We outsmarted CSGO cheaters with IdentityLogger

> Wonderful, we have found a way to silently persist a cookie for each player as they join the server.

This violates GDPR, no?

Edit: It sounds like this took place before GDPR was being enforced.

GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/r...

Fraud prevention is listed as an example of a "legitimate interest."

So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprinting used solely for anti-cheat. They'd run into trouble if they use that same ID for marketing/advertising without consent, though.

They're perhaps not required to gather explicit opt-in consent, but my understanding is that they'd be required to disclose what information they collect/store.

The same rules apply to the steam ID and IP address.

As far as I'm aware, you can get away with disclosing the fact that you are tracking "unique identifiers for the purpose of anti-cheating" in the terms and conditions, without explicitly explaining the technical details that it's a cookie.

Also, this is a server covering the Australia/New Zealand region, so it doesn't have to worry about GDPR compliance.

>the fact that you are tracking "unique identifiers for the purpose of anti-cheating"

A person can requests to delete their data at any time, and also can request to provide all the personal data collected.

This does not apply to fraud. You can store the data if it is relevant to an illegal act, and since cheating voids the ToS of the server ...