Users allege that Epic's launcher collects your Steam data, Valve and Epic respond to claims

epic-games-902x507.jpg

Securing exclusive titles, being yet another entry in the repertoire of PC gaming launchers, and lacking storefront options has had the newly formed Epic Games Store in a state of constant controversy ever since the day it was announced. The latest issue gamers have with the Epic Launcher is a little different this time, however, as multiple posts on various sites have claimed that the Epic Launcher collects user data, Steam data, specifically. One user in particular, called Madjoki, alleged that the Epic looks for Steam data, and if found, it copies a file called localconfig.vdf, and uses it to track what games players have installed from Steam, and your friends list stored in the Steam Cloud.

I tried to replicate those and found out that Epic Games Launcher on start up searches for Steam install
and proceeds to get list of files in your Steam Cloud (this includes mostly game saves for every user that has logged in on your PC)

Steam Cloud is stored under userdata\[account id]\ if you wanna check

It will also create encrypted copy of config\localconfig.vdf.
This file contains your steam friends, their name history (groups you're part of, are considered "friends").

It seems friends might be used for friends suggestions, but I don't even use that feature and it collects more than that.

While it's called "localhistory" it is synced from cloud

It will read, encrypt and then write copy to: C:\ProgramData\Epic\SocialBackup\RANDOM HEX CODE_STEAM ACCOUNT ID.bak
It will also keep historical entries there.

Once the claims gained enough traction, Epic Games eventually responded, stating that any form of tracking is merely used to monitor data for the company's Support-a-Creator program, which is outlined in the private policy when making an account. Epic's VP in engineering, Daniel Vogel, stated the following on Reddit when addressing customer concerns.

We use a tracking pixel (tracking.js) for our Support-A-Creator program so we can pay creators. We also track page statistics.

The launcher sends a hardware survey (CPU, GPU, and the like) at a regular interval as outlined in our privacy policy (see the “Information We Collect or Receive” section). You can find the code here.

The UDP traffic highlighted in this post is a launcher feature for communication with the Unreal Editor. The source of the underlying system is available on github.

The launcher scans your active processes to prevent updating games that are currently running. This information is not sent to Epic.

In regards to accessing Steam's localconfig.vcf file, the CEO of Epic Games, Tim Sweeney, admits that the launcher does indeed access the file without user permission, but followed that statement up with saying that the data is only actually sent to Epic if one actively chooses to import their Steam friends list. In the same post, he also said that this would be fixed in a future update.

You guys are right that we ought to only access the localconfig.vdf file after the user chooses to import Steam friends. The current implementation is a remnant left over from our rush to implement social features in the early days of Fortnite. It's actually my fault for pushing the launcher team to support it super quickly and then identifying that we had to change it. Since this issue came to the forefront we're going to fix it.

We don't use the Steam API because we work to minimize the number of third-party libraries we include in our products due to security and privacy concerns (not from Valve specifically, but see e.g. https://www.macrumors.com/2019/02/22/ios-apps-sending-private-data-to-facebook/ for the general concern of APIs collecting more data than expected)

Valve also stepped into the fray, commenting that they would be looking into the matter, and that private data relating to Steam users should not ever be used by other software.

We are looking into what information the Epic launcher collects from Steam.

The Steam Client locally saves data such as the list of games you own, your friends list and saved login tokens (similar to information stored in web browser cookies). This is private user data, stored on the user's home machine and is not intended to be used by other programs or uploaded to any 3rd party service.

Interested users can find localconfig.vdf and other Steam configuration files in their Steam Client’s installation directory and open them in a text editor to see what data is contained in these files. They can also view all data related to their Steam account at: https://help.steampowered.com/en/accountdata.

What do you think about this? Does this affect if you'll use the Epic Games Launcher, do you not mind, or are you already convinced on never using the program for your PC gaming needs?

:arrow: Source
 

Smoker1

Well-Known Member
Member
Joined
Feb 17, 2015
Messages
5,045
Trophies
1
Location
California
XP
6,062
Country
United States
Also love this: Purchase a Game from Steam. Next thing you know, depending on the Game, you get ANOTHER Steam-Like App on your PC that you need to Sign-Up for in order to Play the Game you just Purchased :angry:

Game in Question: Trials Rising
Steam-Like App it Installs: UPlay

UPlay will want ask to Link your Facebook, Twitter, Steam, you name it. If you Uninstall UPlay, you can not run the Game, which is BS!
 

