ESO Logs consent is not GDPR Compliant. Very promising.

disintegr8 · April 2019

LiquidPony wrote: »

anitajoneb17_ESO wrote: »

zTrok wrote: »

Not sure what the fuss over this whole thing is. The logs are going to be super helpful as a raid lead, and I'm pretty sure the pugs in a fungal grotto 1 won't care that you can't do more than 10k dps, so what's the issue?

Doesn't have to be about DPS.
Let's see John, student and ESO player. John has a very nice girlfriend, a lot of stuff to study for his studies, and enjoys playing ESO. Now there's this group raid on thursday night with his guild. And Jane - she's the girlfriend - wants to go out somewhere. Now John tells Jane that he has an important exam on friday morning, promises to study a lot and to go to bed early, kisses her good night and sits comfortably in front of his PC and prepares for raiding. Everything is fine, until the next morning, Jane sees the raid log on esologs...
I'm not sure that scenario takes so much weed to imagine. It's everyday stuff really. The part where the log says exactly what you've been doing in the game and when is already a problem.

Wow.

Just ... wow.

The ESO forums reach new lows with every passing hour.

Yep, it's the esologs failure to comply with GDPR which caused John to be caught out lying to his girlfriend....

The GDPR was brought in to reduce our chances of being caught out lying to our partners - nice.

ryzen_gamer_gal · April 2019

One more try.

The legal argument will come down to who is and isnt a natural person.

Your named character isnt a natural person.

Even though you may qualify as a natural person (or who knows, maybe legally you dont qualify)

See the real problem now?

xMovingTarget · April 2019

Instead of looking and researching this up, you could just have trained on a dummy and gained better dps, so your fear would be gone to net get picked up anymore.

You guys are ridiculous.

Half of you go to Facebook, Instagram etc. But a combat log in a video game. Uhhgghh, that is too much. Jesus Christ.

Hallothiel · April 2019

VaranisArano wrote: »

Jeremy wrote: »

From my understanding of the GDPR: this argument boils down to the question whether or not a person's account name is considered personal information.

There is that aspect to it.

This particular thread is mostly about whether or not the ESO Logs website has GDPR compliant cookies/consent to use cookies.

But since none of us are actually GDPR experts AFAIK, we're mostly forum lawyering

There is no such thing as a GDPR expert - I know this as I work in this field!!

And as has been mentioned, when it comes to online identifiers & if they are personal data, and other bits that deal with online data & who owns it, the rules get very vague & nebulous - and thus cause these problems.

Alinhbo_Tyaka · April 2019

I'll admit I skipped portions of the conversation but I think a few things are getting confused or maybe I am. If the owner of ESO Logs does not do business and the servers are not resident in the EU, which appears to the situation, then GDPR does not apply. The fact is you cannot enforce EU law outside of the EU.

However ZOS and ESO do business and have servers residing in the EU. Since they have provided an interface that can potentially divulge a player's identification without consent it seems to me this is where the GDPR complaints should be addressed. Even though I don't reside in the EU I want the ability to not just tell the game I wish to be anonymous but that I don't want to participate in statistics collection at all.

Runefang · April 2019

Google is also not GDPR compliant. So before you worry about what information this site has about your pixels and character names I’d suggest you stop Googling where to eat tonight. Or stop with the false outrage.

radiostar · April 2019

This sounds like something that should have been left as an addon for consenting groups or guildies to use together, not a forced game integration. In fact it sounds like what some players tried to get started not long after launch, maybe not enough players signed up for it back then. Let us have an opt out, all the endgamers who would want to use it will anyway. btw if someone says you mind if I start logging and you say no don't start logging, they could still log you, right? lol

Acrolas · April 2019

ZOS made it clear in the TOS that they own your account and everything contained in the account, so from the beginning I've made sure to not have a personal footprint anywhere on my account. I have some clever character names, but nothing that distinctively leads back to me.

With Logs going into effect I might change the email associated with my account. That way I know anything coming into that mailbox should have come from ESO in one context or another.

But Logs may as well list my stats as IDGA* because IDGA*. I only need to be good enough to comfortably clear the content I want to clear, not have a *** measuring contest with some sweaty accountants.

