Netherlands & Belgium: container opening restricted.
Valve’s release notes restored Trading and Market for Dutch customers while restricting container opening in both countries. This was a product-access decision tied to territory.
THE INFORMATION IS ALREADY THERE.
Existing data.
Selective privacy.
Valve must account for the power it already uses.
Location signals, device records, payment restrictions and moderation decisions all sit inside the same platform. Invoking privacy against regulation leaves a central question unanswered: how does Valve use that existing control to protect people, and how can a person challenge its use?
01A VPN does not erase
THE BASELINE VALVE’S RESPONSE LEAVES OUT
A VPN does not erase
the account’s history.
Valve describes additional location checks as a new worldwide intrusion. Assessing that claim requires an inventory of the information already collected and the decisions already made with it.
| Layer | Publicly documented capability | The question it raises |
|---|---|---|
| Account & network | The privacy policy lists SteamID, country of residence and logged IP addresses. | How are historical account and location signals used when access rules change? |
| Device & activity | The same policy lists unique device identifiers, operating-system information, settings and application use. | Which identifiers persist between sessions and connect accounts or devices? |
| Authorised devices | Steam Guard distinguishes unrecognised devices and provides an authorised-device review. | What protection uses this continuity when the network address changes? |
| Country detection | Steamworks exposes GetIPCountry, using an IP-to-location database. | What additional precision is needed, for which decision, and with what error rate? |
THE TECHNICAL POINT
Changing a network route does not inherently reset an application’s device identifier. A long account history followed by a VPN connection can therefore be evaluated alongside existing device and authorisation records. Valve should disclose how those signals are assessed, what they can establish and which less intrusive options it tested.
IP intelligence can classify known VPN or hosting infrastructure. MaxMind documents both classifications and their limits; it is an example of an available technique, not evidence that Valve uses that provider. Detecting a VPN exit and locating the person behind it are different findings. A serious proposal must specify the decision threshold and a way to contest mistakes.
Device identifiers, client downloads and the evidence still required+
The published policy does not enumerate a universal collection of every MAC address, motherboard serial or disk serial. The requested technical disclosure should identify the actual fields, retention periods and purposes. It should also distinguish an account, a recognised device and the person using it.
A game’s installed size does not establish the user’s location when a container is opened. A download can precede a VPN session; Steam also supports copying an installation over a local network. CDN network information is another dated signal, not a substitute for the access decision itself.
Claims about registration-time VPN detection need a dated reproduction of the rejection and its conditions. Claims that NordVPN dominates the New York sample need a defined dataset. Neither is used here as a substitute for Valve’s documented account, device and regional controls.
02The regional switch
VALVE’S OWN PRODUCT HISTORY
The regional switch
already exists.
Country-specific container rules are a documented part of Counter-Strike. Valve’s privacy argument must explain what the proposed controls add to this existing system.
25 APR 2018 / BELGIAN MINISTER OF JUSTICE
Belgium named CS:GO explicitly.
The minister’s release reports the Gaming Commission’s finding that paid loot boxes in CS:GO, FIFA 18 and Overwatch fell under Belgian gambling law. It called for their removal and highlighted the lack of player protection. This is a directly identified Valve game in a primary regulatory record.
The source is a ministerial account of the Commission’s position. The subsequent Valve restriction is documented separately in the July release notes.
NETHERLANDS / 11 JUL 2018Trading & Market: restored.
The ability to exchange was brought back.
THE SAME RELEASEContainer opening: restricted.
Valve changed access to the paid opening separately.
France: X-Ray Scanner introduced.
Valve introduced a preview mechanism that consumes the container. Advancing to another reveal requires claiming the previous result.
Netherlands & Germany: the scanner becomes the route.
Valve announced X-Ray Scanner access for these players, with an exception for keyless containers such as Souvenir Packages. The Netherlands record therefore changes in 2026; the announcement does not name Belgium.
Valve can change the product by territory.
The demand is for the architecture, effectiveness and alternatives behind that control. Country gating alone does not establish reliable identification of a person behind a VPN; Valve must explain the remaining gap.
What does the next unknown result cost?
The current FAQ requires purchase and receipt of the revealed item before another scan. Analysis must follow the paid sequence, including the cost of advancing, rather than stop at the presence of a preview.
The Dutch legal record: identify the actual decision+
The Dutch regulator’s April 2018 study found four of ten examined implementations inconsistent with its gambling-law analysis; it linked transferable prizes to economic value. The games were anonymised.
The Council of State’s 9 March 2022 ruling concerned EA’s FIFA/FUT implementation and overturned the penalty in that case. It is not a judgment on Valve’s containers. The evidence above establishes Valve’s regional product changes, without inventing a Dutch ruling on a “Labubu” defence.
