Users allege that Epic's launcher collects your Steam data, Valve and Epic respond to claims
Securing exclusive titles, being yet another entry in the repertoire of PC gaming launchers, and lacking storefront options has had the newly formed Epic Games Store in a state of constant controversy ever since the day it was announced. The latest issue gamers have with the Epic Launcher is a little different this time, however, as multiple posts on various sites have claimed that the Epic Launcher collects user data, Steam data, specifically. One user in particular, called Madjoki, alleged that the Epic looks for Steam data, and if found, it copies a file called localconfig.vdf, and uses it to track what games players have installed from Steam, and your friends list stored in the Steam Cloud.
I tried to replicate those and found out that Epic Games Launcher on start up searches for Steam install
and proceeds to get list of files in your Steam Cloud (this includes mostly game saves for every user that has logged in on your PC)
Steam Cloud is stored under userdata\[account id]\ if you wanna check
It will also create encrypted copy of config\localconfig.vdf.
This file contains your steam friends, their name history (groups you're part of, are considered "friends").
It seems friends might be used for friends suggestions, but I don't even use that feature and it collects more than that.
While it's called "localhistory" it is synced from cloud
It will read, encrypt and then write copy to: C:\ProgramData\Epic\SocialBackup\RANDOM HEX CODE_STEAM ACCOUNT ID.bak
It will also keep historical entries there.
Once the claims gained enough traction, Epic Games eventually responded, stating that any form of tracking is merely used to monitor data for the company's Support-a-Creator program, which is outlined in the private policy when making an account. Epic's VP in engineering, Daniel Vogel, stated the following on Reddit when addressing customer concerns.
We use a tracking pixel (tracking.js) for our Support-A-Creator program so we can pay creators. We also track page statistics.
The launcher sends a hardware survey (CPU, GPU, and the like) at a regular interval as outlined in our privacy policy (see the “Information We Collect or Receive” section). You can find the code here.
The UDP traffic highlighted in this post is a launcher feature for communication with the Unreal Editor. The source of the underlying system is available on github.
The launcher scans your active processes to prevent updating games that are currently running. This information is not sent to Epic.
In regards to accessing Steam's localconfig.vcf file, the CEO of Epic Games, Tim Sweeney, admits that the launcher does indeed access the file without user permission, but followed that statement up with saying that the data is only actually sent to Epic if one actively chooses to import their Steam friends list. In the same post, he also said that this would be fixed in a future update.
You guys are right that we ought to only access the localconfig.vdf file after the user chooses to import Steam friends. The current implementation is a remnant left over from our rush to implement social features in the early days of Fortnite. It's actually my fault for pushing the launcher team to support it super quickly and then identifying that we had to change it. Since this issue came to the forefront we're going to fix it.
We don't use the Steam API because we work to minimize the number of third-party libraries we include in our products due to security and privacy concerns (not from Valve specifically, but see e.g. https://www.macrumors.com/2019/02/22/ios-apps-sending-private-data-to-facebook/ for the general concern of APIs collecting more data than expected)
Valve also stepped into the fray, commenting that they would be looking into the matter, and that private data relating to Steam users should not ever be used by other software.
We are looking into what information the Epic launcher collects from Steam.
The Steam Client locally saves data such as the list of games you own, your friends list and saved login tokens (similar to information stored in web browser cookies). This is private user data, stored on the user's home machine and is not intended to be used by other programs or uploaded to any 3rd party service.
Interested users can find localconfig.vdf and other Steam configuration files in their Steam Client’s installation directory and open them in a text editor to see what data is contained in these files. They can also view all data related to their Steam account at: https://help.steampowered.com/en/accountdata.
What do you think about this? Does this affect if you'll use the Epic Games Launcher, do you not mind, or are you already convinced on never using the program for your PC gaming needs?
Source