Users allege that Epic's launcher collects your Steam data, Valve and Epic respond to claims

epic-games-902x507.jpg

Securing exclusive titles, being yet another entry in the repertoire of PC gaming launchers, and lacking storefront options has had the newly formed Epic Games Store in a state of constant controversy ever since the day it was announced. The latest issue gamers have with the Epic Launcher is a little different this time, however, as multiple posts on various sites have claimed that the Epic Launcher collects user data, Steam data, specifically. One user in particular, called Madjoki, alleged that the Epic looks for Steam data, and if found, it copies a file called localconfig.vdf, and uses it to track what games players have installed from Steam, and your friends list stored in the Steam Cloud.

I tried to replicate those and found out that Epic Games Launcher on start up searches for Steam install
and proceeds to get list of files in your Steam Cloud (this includes mostly game saves for every user that has logged in on your PC)

Steam Cloud is stored under userdata\[account id]\ if you wanna check

It will also create encrypted copy of config\localconfig.vdf.
This file contains your steam friends, their name history (groups you're part of, are considered "friends").

It seems friends might be used for friends suggestions, but I don't even use that feature and it collects more than that.

While it's called "localhistory" it is synced from cloud

It will read, encrypt and then write copy to: C:\ProgramData\Epic\SocialBackup\RANDOM HEX CODE_STEAM ACCOUNT ID.bak
It will also keep historical entries there.

Once the claims gained enough traction, Epic Games eventually responded, stating that any form of tracking is merely used to monitor data for the company's Support-a-Creator program, which is outlined in the private policy when making an account. Epic's VP in engineering, Daniel Vogel, stated the following on Reddit when addressing customer concerns.

We use a tracking pixel (tracking.js) for our Support-A-Creator program so we can pay creators. We also track page statistics.

The launcher sends a hardware survey (CPU, GPU, and the like) at a regular interval as outlined in our privacy policy (see the “Information We Collect or Receive” section). You can find the code here.

The UDP traffic highlighted in this post is a launcher feature for communication with the Unreal Editor. The source of the underlying system is available on github.

The launcher scans your active processes to prevent updating games that are currently running. This information is not sent to Epic.

In regards to accessing Steam's localconfig.vcf file, the CEO of Epic Games, Tim Sweeney, admits that the launcher does indeed access the file without user permission, but followed that statement up with saying that the data is only actually sent to Epic if one actively chooses to import their Steam friends list. In the same post, he also said that this would be fixed in a future update.

You guys are right that we ought to only access the localconfig.vdf file after the user chooses to import Steam friends. The current implementation is a remnant left over from our rush to implement social features in the early days of Fortnite. It's actually my fault for pushing the launcher team to support it super quickly and then identifying that we had to change it. Since this issue came to the forefront we're going to fix it.

We don't use the Steam API because we work to minimize the number of third-party libraries we include in our products due to security and privacy concerns (not from Valve specifically, but see e.g. https://www.macrumors.com/2019/02/22/ios-apps-sending-private-data-to-facebook/ for the general concern of APIs collecting more data than expected)

Valve also stepped into the fray, commenting that they would be looking into the matter, and that private data relating to Steam users should not ever be used by other software.

We are looking into what information the Epic launcher collects from Steam.

The Steam Client locally saves data such as the list of games you own, your friends list and saved login tokens (similar to information stored in web browser cookies). This is private user data, stored on the user's home machine and is not intended to be used by other programs or uploaded to any 3rd party service.

Interested users can find localconfig.vdf and other Steam configuration files in their Steam Client’s installation directory and open them in a text editor to see what data is contained in these files. They can also view all data related to their Steam account at: https://help.steampowered.com/en/accountdata.

What do you think about this? Does this affect if you'll use the Epic Games Launcher, do you not mind, or are you already convinced on never using the program for your PC gaming needs?

:arrow: Source
 

SapphireExile

Sapphire
Member
Joined
May 2, 2018
Messages
115
Trophies
0
Age
28
Location
Bartow, FL
Website
sapphirelabs.online
XP
490
Country
United States
So many people instantly jumping on the bandwagon.
Check the file yourself. It contains nothing that isn't already public data.

Sure, they could have used the Steam API. They could have also requested such data outright.

