Steam reviews tell you if a game is worth playing, or worth passing on. Sometimes, they tell you if the code could expose your identity. Privacy shouldn’t depend on a streamer spotting a security issue before their audience buys the game and stumbles into the issue. Developers have a responsibility to ensure their game handles user data responsibly and disclose if any data has been acquired from the user’s system. This article takes a peek into what players can check for and what developers should be mindful of for the games we all play.

1. Check and see if the game has a data disclosure.

Games tend to say something along the lines of: These features are used solely for in-game purposes. No personal data is collected, transmitted or stored. This does not mean that data is not read and utilized in game.

One early example is Metal Gear Solid V, where it asks for your name and birthday. Konami, to their credit, responds quickly with: “While the information is used in-game, it is not visible to other players. *Of course, this may not be the case if you are livestreaming or otherwise sharing your gameplay. Once input, this information can’t be changed. There are no particular restrictions with regard to the name you input. Your birthday need not be your actual birthday.” 1

By acknowledging that this asks for sensitive info, being a name and a birthday, yet including it may not be the case of livestreaming, Konami does a wonderful job explaining how and where the info is used, and that livestreaming the game with the info being accurate and truthful may make the information visible to people other than the player.
While input data is one way to dox yourself on accident, there are some games where bugs can dox you as well. Marvel's Avengers had an early bug in 2021 for PS5 streamers, where console usernames and IP addresses could be seen on screen. 2 3 While the hotfix was done quickly, appearing to be within about 24 hours of the bug being noticed, at the time, it was only confirmed for PS5 players, and later confirmed to be isolated to PS5 consoles. It is important to note that the game was in Early Access at the time of the bug, showing the game was not in a completed state. It is possible that because the game was in Early Access, an internal testing version of the game was released, which is primarily used in Quality Assurance (QA) testing. Regardless, if you see text that is normally not in gameplay, it is something to keep in mind and investigate before streaming, to help prevent your information being potentially doxxed or public without meaning for it to be so.

2. Check reviews to see if there is any information used from your system.

While a data disclosure can do a lot of good, sometimes, there just isn’t one present. Another good place to check, would be the reviews. Reviews, while a double-edged sword telling both the good and the bad about the game, can reveal quite a bit about the amount of data that a game utilizes or collects. Our example is Backseat: a game about being a taxi driver with a psychological horror element where you have to survive each ride to save your kidnapped spouse. On the first glance, the game seems like your standard horror game, fantastic for a quick stream, or even a long one. When we look at the reviews however, there are several mentions that the game accesses your name and your friend’s list. Your friend’s list is from steam, however, your name is from your computer’s Window’s profile. There is no mention of this occurring anywhere inside or outside of the game; There is also no mention of it on the Steam page. I had to go to the developer to ask that after one of our stream collective members found out about it on stream.

The name issue: In the game “Backseat,” it was something I did to break the fourth wall and provide players with a more exciting experience. Actually, that name is pulled from your computer’s Windows name. No data is recorded or stored on servers, etc.—the game isn’t online and doesn’t connect to the internet. Creating a .txt file on the desktop: All games create .txt and JSON files on your computer to store save data, your selections, logs, etc. To break the fourth wall, we created one of these on your desktop; our goal was to build suspense by using a common game mechanic in a different way. [...] I’ll get the update ready and publish it today to remove that mechanic.

We appreciate the developer for acknowledging the issue, and love to see the commitment to protecting people who may choose to stream the game. They were not aware how big of an issue it was, and once given information on how damaging it could be to someone streaming their game, was prompt to mention that it would be removed on an upcoming patch. We love to see developers use something like this as a learning opportunity!

3. Checking Privacy Controls

Games often need to collect personal information for access, sometimes even going so far as requiring an account to be made with the developer. It’s not a bad idea to have a gaming only email where your gaming accounts are tied to instead of a main personal or streaming account, so if someone emails that address, you know it has been leaked somewhere. Each game also is dependent on what they offer and what they collect. It’s recommended to check the settings before you start playing a game on stream, to see if there is a privacy data collection link that explains how and what data is collected, or to see if there is a box that might be automatically marked that the developer collects certain analytic data about the game should it encounter a bug or crash. Please keep in mind that in some countries, it is required to have a pop-up asking if data can be collected with a yes or no button available for players to opt out of data collection. Personal information usually also requires consent in many countries, such as Canada, believing that children under the age of 13 can’t provide valid consent and ask that a parental figure consent for the child, then also have the option to control their child’s access to content, the ability to chat with other accounts, and how personal information is shared. 4 One thing to look at is a privacy policy if one is available (it should be!) for the game you are playing if you have any concerns about your data being used incorrectly. You should look for the following: a contact person, what is collected, how is it used, if the information will be disclosed to third-parties, how long the info will be kept, how to access the information the company has on you, and how to make an access request and remove said information.

4. Check the security of the third party tools

Some games, usually MMORPGS (massive multiplayer online role-playing games) use player-made tools, be it corp dashboards, to timers for guilds, as well as even planning manufacturing builds for spaceships and logistics purposes. The game itself is optimized by the use of some of these tools, and while we will not be looking at the game security: it must be said that some third party tools can be used to bypass EULA, and we here at Probably a Game do not support breaking any EULA or ruining the magic of MMORPGS.
Some tools can take the form of third-party websites, even without a log in. The site could be for fun, yet hide a malicious secret: trying to use active current sessions to gather information to help the opposing side in a fight. This is where it is a good idea to take a look at who owns the tool you are looking to use. Is it open source where you can look at the coding? Is it unpublished? Is it from a trusted source, or is it from someone relatively unknown? Doing a thorough security check of third party API tools is highly recommended, to ensure account security. 5

From all of this to say: As a streamer, there are a ton of tools and pieces to remember in your security while livestreaming or creating content videos, however it’s up to you to follow through with the using of these mechanics and tools for your streams.