Riot transfers your personal data to other countries, including the US, and uses Standard Contractual Clauses (SCCs) as the legal mechanism to authorize transfers out of the EU.
This analysis describes what Riot Games's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Data transferred internationally may be subject to different legal protections. The use of SCCs is a recognized GDPR transfer mechanism, but transfers to the US remain subject to ongoing legal scrutiny following the Schrems II ruling and evolving EU-US data privacy framework developments.
Interpretive note: The notice references SCCs as the transfer mechanism but does not confirm whether Transfer Impact Assessments have been conducted, which is a requirement in some circumstances under EDPB guidance following Schrems II.
Riot Games has restructured how it presents information about data collection and use in its privacy notice. The company narrowed its third-party disclaimer by removing the phrase 'we don't own or control,' replacing it with 'we don't control'—a distinction that may affect which entities the company is claiming it has no privacy responsibility for. For California residents, the notice now consolidates information about categories of personal information and their purposes into a single section rather than splitting them across the document. The practical implication depends on how Riot Games operationally interprets 'control' in relation to its business relationships and how California regulators view this language under CCPA notice requirements.
View change record →Your personal data may be processed in countries with weaker data protection laws than your own. EU users should be aware that while Riot uses SCCs as a transfer mechanism, the practical protections available in destination countries may differ from EU standards.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Your personal data may be transferred to and processed in countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country. We have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. These safeguards include implementing the European Commission's Standard Contractual Clauses for transfers of personal data between Riot entities and to our third-party service providers and partners.Excerpt from Riot Games's Privacy Notice
REGULATORY LANDSCAPE: GDPR Chapter V governs international transfers of personal data from the EU/EEA.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Data transferred internationally may be subject to different legal protections. The use of SCCs is a recognized GDPR transfer mechanism, but transfers to the US remain subject to ongoing legal scrutiny following the Schrems II ruling and evolving EU-US data privacy framework developments.
Your personal data may be processed in countries with weaker data protection laws than your own. EU users should be aware that while Riot uses SCCs as a transfer mechanism, the practical protections available in destination countries may differ from EU standards.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Riot Games.