But bashing the company just because they collect data from another service specifically for the purpose to allowing you to add your friends from Steam is a bit stupid.

No hate for the Twitch client? The old Curse? Tukui? Battlenet? Uplay?

People need to get their priorities straight.
 

the_randomizer

The Temp's official fox whisperer
Member
Joined
Apr 29, 2011
Messages
31,284
Trophies
2
Age
38
Location
Dr. Wahwee's castle
XP
18,969
Country
United States
So many people instantly jumping on the bandwagon.
Check the file yourself. It contains nothing that isn't already public data.

Sure, they could have used the Steam API. They could have also requested such data outright.

But bashing the company just because they collect data from another service specifically for the purpose to allowing you to add your friends from Steam is a bit stupid.

No hate for the Twitch client? The old Curse? Tukui? Battlenet? Uplay?

People need to get their priorities straight.

Maybe if Epic wasn't so damn stupid about how they implemented it, it would be different. They should learn to not program in such a shitty manner.
 

Kioku

猫。子猫です!
Member
Joined
Jun 24, 2007
Messages
12,003
Trophies
3
Location
In the Murderbox!
Website
www.twitch.tv
XP
16,124
Country
United States
So many people instantly jumping on the bandwagon.
Check the file yourself. It contains nothing that isn't already public data.

Sure, they could have used the Steam API. They could have also requested such data outright.

But bashing the company just because they collect data from another service specifically for the purpose to allowing you to add your friends from Steam is a bit stupid.

No hate for the Twitch client? The old Curse? Tukui? Battlenet? Uplay?

People need to get their priorities straight.
Maybe if they openly informed the user of the collection? The other platforms you (should) now what they're collecting and when. Especially Twitch... Where you willingly link your profiles. At this point, the issue isn't them collecting it. It's how they're trying to justify it and practically lie about it. I doubt they don't have the information they're receiving, whether they have explicit permission or not.
 
Last edited by Kioku,

Captain_N

Well-Known Member
Member
Joined
Mar 29, 2010
Messages
1,903
Trophies
2
XP
2,014
Country
United States
Also love this: Purchase a Game from Steam. Next thing you know, depending on the Game, you get ANOTHER Steam-Like App on your PC that you need to Sign-Up for in order to Play the Game you just Purchased :angry:

Game in Question: Trials Rising
Steam-Like App it Installs: UPlay

UPlay will want ask to Link your Facebook, Twitter, Steam, you name it. If you Uninstall UPlay, you can not run the Game, which is BS!

This is why i dont mess with steam,Uplay,epic or any others. I dont do online protections. If a game has it ill play the hacked version or i dont play it. the companies cant wait till its all streamed. then they have 100% control.
 
  • Like
Reactions: Smoker1 and tbb043

bi388

Well-Known Member
Member
Joined
May 29, 2015
Messages
1,086
Trophies
0
Age
26
XP
1,256
Country
United States
This is why i dont mess with steam,Uplay,epic or any others. I dont do online protections. If a game has it ill play the hacked version or i dont play it. the companies cant wait till its all streamed. then they have 100% control.
Buy gog versions when you can, theyre always 100% drm free, and their launcher is completely optional
 

Kioku

猫。子猫です!
Member
Joined
Jun 24, 2007
Messages
12,003
Trophies
3
Location
In the Murderbox!
Website
www.twitch.tv
XP
16,124
Country
United States
Buy gog versions when you can, theyre always 100% drm free, and their launcher is completely optional
If every game dev went GOG, that'd be the end of the business world as we know it. All the customers would be happy, though.
 
  • Like
Reactions: Patxinco

kuwanger

Well-Known Member
Member
Joined
Jul 26, 2006
Messages
1,510
Trophies
0
XP
1,783
Country
United States
If you Uninstall UPlay, you can not run the Game, which is BS!

One could say the same for Origin, Steam, etc. I don't know if Twitch Launcher or Epic Launcher* has the same limitation. I do know both will, by default, creating shortcuts pointing to their launcher and not the game files. The first thing I do is fix that, as I do not have nor want either launcher running 99% of the time. I'd actually love to see this whole mess parlayed into #uninstall_and_play or similar to see all these game stores move towards a mostly DRM free setup. Long term, I don't trust any of them, including Valve.

We pay for the games on the respective platform and a cut of the profit goes to the platform and that cash is supposed to be used for the platform.

