Steam Privacy Policy

This document governs Valve Corporation's collection, processing, storage, and sharing of personal data across the Steam platform and associated services, asserting legal bases including contractual necessity, legal obligation, legitimate interests, and user consent consistent with GDPR Article 6 framing. The policy states that Valve collects a broad range of data categories including account credentials, payment information, device identifiers, game statistics, playtime, browser and behavioral tracking data, chat communications, and voice data from Steam's communication features, and the terms authorize sharing this data with Valve group companies, third-party game developers, payment processors, and other service partners. Notably, the policy discloses collection of hardware survey data and voice data from Steam communication features, asserts the right to process anonymized aggregated data and share it with third parties without restriction, and permits behavioral tracking across Steam websites and applications for marketing and analytics purposes, though several of these asserted rights may be constrained by GDPR, UK GDPR, or CCPA requirements depending on the legal basis applied. The policy expressly engages GDPR, UK GDPR, CCPA, and the EU-U.S. Data Privacy Framework, and Valve certifies adherence to the DPF Principles, which govern in case of conflict with this policy; EU and UK users hold specific rights including access, rectification, erasure, and objection, while California residents are entitled to CCPA disclosure and opt-out rights. Material compliance considerations include ensuring adequate legal bases for each processing activity, verifying that third-party data sharing arrangements meet applicable transfer mechanism requirements, and confirming that consent mechanisms for optional cookies and marketing communications meet applicable standards.