A storm caused by a player's data access request is pushing the French game giant Ubisoft Entertainment to the forefront of public opinion. Recently, the Austrian non-profit digital rights organization NOYB officially launched a legal lawsuit against Ubisoft Entertainment, accusing its well-known game series such as "Assassin's Creed" and "Far Cry" of illegal data collection and forcing single-player games to maintain online connections. This series of operations is suspected of violating the EU General Data Protection Regulation (GDPR).
If the allegations are established, Ubisoft Entertainment may face a huge fine of up to 92 million euros, which is equivalent to 4% of the company's revenue of 2.3 billion euros last year.
The fuse of the incident came from a data access request made by a "Far Cry" player to Ubisoft Entertainment. Ubisoft Entertainment initially responded that it only collected basic data such as game startup time and duration. However, NOYB's technical analysis revealed a completely different truth: in just 10 minutes of running "Far Cry: Primal", the game program established more than 150 connections with external servers. NOYB bluntly stated that this data transmission beyond normal needs is tantamount to "secret surveillance."
Regarding the controversy over the mandatory online verification of stand-alone games, Ubisoft Entertainment explained that this move was to verify the ownership of the game. However, NOYB mercilessly pointed out that the game purchased by the player through the Steam platform can be authorized with the help of the Steam verification system, and there is no need to bind the Ubisoft Entertainment account additionally. What is more interesting is that even if Ubisoft Entertainment claims to support the PC-side Ubisoft Connect platform with offline mode, users still need to connect to the Internet to activate it when using it for the first time, which undoubtedly greatly reduces the promise of "offline mode".
Faced with the doubts, Ubisoft Entertainment used the End User License Agreement (EULA) as a shield, insisting that players agree to use "third-party analysis tools to collect game habit data" by accepting the agreement. Its privacy policy also authorizes the collection of "game data used to improve experience and service security" and "login browsing data to ensure service operation." However, NOYB countered that simply launching the game does not constitute effective consent to the EULA, and that the hardware information, IP addresses, etc. collected by Ubisoft Entertainment are all personal data. This data processing behavior beyond the necessary scope is obviously suspected of being illegal.