PUBLIC COMPLAINT / PRIVATE NEGOTIATIONS
Publish the demand being denounced.
The filed NYAG complaint alleges an age-confirmation checkbox rather than age verification (¶144). Its requested relief does not prescribe universal VPN detection, biometrics or worldwide identity-document collection. Valve’s account of proposed additional collection describes pre-litigation discussions.
Release the proposals: required data, affected users, retention periods and alternatives considered. The public cannot audit a sweeping privacy objection from one party’s summary of unpublished negotiations.
03Who funded it?
PAYMENT IDENTITY IS NOT PLAYER AGE
Who funded it?
Who opens it?
Valve invokes age checks built into most payment methods used by its New York customers. That does not establish the age of the person spending an already funded Wallet. The system itself separates funding from use.
RETAIL CASH / THE HISTORICAL ROUTE
Physical cards put money into Wallet.
The complaint expressly describes retail gift cards bought with cash (¶29). That route cannot be answered solely by referring to a bank’s checks on a cardholder.
2026 policy change: Valve is ending its retail gift-card programme. Stores will not be restocked; Valve expects stock to run out by the end of 2026. Existing cards remain redeemable, subject to local law. The FAQ attributes the decision to persistent gift-card scams.
DIGITAL GIFTS / DIFFERENT PEOPLE
The person paying can fund someone else.
Valve sells digital gifts that credit a recipient’s Wallet. Checking the buyer’s payment method does not identify the recipient currently using the game. Existing Wallet funds cannot buy these digital gift cards.
TF2 ITEMS / THE MARKET BRIDGE
A tradable key can become spending balance.
Valve’s Mann Co. Supply Crate Key listing marks the TF2 item as tradable and marketable. Eligible Community Market sales produce Wallet funds. An externally acquired item can therefore reach the spending balance without the player’s own card funding that sale.
Market access has separate eligibility conditions, and sales proceeds alone do not remove limited-account status. These are separate gates; neither is a documented verification of the current player’s age.
THE FAILURE IN THE RESPONSE
A CONCRETE REGIONAL FUNDING RECORDThe Russian top-up question now has a named provider.Official MTS service, territorial statements and linked card-transfer terms ↗A check on one funding route cannot stand in for a check at the paid random outcome. Valve must identify the control that connects the person opening a container to a verified age, across gifts, item-sale proceeds and pre-existing balances.
Inspect the original service and its linked terms:
External funding, cryptocurrency and regional top-ups+
An outside item purchase may be settled in money or cryptocurrency while the subsequent Steam sale credits Wallet. The payment, item delivery and Wallet credit are separate records. This page establishes the Steam leg; it does not assign a universal fee, hold period or lower restriction risk to every outside seller.
The investigation’s Russia, Crimea and Donetsk top-up question requires a named provider, contracting entity, transaction date, settlement path and applicable territorial rule. Turnover totals and a sanctions finding require those records. Continue through the original Steam Dossier ↗
The routes establish an age-linkage problem. The share of minors using each route, and the age checks applied by each retailer, require their own data.
04If the payment failed,
RESTRICTION FIRST / EXPLANATION AFTERWARDS
If the payment failed,
show the evidence.
Steam’s chargeback policy restricts associated accounts and purchases. Its standard remedy sends the payment-method owner to the bank to reverse the dispute; return of funds restores the purchase and removes the restriction. If reversal is impossible, the user is directed to Support.
29—31 AUG2026AMERICAN EXPRESS
FIRST-PERSON REPORTS
FIRST-PERSON REPORTS
Users reported restrictions after payments they said they had not disputed.
In a Steam forum thread, users described removed purchases and payment restrictions involving AmEx. A 31 August account said Support lifted the restriction as an exception and warned about recurrence. These are direct user accounts of the incident; a confirmed cause from Valve, AmEx or the processor was not found.
The unresolved issue is concrete: what can the user challenge when Steam says “dispute” and the bank cannot supply the corresponding record?
Identify the payment event.
Distinguish authorisation failure, settlement failure, reversal and a customer-initiated dispute. Supply a transaction reference and the restriction’s actual basis.
Provide a route out of a mistaken restriction.
State who reviews conflicting records, what evidence is accepted, which functions are restricted and when a decision can be expected.
Valve’s restriction policy includes chargebacks under payment fraud and permits restrictions across an individual’s accounts. It also distinguishes account locks, Community Bans, trade bans, VAC bans and suspensions. The relevant notice and effect must be recorded; “banned account” is not a sufficient classification.