jt_1258

Ella
Member
Joined
Aug 21, 2016
Messages
3,053
Trophies
2
Age
24
XP
4,875
Country
United States
Our data/info is $$$, nothing is 100% free.
We pay for the games on the respective platform and a cut of the profit goes to the platform and that cash is supposed to be used for the platform. Ya, sure, information that we provide is sold which kind of feels horrible but think about the fact that they are outright stealing info from other applications now. Does a police officer being allowed to see your state id mean they can just snoop through the rest of the wallet and just take your debit card info just because he/she could?
 

kumikochan

Well-Known Member
Member
Joined
Feb 4, 2015
Messages
3,753
Trophies
0
Age
36
Location
Tongeren
XP
3,311
Country
Belgium
In europe this is actually illegal seeing it has to be stated specifically and the user has to accept or not accept that specifically. Facebook didn't do that in the past and had to show up in European parlament because of that
 

Dr.Hacknik

Ashley | Developer | Trans
Member
Joined
Mar 26, 2014
Messages
1,773
Trophies
1
Age
24
Location
inside your fridge
Website
dochacknik.keybase.pub
XP
2,219
Country
United States
Epic does realize they may get sued a shit ton by people, not just by Valve in damages and violating users privacy?


Whoever had the bright idea to collect this information is the dumbest person on the face of the planet, and should face jail time.
Shit like this isn't cool, and even Valve is waving their no-no finger.

You fucked up Epic, you fucked up big time!
 

the_randomizer

The Temp's official fox whisperer
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
It doesn't matter what their excuse is. The fact is that they've chosen to do this without the user knowing.

Total douche move on their part. Glad I never bought their games.

I hope they get their asses sued.
 
Last edited by the_randomizer,

Patxinco

Riding a Shooting Star
Member
Joined
Apr 18, 2011
Messages
847
Trophies
1
XP
2,232
Country
Spain
Having almost nonexisting time to play pc games, seeing this is wanting to get me back to my old physical CD games and disconnect so fast the ethernet cable of the pc i would break the port...
 
  • Like
Reactions: Ev1lbl0w

Dr.Hacknik

Ashley | Developer | Trans
Member
Joined
Mar 26, 2014
Messages
1,773
Trophies
1
Age
24
Location
inside your fridge
Website
dochacknik.keybase.pub
XP
2,219
Country
United States
Having almost nonexisting time to play pc games, seeing this is wanting to get me back to my old physical CD games and disconnect so fast the ethernet cable of the pc i would break the port...
I love owning a physical copy of a game. Whether that's for a console or for PC. Honestly, I hate having to download games. I don't mind downloading a game update, but waiting 2hrs for a 16GB game to download is pain overall. I'd rather pop in a BluRay Disc and call it a day. Not to mention not having to deal with shitty online store's and companies that dick with you every few months with some sort of drama.
 

Xzi

Time to fly, 621
Member
Joined
Dec 26, 2013
Messages
17,736
Trophies
3
Location
The Lands Between
Website
gbatemp.net
XP
8,534
Country
United States
The fact that it doesn't collect other user data, and instead goes straight after your Steam data is what concerns me most. You're not gonna convince me that you're gathering data on the competition for an innocuous purpose. It's also clear that Epic didn't want Valve knowing about this, or they would've used the upfront method and gone through Steam's API.
 

the_randomizer

The Temp's official fox whisperer
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
The fact that it doesn't collect other user data, and instead goes straight after your Steam data is what concerns me most. You're not gonna convince me that you're gathering data on the competition for an innocuous purpose. It's also clear that Epic didn't want Valve knowing about this, or they would've used the upfront method and gone through Steam's API.

What kind of stupid programmer was responsible for this. Epic fail much? Pretty sure there's gonna be repercussions from this.
 
  • Like
Reactions: Xzi

Shadowfied

Well-Known Member
Member
Joined
Dec 6, 2014
Messages
2,405
Trophies
1
Age
28
XP
3,666
Country
We don't use the Steam API because we work to minimize the number of third-party libraries we include in our products
How the fuck is consuming an API inherently using more third party libraries? Or is he actually tech illiterate enough to confuse an API and a library?
Even if he is dumb enough to confuse API and library, they have written code to explicitly copy, encrypt and extract data from a proprietary file format lmao

The Steam Client locally saves data such as the list of games you own, your friends list and saved login tokens
Not sure if its implied that the login tokens are specifically in the same file as what Epic collects, but if so, that's fucking rich coming from their statement of "the general concern of APIs collecting more data than expected". Not to mention, pretty sure fetching login tokens or cookies like that is probably illegal.
 
Last edited by Shadowfied,
  • Like
Reactions: CoolStarDood

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Maximumbeans @ Maximumbeans: butte