R6DB.com, a large community database for Rainbow 6: Siege, is shutting down due to the new General Data Protection Regulation (GDPR) coming to the EU later this month. This comes as part of a wave of similar shutdowns related to the regulations, including Loadout and Super Monday Night Combat.
R6DB isn’t the first site to be hit by problems like these, Steam Spy has met a similar fate.
GDPR was instituted in April 2016, and it’s finally being implemented on the 25th of May 2018. The regulation aims to hold companies accountable under EU data protection law while processing private data, with financial penalties on companies that do not comply. The GDPR implementation comes hot off the heels of some high-profile misuses of private data, mostly notably the Cambridge Analytica scandal.
Though better protection for our data is by-and-large a good thing, GDPR compliance costs time and money, which many indie devs and community services simply can’t afford. To comply with the new regulations, R6DB would need to make big changes, as well as hire a lawyer to assure them that everything’s kosher, or they could risk fines of up to €20,000,000.
R6DB may be the first of many community apps orbiting big games to run into problems thanks to GDPR – services such as WoWProgress, DestinyTracker, FortniteTracker, and PUBG.me all pull user data from various sources in order to function. We imagine the details will vary depending on where and how they acquire their data – in R6DB’s case, they say in their statement that they draw their data from Ubisoft, though they are no more precise than this.
Similar difficulties with GDPR compliance have been felt by indie devs, as the creators of the free-to-play shooters Loadout and Super Monday Night Combat have also just announced that they don’t have the resources to deal with the GDPR. It’s likely not the only reason why these projects have been shuttered, but they do create difficulties for start-ups, small studios and already struggling projects.
The issues that R6DB are facing are based on two bits of the GDPR: firstly, that organisations need the consent of data subjects to process personal data, and secondly, to use data collected by someone else, organisations need an explicit arrangement with the data collector. R6DB handles personal data in the form of usernames and IDs, but doesn’t have an account system, making data subject consent impossible. It also can’t get an explicit agreement with Ubisoft to process the data, as it’s not officially available to third-parties.
There is a glimmer of hope for R6DB, however, as Alexandre Remy, Brand Director for Rainbow Six, has reached out to them on Twitter following their shutdown announcement.