Collecting user data

[Phil Steinmeyer]

So, as I look further into the issue of doing a global high scores table, it occurs to me that there's lots of other data I'd love to collect as well, beyond just the playername and score:

1) Some sort of unique identifier (GUID or IP or just a random key my game generates uniquely for the user's computer)

2) Play data (how much time/how many sessions they've had with the game. How much time they've spent with different minigames within the game)

3) Build version - Which version of the game are they using, and, if I know it, what portal did they download the game from?

4) PC Specs - what's their CPU speed, OS version, etc.

The question(s) are:

1) Do other games commonly use high score submissions as a way to collect other data, too?

2) Do I ethically/legally need to notify the user of what data I'm collecting, and if so, how should this notice be offered/provided?

3) Do the portals care one way or another about my data collection - either on behalf of their users, or just 'cause they don't want me getting any data on their customers (i.e. do they want a complete lockbox on the customer)?

Anybody?

[Savant]

I don't believe there are any legalities surrounding it, however, if word gets out that your game is sending information like PC specs back to the mothership (without asking the user if it's OK) it may get you labeled as SpyWare.

[Donavon Keithley]

2) Do I ethically/legally need to notify the user of what data I'm collecting, and if so, how should this notice be offered/provided?
Funnily enough I'm in the process of hiring a lawyer and asked essentially the same question during the initial consultations.

At this stage what they've told me is that if you're going to be collecting data, you want to have a clear, easily accessible privacy policy and you want to adhere to it as if it were a contract.

Also, watch out that you don't run afoul of COPPA -- the Children's Online Privacy Protection Act -- which requires parental approval before collecting certain kinds of information from kids under 13. It may very well not apply to you and to this kind of data, or it might. I'd check with a lawyer just to be safe.

[tonyw]

I'm collecting game version number and who it was, if they've registered. No pc specs or anything personal - though i like the idea :) What struct me when i wrote the code to do this was just how easy it would be to trawl around the HD and upload all sorts of info. You certainly don't need to be clever to write spyware, which explains why there's so much of it, i suppose.

tony

[David De Candia]

I think this is an excellent question. It's certainly right on topic for me, since I've been updating my global table this week.

I personally think that certain game-related data is fine. Num games played, Average FPS your game ran at, whether it was windowed/fullscreen, build version etc. I don't see anything particularly invasive in that.

It's where you draw the line that gets tricky. I need a unique identifier to enforce a one-world-score-per-player rule. That can be generated easily enough. But will this bother users?

In a perfect world, I'd also like to grab PC stats like OS version and CPU speed but have a feeling this could be one-step over that line - for me at least.

I wonder what others think about this? I would have thought there'd be more replies. Does silence imply guilt, I wonder, or is this just not an issue for people?

I'd particularly like an answer to:

3) Do the portals care one way or another about my data collection?

At the end of the day I liked what Donavon had to say. Better to be open and transparent on data collection issues.

[cliffski]

I don't think O/S version or CPU speed is crossing a line. you broadcast way more information than that to god whos-who everytime you launch your browser.
I think its only a privacy issue if you transmit information thats not related to how your game plays or what the hardware required to play it is. If you were to sniff out other processes running, or programs installed, thats unacceptable, but I can't see many people caring that you know they are on windows98.

[Donavon Keithley]

Some people won't like the idea of being "watched" as far as how and when they play the game. And associating a GUID with the computer might tweak the tin-hat types. (Remember the Intel serial number flap?)

[Phil Steinmeyer]

I notice that I can retrieve the IP of the computer talking to the server in my php script.

If I use the IP as a (semi)-unique identifier, how effective will that be? i.e. How many (separate) users will have either meaningless IPs (255.255.255.0), or be sharing the same IP? Conversely, how often will a user on the same PC have separate IPs every time they play the game ('cause their ISP assigns them a different IP every time they log in...)?

[David De Candia]

Well, I have a different IP every time I log in. Hooray for dialup....

[Captain Nemo]

With dynamic IP assignment you get a new one every time you reconnect to the Internet. For me that is at least every day, sometimes more often.

[tonyw]

If I use the IP as a (semi)-unique identifier, how effective will that be? i.e. How many (separate) users will have either meaningless IPs (255.255.255.0), or be sharing the same IP?

IP you will find is not that useful beyond telling you what ISP a user has. But if you're going to log data back to the server from the game engine then you have lots of scope for generating a GUID at the server end and passing it back to the game session, etc, etc. All good fun!

[David De Candia]

. But if you're going to log data back to the server from the game engine then you have lots of scope for generating a GUID at the server end and passing it back to the game session, etc, etc. All good fun!

It seems that an easy way would be to grab the unique sql (autoincrement) index generated when you post that first score. Then just send that back to the computer and store it. All future posts to the sql table would use that index.

Probably a stupid question, but how do you do that with an open browser (ie ShellExecute) call and php?

[tonyw]

Probably a stupid question, but how do you do that with an open browser (ie ShellExecute) call and php?

I think if you're just launching a browser, then you have to use cookies. Alternately, use something easy(ish) like libcurl to integrate the communication properly into your engine - then you can do whatever you want! Mail me if you need more info...

[David De Candia]

I think if you're just launching a browser, then you have to use cookies. Alternately, use something easy(ish) like libcurl to integrate the communication properly into your engine - then you can do whatever you want! Mail me if you need more info...

Cookies huh... Hmmm I don't think I want to take that path. Thanks for clarifying this for me :) I've fiddled with libcurl before, but for my needs I think a simple ShellExecute and local unique id generation will be fine.

[BlueWaldo]

As long as they have the option to turn it off, I don't think that sending hardware, operating system, resolution and game data (as descibed above) crosses any lines. If you hind what you hind what you are sending or send data that has been generated from other programs, I think that is crossing the line.

I think you can explain durning the install in simple turn what information will be collected and how it is helpful to you to make better games in the future and fix bugs in this game. Check the box by default, and most users will understand and leave it on or be too lazy to uncheck the box.