Data collection in games

Quick answer

A free-to-play game handles three kinds of information: what the player supplies at registration, what the client and servers record about play and the device, and what advertising or analytics components collect. Personal information handled about people in Australia is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and the publisher's own policy is the document that says what is done.

Data collection in games is the set of practices by which a publisher records information about players, their devices and their behaviour, both to operate the service and for commercial purposes beyond it. The categories are consistent across the free-to-play market even though the detail varies by publisher and by the components they include.

This entry describes the categories and how to read a publisher's policy against them. It does not describe what any particular game collects, because that is stated in that publisher's own policy and changes with each release.

The three categories

Supplied information: What the player enters: an email address, a username, a date of birth or age declaration, and where a social or platform login is used, whatever that login passes through. Payment details are usually held by the storefront rather than the publisher, which is why a card number is not typically in the publisher's own records.
Service information: What the client and servers record in operation: account identifiers, device model and operating system, an advertising or installation identifier, IP address, crash reports, session times, progression state and purchase history. Most of this is necessary to run a service that synchronises an account across devices.
Commercial information: What is collected for purposes beyond running the game: attribution data identifying which advertisement led to an install, analytics on in-game behaviour, and audience data shared with advertising partners. This is the category that varies most between publishers and the one a policy should be read most carefully for.

Attribution, briefly

When a player installs a game after seeing an advertisement, the publisher usually wants to know which advertisement it was, so that it can pay the right partner and judge the campaign. That is attribution, and it is the mechanism behind a large part of the identifiers a game sends on first launch. It is also the mechanism behind the paid links on this site, described in our Affiliate Disclosure and in our Privacy Policy, which explains what this publisher does and does not receive.

Reading a game's privacy policy

A publisher's policy is long and most of it is standard form. Six questions extract the substance.

Who is the entity, and where is it? The named company and its country determine which regulator applies and where a complaint goes.
What is collected automatically, as distinct from what the player supplies? The automatic list is the longer one and the less obvious one.
Which third parties receive data, and in what role? A list of categories such as “analytics partners” is weaker than a list of named recipients; both are common.
Is information used for advertising, including advertising on other services? This is where cross-context profiling appears if it appears.
What controls exist, and where are they? In-game settings, platform-level advertising identifier controls and the publisher's own request process are three different mechanisms.
How is a request made, and how long does it take? An email address or a form, and a stated period.

The Australian position

Personal information about people in Australia is regulated by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which cover collection, use, disclosure, overseas disclosure, security, access and correction. The principles are published by the Office of the Australian Information Commissioner, which also publishes guidance for individuals on making a privacy complaint and on what to do after a data breach.

Whether and how the Act applies to a particular overseas publisher depends on circumstances this site is not in a position to assess for any named company. A reader with a specific concern about a specific publisher is better served by the OAIC's own material than by a general statement here. Where an account belongs to a child or a teenager, the eSafety Commissioner publishes practical material on gaming privacy and settings for families.

What the player can control

Control points, and what each one reaches
Control	Where it lives	What it affects
Advertising identifier reset or opt-out	Operating system or platform settings	Cross-app advertising profiles tied to that identifier
In-game privacy or data settings	The game's own settings screen, where provided	Analytics and marketing options the publisher exposes
Account deletion request	The publisher's stated process	The account record; often not backups or aggregated analytics
Access or correction request	The publisher's privacy contact	What the publisher holds about the requester
Minimal registration	The player's own choice at sign-up	How much is supplied in the first place

Worked example: deleting an account

A player decides to stop playing and wants the account removed. The sequence that usually works: cancel any recurring purchase at the storefront first, because deleting a game account does not stop a subscription billed by a platform; then use the publisher's stated deletion route rather than simply uninstalling, since uninstalling removes the client and leaves the server-side account intact; then expect the publisher to confirm, and note that deletion usually ends access to purchased content permanently and is not reversible. If the publisher's policy states a retention period for records kept after deletion, that is the period during which some data still exists, which is ordinary and should be stated in the policy.

What this site itself collects

For completeness, since this entry is about data practices: FastStart Online sets no cookies, loads no fonts or scripts from other servers, runs no analytics and has no forms. The only records that exist are the access logs kept by the hosting provider and any email a reader chooses to send. The detail is in the Privacy Policy and the Cookie Policy, and the two agree with each other and with the site's code.

Key terms used in this entry

Advertising identifier: A resettable identifier the operating system provides to apps for advertising purposes.
Attribution: Linking an install or sign-up to the advertisement or link that produced it.
Telemetry: Automatic reporting of events and errors from a client to a server.
Data breach: Unauthorised access to or disclosure of personal information.
Australian Privacy Principles: The thirteen principles in the Privacy Act 1988 (Cth) governing the handling of personal information.