WatchYourSixx · April 2019

Wow seriously someone doesn't like the new log system so much they are trying to find ways to get the website taken down? What does it even matter everyone and everything is tracked already on the internet. People just don't want to enjoy new features anymore apparently

DarcyMardin · April 2019

anitajoneb17_ESO wrote: »
Mudcrabber wrote: »
None of the logs will show up in Google. That used to be good enough for most.

https://www.esologs.com/robots.txt
User-agent: *
Disallow: /zone/
Disallow: /guild/
Disallow: /character/
Disallow: /reports/
Disallow: /server/
Does the GDPR have any safeharbor exceptions, where responsibility falls on the uploader instead of the service host? Sites like YouTube or Reddit could not function if they were personally responsible whenever someone's username was mentioned in a bad light.
I'm sorry but the "robot" thing doesn't make sense to most of use (unless I'm much dumber than most). Care to explain / elaborate a bit ?

This is simply an answer to the robot question, from someone who has been an expert witness in US federal court on search engine technology:

A robot, in this sense of the word, is a software program that follows links across the web and indexes the material on the pages where it lands to be stored in various databases. The database being referred to by the original poster is Google—which indexes just about everything posted on the web unless it is ordered not to do so. Website developers can set up “do not index” command on their websites, and what the poster brought up was exactly this—the third party website where the ESO logs are being stored is currently ordering any robots who visit the site not to index the items that are above listed as “disallowed.”

What this means is that any info that fits into those listed variables will not show up in a Google search. Or in a search on any other search engines.

Whether this provides sufficient privacy is another matter entirely.

Kittenhood · April 2019

anitajoneb17_ESO wrote: »

LiquidPony wrote: »

The ESO forums reach new lows with every passing hour.

@LiquidPony : would you mind coming with actually constructed, sensible arguments, instead of always coming up with short, implying (albeit meaningless) vocabulary such as "wow.... " ?

I'm close to believe you have no argument at all.

I think the message LiquidPony was trying to get across in fewer words:

If you have to lie to your girlfriend to play Elder Scrolls Online as a college student, that's a "new low".
As in that's bad, and if she dumps you, that's your fault for pettiness.

Your 'example' was kinda iffy at best, chief. That ain't it.

Kittenhood · April 2019

Ydrisselle wrote: »

VaranisArano wrote: »

Ydrisselle wrote: »

Kittenhood
Yes, you won't find yourself on ESOLogs yet - because right now it's only working on the PTS, and only from yesterday. So I'm sure you didn't raid together with anyone on the live servers who are using it, since nobody can do that now

In addition, during the PTS, all logs are private.

I know It's still hilarious that somebody is defending the current default setting without even know that it doesn't work on live servers.

I don't know if you were referring to me, but I was never defending anything.

Although I agree wholeheartedly with Ydrisselle's "the default setting should be 'anonymous' for everyone" sentiment - allow people to opt out of this logging - not because it isn't GDPR compliant, which is a crock of bull. But because in a pick-up group Trial setting (non-veteran) we don't need more toxic players than there are already.

And Ydrisselle also may have a point with the PTS thing - I've done only a couple of veteran trials in the past few days on the PTS, which if this ESOLogs service went up yesterday would explain why I can't 'search myself' yet.

Thank you.

Apox · April 2019

homies in this thread acting like esologs gonna be trackin your every move and send you brochures in the mail about how to get a bigger dps score.

yikes

Mayrael · April 2019

anitajoneb17_ESO wrote: »

Mayrael wrote: »

Your personal opinion has nothing to do with actual law.

Neither is yours, nor the opinion of your colleague at work, even if he's a lawyer.

Mayrael wrote: »

Just to make sure, I didn't talked with them about nicknames in game. We talked about real data.

Nickmanes are pseudonyms. Pseudonyms are real, personal data. Deal with it.

_____________

@VaranisArano : how do you manage to be so incredibly patient ? Kudos !

_____________

bharathitman wrote: »

So the 5k dps club is fighting back?

Yeah, noone should worry about toxicity, should they ?

Show me one thing mate. Where it is written that nicknames of your characters are yours? THES ARE NOT YOUR PERSONAL DATA.

From ESO TOS:

"By creating an Account, You agree that You do not own the Account, any user names created on the Account, any Content stored or associated with an Account (such as digital and/or virtual assets, achievements, virtual currency, and other Downloadable Content), or related data associated with the Account."

So please explain me how ZOS by posting something you don't own breaks your rights?

