Valve has self-certified under the EU-U.S. Data Privacy Framework, which is one of the approved legal mechanisms for transferring personal data from the EU, UK, and Switzerland to the U.S.; if this policy conflicts with those Framework Principles, the Principles take precedence.
This analysis describes what Steam's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
EU, UK, and Swiss users' data transferred to the U.S. is covered by the DPF certification, and the Principles supersede this policy in cases of conflict, providing a meaningful legal backstop for cross-border data transfers.
Severity downgraded from medium to low, indicating reduced priority classification for DPF compliance disclosure.
View full change record →EU, UK, and Swiss Steam users have their personal data transferred to the U.S. under Valve's DPF certification, which provides enforceable privacy protections through the U.S. Department of Commerce and FTC. This is a more protective transfer mechanism than standard contractual clauses alone, though the DPF's long-term legal stability has been subject to ongoing political and legal developments.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Valve and its subsidiary TR Technical Inc. comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Valve has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.Excerpt from Steam's Privacy Policy
(1) REGULATORY LANDSCAPE: The EU-U.S.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
EU, UK, and Swiss users' data transferred to the U.S. is covered by the DPF certification, and the Principles supersede this policy in cases of conflict, providing a meaningful legal backstop for cross-border data transfers.
EU, UK, and Swiss Steam users have their personal data transferred to the U.S. under Valve's DPF certification, which provides enforceable privacy protections through the U.S. Department of Commerce and FTC. This is a more protective transfer mechanism than standard contractual clauses alone, though the DPF's long-term legal stability has been subject to ongoing political and legal developments.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Steam.