GDPR & Improved Data Security Worldwide

Riot·May 15, 2018·1 votes·10,332 views

Greetings summoners,

If you live in Europe, you may have heard about GDPR (General Data Protection Regulation). If not, here’s the tldr: The EU recently passed new data privacy laws that will require some changes to how companies like Riot store and manage your data.

So what do you need to know?

Not much will noticeably change for the majority of players, even within Europe.

On the backend, companies will add new processes and security to better protect your information, and you now have the ability to better control some of the ways companies handle your personal data (like requesting that a company remove personal data it has stored about you).

The changes are targeted to the European Union, but Riot is committed to maintaining player trust worldwide, so we’re taking this opportunity to assess and improve many of the ways we manage player information in all regions.

One of the ways GDPR seeks to better protect personal data is increasing the minimum age of consent to process personal data to 16 years old in many EU member states. It also allows member states to pass local laws to set the age of consent at a lower age -- which some have done -- as long as it isn’t lower than 13 years old. To help ensure we’re addressing these changes, we’re verifying that players are of the legal age (for their countries) by asking for parental permission first. More on that below.

How do I know if I am impacted by the age requirement changes?

If you are not in the EU and/or are over the age of 16, you will not be required to do anything and can play as normal.

If you are under 16 and in the EU, we may seek to get permission from your parent or guardian to play League of Legends. The age required varies from country to country, so check the player support article here to see what the requirements are for your location.

How will it work?

After May 25th, we’ll need to suspend accounts for players who fall under the legally required age for their region until parental permission is received.

If your account is one of those requiring parental permission, you will receive in-client warnings about a week before the changes go live. You will be directed to a website to unlock your account once that is available. If you are not impacted, you won’t see the notification and don’t need to take any further action.

Is there a place I can find out more about GDPR?

Yes, please check out the player support article for additional questions and answers.

11 Comments

Morning RavenMay 15, 20185 votes

As a whole, sounds fantastic. But how do you avoid kids making alternate accounts and lying about their ages?

ShivarusMay 15, 20183 votes

Kids lie about their ages all the time anyways, i think its outta riot's hands at that point

Fondling GemsMay 17, 20181 votes

Bit late, but when someone signs off on something saying that they are older than they are it is considered a voided contract. Because they can't legally sign off it is no longer a legally binding contract, meaning that if it becomes aware that they lied Riot is not responsible.

Like any company in that situation Riot is expected to stop providing the agreed on service (their LoL account) but the punishment is ultimately on the kid and is based on the laws of the area. Riot isn't expected to confirm the player's age, simply require the player to sign a legally binding contract which isn't a legal contract anymore if the player lied about their age.

Morning RavenMay 17, 20181 votes

That's good to know, but I don't see why that helps. Like, the kid can just continuously make new accounts as old ones get locked. Like how toxic players start smurfs when their account gets permabanned for toxicity.

Fondling GemsMay 17, 20181 votes

The point is that they still have to face legal repercussions. Riot isn't the one in charge of that, that is the EU government. Riot's only responsibility is making sure players sign the contract (which they are doing), and to remove access to the account if there is evidence that the contract has been voided. It is then up to the EU government to determine and deliver a punishment.

The removal of the account is not the punishment, it is simply the result of a voided contract.

Morning RavenMay 17, 20181 votes

Then Riot doesn't care if someone tries to lie. They don't need to find a way to reduce those chances as they will just keep themselves safe legally and avoid anything else on the client end. That makes more sense.

Fondling GemsMay 17, 20181 votes

Basically, but it also just isn't their job. That is the Eu gov's job. They don't expect any game company to do anything beyond follow the rules they put up.

midoriiMay 15, 20183 votes

Will these backend security changes still make it over to the NA server despite the current administration's zeal with destroying net neutrality?

We may not be EU residents but many of us still value and envy those same privacy rights our fellow Europeans care so much to protect, especially when our voices are ignored in our own country.

RiotRiot Ruin3dMay 15, 20187 votes

Our intention is to take this opportunity to improve data security for players worldwide not just in Europe. Your data is important to us and we want to do what we can to protect it in all regions.

DeathBurstMay 15, 20181 votes

Hmm, I get a 403 Error on that Support page (which is supposed to be the one about GDPR linked in the article): https://support.riotgames.com/hc/fr/articles/360001196228

midoriiMay 16, 20181 votes

Thanks for the clarification, and also, thanks for caring!