10 Total
3 High severity
6 Medium severity
1 Low severity
Summary

This privacy notice establishes Riot Games' data collection and processing practices across its game and service portfolio, including League of Legends, Valorant, and related products. The notice authorizes collection of voice communications, in-game behavioral data, hardware identifiers, and approximate location information, with specified sharing of certain data categories to advertising partners for targeted marketing purposes. The document establishes data subject rights for EU, UK, and California residents, including access, deletion, and opt-out requests administered through Riot's privacy request portal.

Technical / Legal Breakdown

This document is Riot Games' global Privacy Notice, governing the collection, use, storage, and sharing of personal data across all Riot Games products and services, with stated legal bases including contractual necessity, legitimate interests, consent, and legal obligation depending on jurisdiction. The notice states that Riot collects a broad range of data categories including account information, payment data, device and hardware identifiers, gameplay and behavioral data, voice and text communications, and location information, and the terms authorize sharing this data with affiliates, service providers, advertising partners, and in connection with business transactions such as mergers or acquisitions. Notable provisions include the collection and potential recording of voice and text chat content for safety and moderation purposes, the use of anti-cheat software (Vanguard) that operates at a kernel level and collects hardware and software information, and the use of behavioral and gameplay data for targeted advertising, which together represent a meaningful scope of data collection that users may not fully anticipate. The notice engages GDPR for EU/EEA users (with Riot Games Ltd. identified as the data controller for those users), CCPA/CPRA for California residents, COPPA and equivalent frameworks for minors, and references compliance with LGPD for Brazilian users and PDPA for relevant Asian jurisdictions; the enforceability and scope of certain data practices may vary significantly by jurisdiction, particularly regarding children's data, advertising profiling, and communications monitoring.

Institutional Analysis

Institutional analysis available with Professional

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Start Professional free trial

3 important changes detected

4 versions captured · Last updated: May 2026

What changed Riot Games updated its privacy notice on May 6, 2026 to clarify that its U.S. entity is now called 'Riot Games U.S.' instead of 'Riot Games, Inc.' throughout the document. This is a naming clarification change that affects references to which company entity handles your data under the EU-U.S. Data Privacy Framework and related international data transfer rules. The substantive data protection commitments remain the same; this is primarily a corporate structure clarification.
Why this matters The updated privacy notice clarifies that Riot Games U.S. (formerly referred to as Riot Games, Inc.) is the entity responsible for handling your personal data under international data privacy frameworks, including the EU-U.S. Data Privacy Framework. This is a naming and entity clarification rather than a substantive change to data protection practices. The commitments to comply with Data Privacy Framework Principles and FTC regulatory oversight remain unchanged.
View full change record →
What changed Riot Games restructured its Privacy Notice on April 19, 2026, reorganizing how it describes data collection, use, and retention. The notice now consolidates sections, changes cross-references from section letters and numbers to a new numbering system, and clarifies that California residents can find both the categories of personal information collected and the purposes for their collection and use in a single location rather than across multiple sections. The core privacy practices do not appear to have fundamentally changed, but the organizational restructuring means consumers may need to navigate the updated layout to find specific information.
Why this matters Riot Games restructured how its Privacy Notice is organized, consolidating sections and updating internal cross-references. For California residents, the notice now explicitly states that both the categories of personal information collected and the purposes for collection and use can be found in a single section, improving clarity. The practical impact on what data Riot Games collects, uses, or retains does not appear to have changed; this is primarily an organizational and navigational update to the existing privacy disclosure.
View full change record →

April 14, 2026 medium

Riot Games reorganized and updated their privacy notice on April 14, 2026, consolidating sections and clarifying how personal information is collected and used. The main structural change combines collection and …

View change record →
High — 3 provisions
Medium — 6 provisions
Low — 1 provision

Monitoring

Riot Games has updated this document before.

Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.

Start Watcher free trial Or create a free account →

Professional Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Professional free trial

Cross-platform context

See how other platforms handle Children's and Minors' Data and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
COPPA
United States Federal
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
CAN-SPAM
United States Federal
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
VPPA
United States Federal
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured May 6, 2026 21:27 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000310
Version ID CA-V-002311
SHA-256 d1eadebcfb5952a54b0b6120d5a696464a0eb15d95197e75908a437f84480861
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans