Steam Privacy Policy

This is Steam's privacy policy — the legal document explaining what personal information Valve collects when you use Steam, including your purchase history, game playtime, device identifiers, chat messages, IP address, and payment details. The most important thing to know is that Steam shares your data with a broad range of third parties including payment processors, advertising partners, anti-cheat services, and law enforcement, often without specific advance notice to you. You can manage cookie preferences and some data-sharing settings directly in your Steam account under Privacy Settings and Cookie Settings.

This document is Steam's (Valve Corporation) Privacy Policy governing the collection, processing, storage, and sharing of Personal Data from users of the Steam platform and associated services, with legal bases grounded in contractual necessity, legal obligation, legitimate interests, and consent as enumerated in GDPR Article 6. The policy creates obligations for Valve to collect only necessary data, respond to user rights requests (access, correction, deletion, portability, objection), and maintain DPF compliance for EU/UK/Swiss-to-US data transfers, while users implicitly consent to broad behavioral, device, tracking, and content-use data collection as a condition of platform use. Notable provisions include Valve's explicit reservation to share Personal Data with a wide network of third-party partners (payment processors, anti-cheat providers, advertising networks, platform partners) and law enforcement without individualized notice, as well as the retention of anonymous and aggregated data with no stated deletion timeline. The policy engages GDPR (EU) 2016/679, UK GDPR, CCPA (Cal. Civil Code §1798.100 et seq.), and the EU-U.S. Data Privacy Framework (DPF)/Swiss-U.S. DPF; material compliance considerations include the adequacy of DPF as a transfer mechanism post-Schrems II, the scope of legitimate interests processing, and CCPA rights fulfillment for California residents. Compliance teams should note that the policy's broad data sharing with unnamed third-party partners and the collection of device identifiers, crash data, behavioral tracking, and game statistics at scale may require updated data mapping and vendor agreements under GDPR Article 28 and CCPA service provider contracting requirements.