It's not about your interpretation, but interpretation of lawyers and judges, thus interpretation of law team > yours.

anitajoneb17_ESO · April 2019

Mayrael wrote: »

Show me one thing mate. Where it is written that nicknames of your characters are yours? THES ARE NOT YOUR PERSONAL DATA.

From ESO TOS:

"By creating an Account, You agree that You do not own the Account, any user names created on the Account, any Content stored or associated with an Account (such as digital and/or virtual assets, achievements, virtual currency, and other Downloadable Content), or related data associated with the Account."

So please explain me how ZOS by posting something you don't own breaks your rights?

It's not about your interpretation, but interpretation of lawyers and judges, thus interpretation of law team > yours.

Law trumps TOS.
It's been explained and quoted all over those threads. Just read them.

Elsonso · April 2019

VaranisArano wrote: »

My main issue with ESO Logs is simply that it assumes our consent. I wish it were Anonymous, unless you choose otherwise.

Personally, I would never go out the door with a feature like this turned on by default, so I agree.

I am not certain that ZOS has said that the feature is designed to be on by default. Even if they have said it, protest has been raised, and ZOS is free to make it off by default before it goes live. Even if it is going to be off by default, they may keep it on by default during PTS for testing purposes.

Mudcrabber wrote: »

Does the GDPR have any safeharbor exceptions, where responsibility falls on the uploader instead of the service host?

Heh.

Mayrael wrote: »

Show me one thing mate. Where it is written that nicknames of your characters are yours? THES ARE NOT YOUR PERSONAL DATA.

In this case, the ESO account name is an online identifier that is specific to the physical and social identity of a natural person. It does not matter who owns the account. ZOS is still required to act if an EU citizen demands it.

WeerW3ir · April 2019

There is one huge difference. With the new tool. they can track your activity in game. even if you hide yourself. the game will say youre anonymus. and lets see. if there is a trial. and from 12 member. only youre the anonymus. then it will end up the same. they will know youre.

Hallothiel · April 2019

1) terms and conditions can be challenged if one party decides to unilaterally change the terms of service without agreement.

2) Again, whilst Zos does say in the t&cs that they own your user name, this could again be challenged if the user name was used elsewhere - for example my username is the from the PS4 - they don’t own that. And I can’t change the link (as far as I know) between that as my user name in ESO and on the PS4 - So how can they own my username?

3) whilst you may think those debating this are paranoid idiots (that’s your prerogative) it’s about the principle of things being shared with a third party site without consent.

4) finally - most posting who query the compliance are not saying not to have esologs! Just to think about it and implement it in a way that does not potentially alienate a lot of the playerbase.

Jhalin · April 2019

anitajoneb17_ESO wrote: »

Mayrael wrote: »

Show me one thing mate. Where it is written that nicknames of your characters are yours? THES ARE NOT YOUR PERSONAL DATA.

From ESO TOS:

"By creating an Account, You agree that You do not own the Account, any user names created on the Account, any Content stored or associated with an Account (such as digital and/or virtual assets, achievements, virtual currency, and other Downloadable Content), or related data associated with the Account."

So please explain me how ZOS by posting something you don't own breaks your rights?

It's not about your interpretation, but interpretation of lawyers and judges, thus interpretation of law team > yours.

Law trumps TOS.
It's been explained and quoted all over those threads. Just read them.

Law only applies to your data, which this isn’t. You agreed none of the data on the account belongs to you. You have zero ownership and thus, zero claim to any infringement on “your” data. @ names aren’t linked unless you sign up for the site so you can’t even try to argue it that way. There is nothing that could reasonably be construed as sensitive information

witchdoctor · April 2019

lordrichter wrote: »

In this case, the ESO account name is an online identifier that is specific to the physical and social identity of a natural person. It does not matter who owns the account. ZOS is still required to act if an EU citizen demands it.

This assumes, and frankly, I think it is a huge assumption, that a CHARACTER NAME, not the @NAME, but merely the CHARACTER NAME, is such that can be found to uniquely identify you.

It also assumes then that, if so, the character name, identifying the @name, identifies you, the natural person.

I think that is a stretch.

Unless someone can refer to judicial decision finding, or implying such, I think that is one leap too far (to assume that combat logs associated with a character and two steps removed from the actual person is a breach of any EU law).