I've bought zero games for Uplay or Epic Launcher yet have a few or several. I incidentally (Amazon Prime) have games with Twitch Launcher. I've bought one bundle of games that had some Origin exclusives, but most my games were "On the house". Basically, I have little to no interest in funding any store front than GoG or Steam, and I'd be perfectly happy if larger players could push Steam harder to give fairer cuts across the board--the same with Google, Apple, etc.

My point is, at least for the moment I guess I paid Epic with my data, so I'm not entirely upset about this. This is probably all that Epic is going to get out of me.

* I know at least for Epic that Axiom Verge and Slime Rancher were both DRM free, as I was able to copy and use them on my Linux machine under Steam's Proton. And the absurdity of course is that Axiom Verge and Slime Rancher both have Linux versions.
 
Last edited by kuwanger,

Burlsol

Well-Known Member
Member
Joined
Nov 7, 2015
Messages
113
Trophies
0
XP
752
Country
Also love this: Purchase a Game from Steam. Next thing you know, depending on the Game, you get ANOTHER Steam-Like App on your PC that you need to Sign-Up for in order to Play the Game you just Purchased :angry:

Game in Question: Trials Rising
Steam-Like App it Installs: UPlay

UPlay will want ask to Link your Facebook, Twitter, Steam, you name it. If you Uninstall UPlay, you can not run the Game, which is BS!
Pretty much this. We already had our time to bitch about this when Ubisoft and EA started moving everything to their storefronts. Too little outcry too late.
 

Xzi

Time to fly, 621
Member
Joined
Dec 26, 2013
Messages
17,735
Trophies
3
Location
The Lands Between
Website
gbatemp.net
XP
8,524
Country
United States
Pretty much this. We already had our time to bitch about this when Ubisoft and EA started moving everything to their storefronts. Too little outcry too late.
Not really, UPlay is actually a much better solution because it doesn't force you to start a whole new library on a whole new launcher. If Epic had taken that route and continued to offer their games on Steam in addition to offering them through their own launcher, that would make them a far more appealing option.

This is ultimately a separate issue from gathering data without consent, though.
 
Last edited by Xzi,

jt_1258

Ella
Member
Joined
Aug 21, 2016
Messages
3,053
Trophies
2
Age
24
XP
4,866
Country
United States
One could say the same for Origin, Steam, etc. I don't know if Twitch Launcher or Epic Launcher* has the same limitation. I do know both will, by default, creating shortcuts pointing to their launcher and not the game files. The first thing I do is fix that, as I do not have nor want either launcher running 99% of the time. I'd actually love to see this whole mess parlayed into #uninstall_and_play or similar to see all these game stores move towards a mostly DRM free setup. Long term, I don't trust any of them, including Valve.



I've bought zero games for Uplay or Epic Launcher yet have a few or several. I incidentally (Amazon Prime) have games with Twitch Launcher. I've bought one bundle of games that had some Origin exclusives, but most my games were "On the house". Basically, I have little to no interest in funding any store front than GoG or Steam, and I'd be perfectly happy if larger players could push Steam harder to give fairer cuts across the board--the same with Google, Apple, etc.

My point is, at least for the moment I guess I paid Epic with my data, so I'm not entirely upset about this. This is probably all that Epic is going to get out of me.

* I know at least for Epic that Axiom Verge and Slime Rancher were both DRM free, as I was able to copy and use them on my Linux machine under Steam's Proton. And the absurdity of course is that Axiom Verge and Slime Rancher both have Linux versions.
How can you just be happy with it....it makes no sense. Sure, if they took the info from what you provided to them then maybe but they are stealing info from other applications now. This is beyond it's own bounds now to the point where it's like spyware that trys to steal your passwords and credit card info. Why is something like that acceptable.
 
  • Like
Reactions: Deleted_413010

Taleweaver

Storywriter
Member
Joined
Dec 23, 2009
Messages
8,689
Trophies
2
Age
43
Location
Belgium
XP
8,083
Country
Belgium
I have to ask : is the OP updated at some point or are almost all people here too ignorant to read? :unsure:
I know... The statement will press people off, but it clearly states the following :

the data is only actually sent to Epic if one actively chooses to import their Steam friends list.

