cross-posted from: https://lemmy.cafe/post/4800845
tl;dr: Watch what you put online and who you friend, especially on Steam. Once it’s on the internet, it’s there forever.
There’s a website similar to SpyPet for Discord, but for Steam. They compile all of our users’ profile pictures, name history, comments, URL history, “real name” history, our friend networks, forever, and they give us no option to opt out of it. Not even a private profile will stop it from scouring your friends’ lists, the forums, your avatars and name history. So what’s the purpose of it?
Stalking. I’m a victim of it.
And despite all of my efforts to not leave a trail leading to my new Steam account, SteamHistory enabled my stalkers to find me.
There are a number of unfortunate folks that have dedicated their time to follow me into whatever game servers I visit and spoil my day. I had deleted my old Steam account and repurchased all of my games on a new account that was privated from the start. I was very careful to not disclose any information that could lead to my identification, including using VPNs and prepaid methods to avoid leaking my real name to Steam. Despite that, my stalkers managed to attribute my new anonymous account to me, even though my profile is private and haven’t posted anything. But how? Well, they were “kind” enough to tell me how.
How did they find me? Enter SteamHistory.
The task itself would have been impossible without a massive database of Steam friend networks, but the website simplifies such an endeavor that it is basically trivial. Assume the role of a stalker for a second and that you know nothing about your victim’s new account. All you know is that they have a few friends with whom they sometimes play and their profiles are also private. What can you do? Initially, it seems like a lost cause, SteamHistory gives you a lead.
Go on their website and look up your victim’s friends. Despite that all involved profiles are private, it is unlikely that the victim’s friends would create new Steam accounts and repurchase their games. It’s more likely that they would simply private their profiles. With this knowledge, look at each friend’s friend history and find the friends that they all have in common, then eliminate all of those in this intersection that you are sure are not your victim. This process will always narrow the scope into only one last person: the target. Bingo. You’ve found your victim. And you didn’t even need any data from them. That’s how they found me.
What does SteamHistory store?
They store and put on an exhibit your embarrassing names, your immature profile pictures, for the whole world to see. Your deadname, your abusive ex’s comments, made forever available for any imaginable bad actor. They etch in stone the fact that you once were Steam friends with this guy that turned out to be a sexual predator.
So what can you do?
Nothing besides not using Steam. Or get Valve to implement better control of our privacy, but good luck with that. The owner of SteamHistory has been confronted on the matter, and what they said is that you can opt out of data collection by deleting your Steam account. They don’t care about the GDPR because they’re situated in the US.
So heads up.
So theoretically they could collect data on Europeans from Steam, block those people from accessing the site, and they would be good?
No, they would have to collect from some Europeans and then geoblock all of Europe, and they might be good.
Yes, blocking all of Europe is what I meant. The point is they are collecting the data from Steam, which already has the data legitimately, not from the users directly. One of the two conditions for complying with GDPR according to the comment above was simply blocking Europeans with no other conditions. It sounds like as long as they do that, they can collect and distribute all the data about Europeans they want.
No, the purpose of restricting the site is to ensure you don’t collect European citizens data. They don’t use any part of the site that collects data, their data isn’t in your set.
What you’re saying would break GDPR and hide that fact from Europeans.
The comment above claimed one of two options to comply with GDPR was to block Europeans with no other conditions. Is there additional language in there to mandate that sites that block Europeans cannot collect data about them from other sources as well? If so, the previous comment isn’t accurate
They explicitly state they’re talking about considerations of being a website admin.
For instance your can be an EU Spotify account holder and request your portfolio from Spotify and they have to dig up all your data and give it to you. You can also ask them to forget about you and make them delete all that data. You can make this request to anyone that holds your information without reason.
If you collect information about European citizens, whether as a primary aggregate, or simply to manipulate and present it, you must comply. It is not an option. The other implicit option is don’t collect data belonging to European citizens. For a website admin this is done by preventing Europeans from accessing your site.
Osa above says they might be good because it only matters if Europeans know you have their data and you’re not obligated to announce it without a GDPR request. Which is hard to do if you block them.