Steam shares both anonymous and aggregated data with third parties, and also collects personal data from your communications on the platform including forum posts, chats, and user-generated content.
Your aggregated usage data and communications on Steam (forums, chats, user content) are collected and can be shared with unspecified third parties, with the risk that 'anonymous' data could be re-identified when combined with other data sources.
Cross-platform context
See how other platforms handle Third-Party Data Sharing with Partners and Service Providers and similar clauses.
Compare across platforms →The broad grant to share anonymous and aggregated data with third parties — without limitation on who those parties are or what they do with the data — is a significant privacy concern, as 'anonymous' data from a gaming platform with hundreds of millions of users can potentially be re-identified.
REGULATORY FRAMEWORK: GDPR Art. 4(5) defines pseudonymization but notes that data capable of re-identification remains personal data subject to the full Regulation. The claim that aggregated/anonymous data does not allow identification is potentially contested under GDPR Recital 26, which requires assessing re-identification risk. CCPA §1798.140 applies similarly — 'deidentified' data requires reasonable measures to prevent re-identification (§1798.145(a)(5)). FTC Act Section 5 applies to deceptive anonymization claims.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.