Privacy penalty or breach
A privacy regulator's fine or order, or a breach of the company's systems that exposed players' data.
Players' personal data was handled badly enough for a regulator to act, or was taken from the company's own systems.
What it means
Games collect a lot of personal information: names, emails, payment details, voice chat, play habits and, on phones, location. This badge means the company was penalised for how it handled that data, or that its own systems were breached and player data exposed.
How we apply it
We add it for a fine, order or settlement from a privacy regulator (such as the US FTC, the UK ICO or an EU data protection authority), or a breach the company confirmed in which player data was taken from its systems. Accounts taken over with passwords stolen elsewhere (credential stuffing) go on the track record as events, not as a badge. Cases about children's data go under Child-safety enforcement.
Companies in the guide with it
- Sony Interactive Entertainment
UK Information Commissioner's Office fined Sony Computer Entertainment Europe £250,000 in January 2013 over the 2011 PlayStation Network hack; Sony dropped its appeal in July 2013.
Developer and publisher · United States · 1 game in the guide - Zynga
September 2019: Zynga confirmed that outside hackers had accessed certain player account information.
Developer and publisher · United States · 1 game in the guide