EDIT: because, as I understand, it logs the character name, and not the @name.

anitajoneb17_ESO · April 2019

Jhalin wrote: »

Law only applies to your data, which this isn’t. You agreed none of the data on the account belongs to you. You have zero ownership and thus, zero claim to any infringement on “your” data. @ names aren’t linked unless you sign up for the site so you can’t even try to argue it that way. There is nothing that could reasonably be construed as sensitive information

GDPR says otherwise. GDPR trumps TOS. Pseudonyms are private data. That's all there's to it. Deal with it.

Mayrael · April 2019

anitajoneb17_ESO wrote: »

Mayrael wrote: »

Show me one thing mate. Where it is written that nicknames of your characters are yours? THES ARE NOT YOUR PERSONAL DATA.

From ESO TOS:

"By creating an Account, You agree that You do not own the Account, any user names created on the Account, any Content stored or associated with an Account (such as digital and/or virtual assets, achievements, virtual currency, and other Downloadable Content), or related data associated with the Account."

So please explain me how ZOS by posting something you don't own breaks your rights?

It's not about your interpretation, but interpretation of lawyers and judges, thus interpretation of law team > yours.

Law trumps TOS.
It's been explained and quoted all over those threads. Just read them.

Mhm... But doesn't cancel it, just when there is conflict between them, and still I don't see any regulations that would cancel TOS in that matter. You do agree that you don't own anything mentioned above, nobody forces you to do it, you can always decline and resign from the service. It's just like with intellectual property. When someone proclaims he's software is freeware, it's free. If you agree you don't own account and such, it's not yours. If not this clause you could be right, but in this case? You may try, please be my guest, sue ZOS.

anitajoneb17_ESO · April 2019

witchdoctor wrote: »

lordrichter wrote: »

In this case, the ESO account name is an online identifier that is specific to the physical and social identity of a natural person. It does not matter who owns the account. ZOS is still required to act if an EU citizen demands it.

This assumes, and frankly, I think it is a huge assumption, that a CHARACTER NAME, not the @NAME, but merely the CHARACTER NAME, is such that can be found to uniquely identify you.

It also assumes then that, if so, the character name, identifying the @name, identifies you, the natural person.

I think that is a stretch.

Unless someone can refer to judicial decision finding, or implying such, I think that is one leap too far (to assume that combat logs associated with a character and two steps removed from the actual person is a breach of any EU law).

EDIT: because, as I understand, it logs the character name, and not the @name.

From what we know by now :

- If you're "anonymous", your combat data is being logged (if someone you're interacting with is logging), but not your @name and not your char's name.
- If you're not anonymous, both your @name and your char name are being logged. However, only your char name is being shown on the site. @names are not shared. They're used for the database's internal purposes.

That's why the option should be set to anonymous by default.

Flares · April 2019

anitajoneb17_ESO wrote: »

Jhalin wrote: »

Law only applies to your data, which this isn’t. You agreed none of the data on the account belongs to you. You have zero ownership and thus, zero claim to any infringement on “your” data. @ names aren’t linked unless you sign up for the site so you can’t even try to argue it that way. There is nothing that could reasonably be construed as sensitive information

GDPR says otherwise. GDPR trumps TOS. Pseudonyms are private data. That's all there's to it. Deal with it.

How much of a casual you have to be to go after the best thing that ever happened to eso. Just don't participate in the content and you won't get parsed. People didn't care about you before, they certainly won't care now

anitajoneb17_ESO · April 2019

Flares wrote: »

[edit] Just don't participate in the content and you won't get parsed. People didn't care about you before, they certainly won't care now

[edit]. The logger can be used anywhere in the game. You don't have to be "grouped" or to be in an instance to get logged without knowledge and consent.

[edited for non-constructive comment]

RANKK7 · April 2019

Kittenhood wrote: »

@RANKK7
That 'cookies' message on ESOLogs has always been there in some form or fashion.

(...) it also serves no purpose other than the spread of misinformation by the OP (Original Poster).

In some form or fashion is not GDPR compliant but you may contact www.cookielaw.org or www.itgovernance.eu and tell them they are "misinformed" at this point because:

Implied consent is no longer going to be compliant. There are several reasons for this. Mainly it’s because the GDPR requires the user to make an ‘affirmative action’ to signal their consent. Simply visiting a site for the first time would not qualify. So loading up your landing pages with cookies in the hope people won’t opt-out, won’t wash.