The way I see this, the situation is as follows :

Epic store : do you want to import your stream friends list?
User: yeah sure Whatever
...
User : hey... This thing accesses my already public steam data without my consent! :angry:
 

kuwanger

Well-Known Member
Member
Joined
Jul 26, 2006
Messages
1,510
Trophies
0
XP
1,783
Country
United States
How can you just be happy with it....it makes no sense. Sure, if they took the info from what you provided to them then maybe but they are stealing info from other applications now.

I never said I was happy about it. One thing I'm not happy about is the hardware survey. Annoyingly enough, you have to login with UE4 access to look at the code they point at. This could be used for unique iding, which is far from desirable. Having said that, I use my Wintendo for Epic Launcher, so I'm not entirely worried about this--mostly just annoyed. They also don't really address the issue of scraping Steam game save listings or how there's cloud syncing which copies your friends list. The major reason I don't care about these things? My Steam profile is already public--that's the norm if you do key trading--, so there's very little real new information they gather*.

This is beyond it's own bounds now to the point where it's like spyware that trys to steal your passwords and credit card info. Why is something like that acceptable.

Stealing passwords and/or credit card info would be entirely unacceptable. If it turns out they were searching for any of the above, then that would be grounds for lawsuits. The same with if Microsoft were caught doing similar. You see, we're already down the rabbit hole that is pervasive spying** as the norm. I don't like it. I don't actively support it. However, there's basically nothing I can do about it, so sadly I'm most complacent about it.

Oh, and as a point, I don't store my credit card information or "important" passwords on my Windows machines. Spyware is sadly too much the norm with Windows (even beyond Windows itself). That legitimate companies are now very much in the game? *sigh* I use Epic Launcher just long enough to get free games. I avoid Origin and UPlay. I do what I can to fight the corporate created mess. I guess what I'm saying is, I'm too tired of fighting it all off that this seems like a smaller offense.

* They gather a link between my IP address, possibly my email (I use Google to log in), and my Steam account. That's actually the worst offense.

** Google. My ISP (I presume). Facebook (even though I don't use Facebook). Windows (when I use it to play games). *sigh*
 

Minox

Thanks for the fish
Former Staff
Joined
Aug 27, 2007
Messages
6,995
Trophies
2
XP
6,155
Country
Japan
So many people instantly jumping on the bandwagon.
Check the file yourself. It contains nothing that isn't already public data.

Sure, they could have used the Steam API. They could have also requested such data outright.

But bashing the company just because they collect data from another service specifically for the purpose to allowing you to add your friends from Steam is a bit stupid.

No hate for the Twitch client? The old Curse? Tukui? Battlenet? Uplay?

People need to get their priorities straight.
That is just plain false. A private Steam profile reveals almost none of this data publicly and even if public you won't find detailed user information like this available online.
 

AkikoKumagara

The Coolest Bear Around
Member
Joined
Jan 4, 2017
Messages
1,534
Trophies
1
Website
thebearsden.web.fc2.com
XP
3,919
Country
United States
Just use the damn API, Epic. This is the exact kind of scenario it exists for. If I were worried about Valve mishandling my data, why on Earth would I have a Steam Account?

So many people instantly jumping on the bandwagon.
Check the file yourself. It contains nothing that isn't already public data.

Sure, they could have used the Steam API. They could have also requested such data outright.

But bashing the company just because they collect data from another service specifically for the purpose to allowing you to add your friends from Steam is a bit stupid.

No hate for the Twitch client? The old Curse? Tukui? Battlenet? Uplay?

People need to get their priorities straight.

It's collecting this file and uploading it to a server without making it apparent to the end user. I don't think that's right. It could be taking any file from your hard drive and I still think they're obligated to let the end user know.
 
Last edited by AkikoKumagara,
  • Like
Reactions: Deleted_413010

leon315

POWERLIFTER
Member
Joined
Nov 27, 2013
Messages
4,097
Trophies
2
Age
124
XP
4,075
Country
Italy
the prominent APEX is gaining an increasing fanbases, wonder if Origins do same shit as Epic???

--------------------- MERGED ---------------------------

I don't use programs made by the Chinese

--------------------- MERGED ---------------------------


That's called Capitalism
sir, that's dumb if you think you can escape from ''made in china''.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: Yeah forgot to turn that off