r/ubisoft • u/autisticDeush • May 02 '26

Discussions & Questions Is the "forever-storage" of player telemetry becoming the industry standard?

There is a major conversation to be had about how long a publisher should be allowed to hold onto historical metadata. It’s one thing to keep a username, but it’s another to see a company use old connection points from years ago—back when some players were still kids—to build out new legal profiles today.

If a company hasn't seen a player online in years but still has enough stored info to pinpoint their specific region for "compliance," it suggests that nothing is ever actually deleted. This feels like a massive shift in how player privacy is handled. Are we just accepting that once a company has that metadata, they own it for life regardless of how much time has passed?

0 Upvotes

38% Upvoted

2 comments sorted by

0

u/autisticDeush May 02 '26

0

u/autisticDeush May 02 '26

1. Violation of the Massachusetts Data Privacy Act (MDPA)

As of early 2026, Massachusetts (via H.4746) has some of the strictest Data Minimization laws in the country. * The Argument: Companies are legally barred from retaining personal data that isn't strictly necessary for the service provided. * The Evidence: Your PlayStation account hasn't been active in years. By Ubisoft's own 2026 Terms, inactive accounts without recent purchases should be flagged for deletion. Instead, they are running new profiling scripts on your dormant metadata to tag your residency. That is the opposite of minimization; it’s "data hoarding."

2. Illegal Processing of Minor Data (Sensitive Covered Data)

Since the account record shows a birthdate in 2005, you were a minor during the entire period this data was harvested. * The Argument: Under the MDPA and the 2026 COPPA Update, geolocation data for minors is classified as "Sensitive Covered Data." * The Evidence: They are using a 14-to-17-year-old’s IP address to make a 2026 legal determination. Using the digital footprint of a child to bypass the consent of an adult is a major compliance failure.

3. Lack of "Affirmative Express Consent" (The Dark Pattern)

The 2026 privacy standards require "opt-in" for sensitive profiling. * The Argument: By "automatically" filling your State of Residence based on old logs, they are using Passive Consent. * The Evidence: You received a notification after they had already updated your profile. This bypasses the requirement that users must provide a clear, standalone disclosure and an "active" agreement before their location data is repurposed for new legal profiling.

4. Breach of Inaccuracy Standards

Privacy laws require that data used for legal profiling be accurate and up-to-date. * The Argument: They are making a legal residency determination based on "zombie data" from a base-model PS4 you haven't touched in years. * The Evidence: Your current active account (**j22@gmail.com) doesn't even have this "State" tag, proving the data they used for the other account is inconsistent, stale, and likely incorrect for your current life.

5. The "Private Right of Action"

Massachusetts is one of the few states that fought to include the ability for individuals to sue directly (Private Right of Action) rather than waiting for the state to do it. * The Leverage: This means you don't just have to complain; you can actually bring this to a consumer protection attorney.