"Since this issue came to the forefront we're going to fix it"

Valve to investigate Epic’s use of Steam data after users raise privacy concerns

Valve has confirmed it is investigating what information the Epic Launcher is collecting from Valve’s online digital store client, Steam, after users claimed Epic was accessing and tracking Steam data without consent.

The issue began with a Reddit thread that accused the Epic Games Store of using a tracking pixel to access root certificates and DLLs without the user’s knowledge – claims later substantiated by PC Gamer.

"We are looking into what information the Epic launcher collects from Steam. The Steam Client locally saves data such as the list of games you own, your friends’ list and saved login tokens (similar to information stored in web browser cookies)," a Valve spokesperson told Bleeping Computer (thanks, GI.biz). "This is private user data, stored on the user’s home machine and is not intended to be used by other programs or uploaded to any 3rd party service."

Epic VP of engineering Daniel Vogel explained the issue was down to "a tracking pixel (tracking.js) [Epic uses] for [its] Support-A-Creator program so [it] can pay creators", and said the root certificate and cookies access was "a result of normal web browser start up". Subsequently, CEO Tim Sweeney, too, responded by acknowledging the issue and confirming a fix was on its way.

"You guys are right that we ought to only access the localconfig.vdf file after the user chooses to import Steam friends," Sweeney said on Reddit. "The current implementation is a remnant left over from our rush to implement social features in the early days of Fortnite. It’s actually my fault for pushing the launcher team to support it super quickly and then identifying that we had to change it. Since this issue came to the forefront we’re going to fix it.

"We don’t use the Steam API because we work to minimize the number of third-party libraries we include in our products due to security and privacy concerns."

In response to Valve statement, Epic responded with the following: "We’ve responded to in full here: https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_game_store_spyware_tracking_and_you/eijlbge/

"We only import your Steam friends with your explicit permission. The launcher makes an encrypted local copy of your localconfig.vdf Steam file. However information from this file is only sent to Epic if you choose to import your Steam friends, and then only hashed ids of your friends are sent and no other information from the file."

About Vikki Blake

It took 15 years of civil service monotony for Vikki to crack and switch to writing about games. She has since become an experienced reporter and critic working with a number of specialist and mainstream outlets in both the UK and beyond, including Eurogamer, GamesRadar+, IGN, MTV, and Variety.

Check Also

PEGI 20: Ian Rice on 20 years of PEGI ratings and why they remain relevant in an an increasingly digital marketplace

In the midst of celebrating 20 years of the PEGI ratings system at WASD x IGN, Ian Rice, director general of the Games Rating Authority, took some time out to answer our questions