations that lead to it being a unique machine are very personal and identifiable.
You only need good lawyers if you are trying to game it.
It wouldn't be a problem to collect that. If I am informed as well as have the (easy) ability to opt out.
Did they collect after 25. of May? Wouldn't they be liable regarding GDPR?
> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
https://gdpr-info.eu/art-4-gdpr/
> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
[...]
> ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR.
Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.
The information collected in this program is more than enough to identify me personally, and probably enough to start making some kind of psychological profile to help them predict how to convince me to vote for Donald Trump (or in my case, a Liberal Party member).
This is why I roll my eyes back into my head every time some marketing suit says "well we anonymize the information" and it's just flat out ridiculous if you think about it, if the information was properly anonymized, then IT COULDN'T BE USED FOR AD TARGETING. Full. Stop.
So if the data collection is for ad targeting, then it's identifiable because it can't not be otherwise it would be useless for the thing it's collected for.
The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two.
As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation.
Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another.
Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.
> "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs."
Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right).
Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law.
edit: formatting
All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default.
Based on my research I don't believe that these (even all of them together) are PII.
The distinction here is that they have been doing it a very long time, and user privacy actually is a core tenet of what they worry about at Google.
That is vastly different from a spyware module installed clandestinely together with a software I paid for that sends data about me to somewhere and somebody then does something with it that I don't know about.
If you really think this is false outrage you need to work on seeing things from other people's viewpoints
> Consumers do not want to pay money for a product and then also have their data harvested to be used to make even more money off of them.
Agreed. And both the game devs and Red Shell as far as I can see aren't selling this data. The devs are spending money to use Red Shell to try to have better / more cost effective advertising campaigns.
Just collecting the data makes it vulnerable to abuse. What if there is a breach?
I am struggling to think of how this affect my life.
They are outraged because the data is being collected at all, not what you are using it for
The nature of marketing hasn't changed at all over the years. Show an impression, ask what the user was influenced by. Surreptitiously stealing data off of someone's computer as a means of answering the question is flat out the wrong way to do it.
If you take my personal data without my consent, I will consider that an intrusion upon my privacy.
*We sell it to others who do that!