Advice to adjust browser settings won’t be enough. The GDPR says it must be as easy to withdraw consent as give it. Telling people to block cookies if they don’t consent would not meet this criterion. It both difficult, ineffective against non-cookie based tracking, and doesn’t provide enough granularity of choice.

‘By using this site, you accept cookies’ statements will not be compliant. If there is no genuine and free choice, then there is no valid consent. Also people who don’t consent also cannot suffer detriment, which means you have to provide some service to those who don’t accept those terms. Which also means…

Sites will need an always available opt-out. Even after getting valid consent, there must be a route for people to change their mind. Again this comes down to the requirement that withdrawing consent must be as easy as giving it.

Soft opt-in is likely the best consent model. This means giving an opportunity to act before cookies are set on a first visit to a site. If there is then a fair notice, continuing to browse can in most circumstances be valid consent via affirmative action. Although see above about a persistent opt-out route. This however may not be sufficient for sites that contain health related content, or other sites where the browsing history may reveal sensitive personal data about the visitor. Then it may require explicit consent, a higher bar to get over.

You need a response to Do Not Track browser requests. A DNT:1 signal is a valid browser setting communicating a visitor preference. It could also be interpreted by regulators as an exercise of the right to object to profiling.

Consent will need to be specific to different cookie purposes. Sites that use different types of cookies with different processing purposes will need valid consent mechanisms for each purpose. This means granular levels of control, with separate consents for tracking and analytics cookies for example.

I've been the webmaster of a personal website, I spent rawly 3 days to get my things straight about a GDPR compliant consent at the time, reading documentation around, analyzing the cookies on the site, building a compliant consent with opt out options, and there are templates to use as base.

You can inform yourself in those sites and there is plenty of other reference sites for platforms superusers and small sites webmasters, the documentation around is massive.

This thread is simply about:

the site that should hold our data (@ZOS would you care to tell us which ones in details and to which extend? Since not everyone is able or have the time to analyze logs and transparency is needed and this is up to you), so that site currently don't have a GDPR compliant consent for cookies and it's not promising at all, it's a basic thing to have.
It's something that can be added at any time and hopefully will be added.

Then there is the part about the data shared from the game but it's obscure for me and for many and I think @ZOS should come out clear and straight about this and explain how the whole data sharing/storing is going to get managed since they are providing support for this.

pod88kk · April 2019

Hallothiel wrote: »

As have noted on other threads about this, GDPR is a minefield at present and has not been tested / challenged in Court.

The main debate stems around whether your user name in a game can be considered personal information - GDPR speaks about ‘online indicators’ that can ‘directly or indirectly’ identify someone, which is rather vague. And do you own the right to that information, or does the game owner?

I would think that as you're essentially leasing the game from Zos and don't necessarily own it that you don't own the information.

If the file had access to personal login information or an email address then that would be a completely different matter.

Elsonso · April 2019

anitajoneb17_ESO wrote: »

From what we know by now :

- If you're "anonymous", your combat data is being logged (if someone you're interacting with is logging), but not your @name and not your char's name.
- If you're not anonymous, both your @name and your char name are being logged. However, only your char name is being shown on the site. @names are not shared. They're used for the database's internal purposes.

That's why the option should be set to anonymous by default.

My understanding of GDPR, as a US citizen looking at all of this because I have to comply with it, is that your bullet #1 OK per the GDPR. The second one is covered by GDPR as it includes a digital identity (ie "personal data") that could potentially be directly linked to personally identifiable information.

Reistr_the_Unbroken · April 2019

ryzen_gamer_gal wrote: »

One more try.

The legal argument will come down to who is and isnt a natural person.

Your named character isnt a natural person.

Even though you may qualify as a natural person (or who knows, maybe legally you dont qualify)

See the real problem now?

Well see here, the the named character is possibly still under a console username or email address soooo...

Jhalin · April 2019

Reistr_the_Unbroken wrote: »

ryzen_gamer_gal wrote: »

One more try.

The legal argument will come down to who is and isnt a natural person.

Your named character isnt a natural person.

Even though you may qualify as a natural person (or who knows, maybe legally you dont qualify)

See the real problem now?

Well see here, the the named character is possibly still under a console username or email address soooo...

Which are inaccessible except to those you give access via the guild membership system used on that site, if you never join the site you’ll never have your @ name attached to the characters