Privacy in Game Tracking: Keep It Anonymous
Record what happened in the game, never who played it: no accounts, no device ids, no IP addresses and no clock times. Ask the player first anyway, because in the EU even anonymous information stored on someone's device can raise a legal question.
This page is general information and has not been reviewed by a lawyer. Nothing here makes tracking legally safe, so get advice before you release a game with it.
What makes a log anonymous?
Leaving out names is not enough. Glass Orchard is an invented game, and these numbers are made up for this example. Its first log line had nine things in it:
| Field | Keep? | Why |
|---|---|---|
| Event name, such as level-lose | Yes | This is the point |
| Level | Yes | Tells you where |
| Seconds since this sitting began | Yes | Tells you how long, not when |
| Game version | Yes | Needed to compare versions |
| Clock time and date | No | Can tie a sitting to a person |
| Language | No | Rare ones stand out |
| Screen size | No | Part of a device's fingerprint |
| Device id | No | Follows one device for good |
| Account name | No | It is a person |
The game had 40 testers. By language alone, 3 of them stood out, because each was the only one speaking theirs. Adding screen size and start time made 31 of the 40 unique, without one name in the file. Anyone who knew that a friend played in Finnish at 23:10 could pick out her whole session. The four fields that stayed describe the game, not the player, so nothing was left to recognise a friend by.
This is what the law calls singling out. Recital 26 of the GDPR, the EU's data protection regulation, says data that is truly anonymous falls outside it. It also says that pseudonymous data, where a label can be traced back with extra information, still counts as personal, and that singling someone out counts as a way of identifying them. So a stable player id is not anonymous.
Why ask if nothing is personal?
Article 5(3) of the EU's ePrivacy Directive covers storing information on a user's device and reading it back. The European Data Protection Board points out that the rule says "information", not "personal data". In Germany, § 25 TDDDG says that storing or reading requires consent unless it is strictly necessary for a service the user explicitly asked for.
A save game is something a player obviously wants. A statistics log is less clear, and we cannot tell you where your game falls. The honest and simple way out is to ask in plain words, and to record nothing on a no. The Board also says that sending information produced on a device back to a server can count as accessing it. That is one reason our event log sends nothing, and a player hands over their file themselves.
If you add automatic sending later, remember that servers can see who contacts them. nginx, a common web server, writes the visitor's IP address into its log by default. Get advice before you do this.
What to do about it
- Refuse free text: a chat line can hold anything.
- Say what you collect, in a sentence a child understands.
- Offer a delete button, and make it work.
Paste this to your AI
Check my game's tracking for anything that could point to a person.
1. List every place my game records or stores data, and draw how the data moves as a Mermaid state diagram: from the moment it is created, to where it is stored, to who can see it. Mark every step that leaves the player's device.
2. Compare that with this plan: no accounts, device ids, IP addresses, clock times or free text, a random label for each sitting that is never stored for the next one, nothing written before the player agrees, nothing sent automatically.
3. Show me each field found, with one real example value and the file and line it comes from.
4. Look for values only one session has, such as a version just one tester got, because rare values can point to a person. Show the count of such sessions. If I have too little data to tell, say so.
Change nothing yet. Never tell me anything is legal or safe. You can only tell me what the code does, and I will take legal questions to a lawyer.
Or skip this and connect the MCP: your AI then finds all of this by itself.Connect the MCP
How to check it worked
- Read a whole session. Could you tell a friend's session from anyone else's?
- Say no in the game. Nothing may be written, not even a label.
- Search your code for "fetch" and "send". Nothing should leave the device without you knowing.
- Ask someone who knows. A lawyer, before release. We are not one.