THE ENFORCEMENT QUESTION
Valve can make a payment event immediately consequential for the user. The corresponding obligation is a usable explanation and correction process. Calling a remedy an exception does not explain whether the original classification was right.
05Valve can document abuse.
THE STANDARD OF PROOF MUST TRAVEL BOTH WAYS
Valve can document abuse.
Apply that standard consistently.
Valve’s discussion of media and real-world violence does not answer the question of threats and abuse inside its own reporting and support systems. The relevant record is what people submitted, how Valve assessed it and what decisions followed.
SMIRNOV v. VALVE / NEVSKY DISTRICT COURT
A documented litigation trail.
Case № 2-5519/2022 · UID 78RS0015-01-2021-007838-13
The claim was dismissed.
The Nevsky District Court decision dates to 1 September; final form followed on 2 September. The requested RUB 74,598,433 penalty and RUB 50 million moral-damage award were separate demands. The widely circulated 13 September date concerns reporting of the case.
Valve’s side commissioned a linguistic examination.
The 66-page GLADIS report, published by its authors, identifies an 8 June contract with the Baker & McKenzie CIS branch. It examines the claimant’s correspondence with Steam Support, using submitted screenshots and translated printouts. This was a party-commissioned specialist report.
The cassation court upheld the refusal.
The court describes escalating Community restrictions and the expert findings on insults, discriminatory statements and threats. It records that the claimant declined the opportunity to seek a court-appointed examination or submit contrary evidence. Case № 88-10528/2024.
Language was examined as evidence.
Valve’s side obtained an extended analysis to support a sanction. This demonstrates that its enforcement position can be particularised and tested against a record.
Abusive reports require the same scrutiny.
The Steam Dossier describes nationality-based abuse and death wishes in retained reports. Its public audit establishes failed masking across 830 pages and 902,270 extractable covered characters.
ONE RULE / AN AUDITABLE APPLICATION
Which reports were used against their target, and what happened to abusive reporters? Publish anonymised decision records showing the allegation, assessment, rule applied, sanction and appeal result. Evidence submitted to justify a sanction must be distinguished from material merely retained in a file.
What the disclosure audit measures—and what the next review must establish+
The aggregate audit counts 177 occurrences of the heading “Abuse Reporter Account Name”. That is a document-label count, not a count of unique complainants, abusive reports or proven violations. It does not record the moderation outcome for each report.
The reported pornographic URL needs a redacted, source-verifiable exhibit and its processing history. The question is whether it was assessed, relied upon, escalated or rejected. Retention alone cannot answer those questions, and publishing the URL or third-party identifiers would add no evidential value.
A profanity dictionary alone would not resolve threats, context or discriminatory abuse. Steamworks documents text-filtering functions, but their existence does not establish which controls were used in the report pipeline. The relevant evidence is the actual rule and decision trace.
Testing whether valuable inventories affect sanction decisions requires comparable cases, inventory values, violation categories and appeal outcomes. That is a specific audit demand, not a motive established by the Smirnov judgment.
06Account for the system
A CONCRETE TEST OF VALVE’S POSITION
Account for the system
that already operates.
The investigation calls for access to existing decision records, minimised and protected where necessary. Expanding data collection is not a prerequisite for examining how Valve exercises its present power.
- 01
Show the proposed privacy intrusion.
Release NYAG’s actual proposals and Valve’s alternatives: data categories, affected users, necessity, retention and safeguards.
- 02
Map the data already used.
Identify location and device fields, cross-account matching, retention, error rates and the decisions they inform.
- 03
Explain the age gate at the transaction.
Account for existing balances, gift funding and Market proceeds; identify how the current player’s age is established.
- 04
Make restrictions reviewable.
Provide the reason, evidence reference, scope, reviewer and correction route for payment and commercial-use restrictions.
- 05
Audit moderation in both directions.
Trace reports to findings, sanctions and appeals, including abusive submissions and any relationship to inventory value.
THE FINDING
Valve’s existing control is documented. The adequacy and accountability of its use remain the issue. A privacy slogan, a payment-method generalisation and an aggregate ban count do not supply the missing decision record.
07107 RECORDS
THE PUBLIC RECORD
Inspect the evidence.
Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.
No matching records. Try a different term or select “All records”.
Research method and source status+
Reviewed 11 October 2026 UTC. Official policies and product announcements establish documented capabilities and rules. The public complaint states the plaintiff’s allegations. Court dates and findings are tied to the cited acts; user incident reports remain attributed testimony.
The analysis asks for specific decision records. It does not turn a device signal into proof of physical location, a retained report into an endorsed allegation, or a user’s explanation into a confirmed payment-system diagnosis. Earlier chapters and evidence remain intact.