Epic shares and receives user data with gaming console operators like PlayStation and Xbox, and with advertising companies, as part of running its services and marketing campaigns.
This analysis describes what Unreal Engine's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Data flows to and from gaming console operators and advertising networks mean that your activity across multiple platforms is connected, and the third parties involved have their own privacy practices that Epic does not control.
Your gaming account data, device information, and advertising interaction data may flow between Epic and companies like Sony, Microsoft, Nintendo, and advertising platforms, with each party's own privacy practices governing how they use that data on their end.
How other platforms handle this
We may share your information with third-party vendors and service providers that perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance. We may also share your information with third-party advertising p...
We may share your personal information with third parties in the following circumstances: With service providers who perform services on our behalf, such as data analytics, marketing, customer service, and technology services. With financial partners, including banks, brokerage firms, and payment pr...
Sending you information about Adobe products and services, special offers and similar information, and sharing your information with third parties for their own marketing purposes, where your consent is not required; In some cases, in order to show you more relevant ads, we disclose with social medi...
Monitoring
Unreal Engine has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you buy, download, or access our games through third-party gaming consoles (e.g., PlayStation®, Microsoft Xbox, and Nintendo Switch), we may receive information from those consoles (e.g., your third-party display name, user ID, device information, and country) to facilitate gameplay, track your progression and entitlements, and support your use of the Epic Services. When you interact with an ad for the Epic Services on a third-party website or service, we may receive related information from the company operating that website or service.— Excerpt from Unreal Engine's Epic Games Privacy Policy
REGULATORY LANDSCAPE: Outbound data sharing with gaming console operators and advertising companies may constitute disclosure of personal information under GDPR Article 4(2) requiring documented legal bases, and may constitute 'sharing' of personal information for cross-context behavioral advertising under CCPA/CPRA, triggering opt-out rights. The FTC Act applies to the adequacy of disclosure regarding these data flows. If advertising data flows involve precise geolocation, financial data, or data from minors, heightened restrictions apply under CCPA/CPRA and COPPA. GOVERNANCE EXPOSURE: Medium. Third-party data sharing with major gaming platform operators is standard in the industry and is operationally necessary for cross-platform gameplay. The advertising data flow is more sensitive, particularly regarding whether sharing behavioral or device data with advertising partners constitutes a 'sale' or 'sharing' under CCPA/CPRA, which would require a clearly accessible opt-out mechanism. JURISDICTION FLAGS: California (CCPA/CPRA 'sharing' for cross-context behavioral advertising), EU/EEA (GDPR data transfer and joint controller or processor agreements), United Kingdom (UK GDPR). Any data sharing involving children's information triggers COPPA obligations for the US and equivalent national children's data protection laws globally. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with gaming console operators must clearly define the purpose, scope, and limitations of data flows. If console operators act as independent controllers rather than processors, the policy should reflect that and direct users to the console operators' own privacy notices. Advertising network agreements must address CCPA opt-out obligations and GDPR processing basis documentation. COMPLIANCE CONSIDERATIONS: Compliance teams should (1) audit all active data sharing arrangements with gaming console operators and advertising partners to confirm appropriate contractual instruments are in place; (2) assess whether advertising data flows constitute CCPA 'sharing' and implement opt-out mechanisms if required; (3) ensure that children's data is not included in advertising data flows; and (4) review GDPR Chapter V transfer mechanisms for any data sharing with entities outside the EEA.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Data flows to and from gaming console operators and advertising networks mean that your activity across multiple platforms is connected, and the third parties involved have their own privacy practices that Epic does not control.
Your gaming account data, device information, and advertising interaction data may flow between Epic and companies like Sony, Microsoft, Nintendo, and advertising platforms, with each party's own privacy practices governing how they use that data on their end.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Unreal Engine.