Privacy group NOYB has accused Ubisoft of collecting player data during offline-capable single-player games without a valid legal basis under the EU’s GDPR. The accusation is contained in a complaint filed with Austria’s data protection authority on April 24, 2025. It is an allegation, not a ruling: no decision by that authority or a court on the complaint has been publicly identified as of October 2026, so the outcome is still unestablished.
What the complaint covers
The case centres on one player’s experience with a PC copy of Far Cry Primal bought through Steam. According to NOYB, the player could not launch the game offline and was prompted to log in to a Ubisoft account. That single experience is the basis of the complaint. It does not establish how every Ubisoft game, on every platform, behaves.
What NOYB says the data showed
NOYB says the player made a subject access request under the GDPR and received records that included a unique identifier and the times the game was launched, how long it ran and when it was closed. The player also examined network traffic. NOYB reports that the player observed 150 connections to external servers over ten minutes, with Google, Amazon and Datadog among the recipients it named.
That 150-connection figure is NOYB’s report of the complainant’s own observation. Neither NOYB nor Ubisoft has published a independent technical analysis of it in the sources available, so it should be read as the complainant’s measurement rather than a verified count.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Brand video game Ubisoft.
- Color: Multicolor
- Dimensions: 10.5 x 17 x 1.2 cm.
- Reference: S71010221.
- If what you want is quality at the best price do not keep looking!
Ubisoft’s explanation for the launch check
NOYB says Ubisoft customer support described the launch connection as an ownership check, and referred the player to the end-user licence agreement and privacy policy for any other processing. NOYB points to policy wording that describes game data and third-party analytics relating to users’ gaming habits. NOYB’s account of that wording is its own; the current text of Ubisoft’s policies should be checked directly before quoting it.
Ubisoft’s response
Insider Gaming reported on April 29, 2025 that Ubisoft said: “We are aware of the complaint and are looking into it.” The publication also quoted the company on connectivity and privacy controls:
Rank #2
- Cast, hook, and rebels! choose your tackle and hone your skills in three different modes in this arcade-style fishing game
- Challenge yourself with Career mode, featuring 80 missions to take you from Casual angler to legendary fisher
- Perfect your techniques to unlock 10 different venues with varied fish in four seasons and different weather conditions
- Play with up to four friends or family and challenge them into catching different types of fish
- Nintendo Switch system: use motion controls with the Joy-Con Controllers to cast (classic controls also available)
- For games that support offline modes, an internet connection is required only at the initial launch, to validate the purchase and link the game to the player’s account.
- Players keep control of their personal data through Ubisoft’s dedicated Privacy Center.
- Ubisoft says it is continuously working on transparency and clearer privacy tools.
These statements are quoted through Insider Gaming’s report; they are not from a Ubisoft source document. Ubisoft’s account of the launch requirement and NOYB’s account of the same launch differ on one point: whether the connection is limited to first launch.
The legal question: lawful basis under GDPR Article 6(1)
The complaint is built on Article 6(1) of the GDPR, which sets out the lawful bases on which personal data may be processed. NOYB argues that the processing it describes was not necessary for any of those purposes and therefore lacked a valid legal basis. Whether a company’s processing is necessary is a question that depends on the facts and on the company’s stated purposes, which is why the regulator’s view matters more than the complaint’s framing. The complaint’s existence does not show that the Austrian authority or a court has agreed with NOYB.
Rank #3
- Wield the powers of the gods like Achilles' sword and Daidalos' wings to battle powerful enemies and solve ancient puzzles.
- Fight iconic mythological beasts like Cyclops and Medusa in dynamic combat in the air and on the ground.
- Use your skills and diverse weapons, including self-guided arrows, telekinesis, and more, for devastating damage.
- Discover a stylized open world across seven unique regions, each inspired by the gods.
What NOYB is asking regulators to do
NOYB asks the Austrian authority to:
- find that an infringement has occurred;
- order the deletion of personal information processed without a valid legal basis;
- require Ubisoft to stop further unlawful processing;
- impose an administrative fine.
NOYB cites €92 million as the possible maximum fine, calculated from its stated turnover figure. That number is NOYB’s estimate of a ceiling. It is not a penalty imposed or proposed by any regulator, and the calculation has not been independently checked.
How the two accounts compare
| Question | NOYB’s account | Ubisoft’s statement | Status |
|---|---|---|---|
| When is an internet connection required? | Described as required during the reported launch of an offline-capable game, with the complainant prompted to log in | Required only at the initial launch, to validate the purchase and link the game to the account | Not independently verified; the two accounts differ on whether the requirement is limited to first launch |
| What data is collected? | Launch and session-duration records, a unique identifier, and 150 external-server connections in ten minutes, as observed by the complainant | Connectivity described as an ownership check; data-use controls available through the Privacy Center | The network observation is not independently verified; the scope of collection in other games is not established |
| Is the processing lawful? | Alleged to lack a valid legal basis under GDPR Article 6(1) | Ubisoft said it is looking into the complaint | No regulator or court finding identified as of October 2026 |
Advocacy language versus technical findings
NOYB’s public statements are written for advocacy. Joakim Söderberg, a data protection lawyer at NOYB, said: “Imagine if the Monopoly man sat at your table and took notes every time you want to play a board game with your family or friends.” He added that, “As long as you have an open internet connection when you play, your data is collected and analysed.” Lisa Steinfeld, also a NOYB lawyer, said: “Ubisoft’s actions are clearly unlawful and must be stopped.” These are the complainant organisation’s positions and should be read as such, not as established facts.
Rank #4
- Designed to bring together families, friends, and neighbors, MONOPOLY is perfect for game nights! Play with up to six players in your living room or online from around the world.
- Feel the essence of tabletop gaming in every move as you buy, sell, trade, and scheme your way to riches. You can now manipulate your token, moving it around and making jumps.
- With next-gen quality and a detailed 3D city, MONOPOLY brings the classic franchise to a new level. Move around the board to explore the city and its different neighborhoods, or spy on your opponents before your next move.
- Not enough time for a full game? Twist the game with house rules or choose a new objective from five special goals! Speed Die mode is also available, allowing you to progress faster around the board.
- Internet connection, Ubisoft Account, PlayStationNetwork account, and PlayStationPlus subscription (sold separately) required to access online multiplayer/features.
Does this apply to every Ubisoft single-player game?
The available reporting does not show that. The complaint concerns one PC purchase through Steam, and Ubisoft’s own explanation distinguishes the first-launch check for offline-capable games from anything else. Readers who want to know whether a specific title sends data during offline play should check that game’s privacy policy and any data-access records they can request under the GDPR, rather than assume the Far Cry Primal findings carry over.
What is established and what is not
- Established: NOYB filed a complaint with Austria’s data protection authority on April 24, 2025, and Ubisoft said on April 29, 2025 that it was looking into it.
- Reported but not verified: the access-request contents, the 150-connection observation, and the description of Ubisoft’s policy wording.
- Not established: any regulator decision, court ruling, fine, or change to Ubisoft’s launch requirement arising from this complaint.
Anyone tracking the case should check the Austrian data protection authority’s public case records and any official updates from Ubisoft before relying on a current status.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Play as Dani Rojas, a local Yaran, as you fight alongside a modern-day guerrilla revolution to liberate Yara
- Fight against Castillo’s regime in the most expansive Far Cry to date, through jungles, beaches, and Esperanza, the capital city of Yara
- Employ an arsenal of resolver weapons, backpacks, and vehicles to take down Castillo’s ruthless regime.
The underlying legal framework is Regulation (EU) 2016/679 (GDPR), available as official text through EUR-Lex.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
