New lawsuit alleges Ubisoft illegally shares user data with Meta

Bloomberg Law reports Ubisoft is being sued for allegedly sharing player data from its titular store and Ubisoft+ subscription service with Meta.

In the suit, plaintiffs Trevor Lakes and Alex Rajjoub allege they learned of the data sharing when they individually bought or downloaded games from the developer’s website. During these instances, they were also logged into their respective Facebook accounts, which revealed key personal details like their names, jobs, and where they live.

Ubisoft’s website allows users to log in through different social accounts, including Facebook. Account linking is common, and it can show a user’s friends what games they are playing, or offer in-game incentives by developers.

The plaintiffs further claimed the French developer does not mention on its website that users will have their publicly identifiable information (PII) “captured by the Meta Platforms” via the Pixel tracking software it uses.

Doing so “thereby exposes the subscribers’ PII to any person of ordinary technical skill who received that data,” reads the complaint. It notes the software could not be on Ubisoft’s website, or placed on Facebook, without the developer’s direct action or “knowledge and cooperation.”

And by “compelling” a user’s browser to disclose website cookies and event data, it is alleged Ubisoft “knowingly discloses information sufficiently permitting an ordinary person to identify what video games a specific individual has purchased.”

The complaint also says Ubisoft and Meta’s alleged sharing is in violation of several acts, including the Video Privacy Protection Act (VPPA), which is meant to stop video rental companies from sharing PII without explicit user permission.

Along with monetary damages for everyone affected, the plaintiffs are calling for “injunctive relief” requiring [Ubisoft] to immediately remove the Pixel from the Website,” or seek (and gain) direct consent from users.

If neither can be achieved, they want Ubisoft to “anonymize video game titles in URLs, parameters, and metadata and/or hash PII Users’ Facebook user IDs (“FIDs”) in the Pixel transmissions.”

At time of writing, the lawsuit (which can be read in full here) has not reached class action certification. The plaintiffs are seeking a trial by jury.

Game Developer reached out to both Ubisoft and Meta for comment. Ubisoft said it “does not comment on legal matters,” and we will update with Meta’s response when it is given.