{
  "schema": "phishdestroy.reading-edition.v2",
  "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json",
  "object_type": "Dated article reading edition with PDF digest",
  "id": "privacy-and-enforcement",
  "language": "en",
  "title": "Existing data. Selective privacy. — Valve & enforcement · PhishDestroy",
  "author": "Agent Noel",
  "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement",
  "source_file": "steam_dossier/privacy-and-enforcement.html",
  "source_html_sha256": "d9ea08850ec097778ebab538d447e5b7baef81f399361a981399b8999f22d840",
  "exported_at": "2026-10-18T11:58:30.589Z",
  "edition_date": "2026-10-18",
  "scope": {
    "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.",
    "omissions": [],
    "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence."
  },
  "pdf": {
    "filename": "privacy-and-enforcement.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/privacy-and-enforcement.pdf",
    "sha256": "0bbfa34250b31308a8b81d7d64a466dda16a765be1236f16d69c0abf0ab2932b",
    "bytes": 426217,
    "pages": 22
  },
  "integrity": {
    "signed_object": "privacy-and-enforcement.content.json",
    "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/privacy-and-enforcement.content.json.asc",
    "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/privacy-and-enforcement.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted."
  },
  "license": {
    "identifier": "CC0-1.0",
    "application": "Authored material only; third-party material retains its own rights.",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb"
  },
  "content": {
    "text": "Contents · Live article\n\nEXISTING DATA / ACCESS / REMEDYREVIEWED 11 OCT 2026 · UTC\n\nTHE INFORMATION IS ALREADY THERE.\n\nExisting data. Selective privacy.\n\nValve must account for the power it already uses.\n\nINVESTIGATION BY AGENT NOEL\n\nLocation signals, device records, payment restrictions and moderation decisions all sit inside the same platform. Invoking privacy against regulation leaves a central question unanswered: how does Valve use that existing control to protect people, and how can a person challenge its use?\n\nFollow the existing record ↓The disclosure demands ↗\nONE PLATFORM / UNEQUAL VISIBILITY\nVALVE CANIdentify.\nCorrelate.\nRestrict.\nTHE USER NEEDSThe evidence.\nThe reason.\nA remedy.\n\nA restriction is an exercise of power. Its justification must be open to challenge.\n\nOriginal 11 October edition · complete text →\n01\n\nTHE BASELINE VALVE’S RESPONSE LEAVES OUT\n\nA VPN does not erase the account’s history.\n\nValve describes additional location checks as a new worldwide intrusion. Assessing that claim requires an inventory of the information already collected and the decisions already made with it. [E14]\n\nThe existing record—not a hypothetical new surveillance system\nLayer\tPublicly documented capability\tThe question it raises\nAccount & network\tThe privacy policy lists SteamID, country of residence and logged IP addresses. [E71]\tHow are historical account and location signals used when access rules change?\nDevice & activity\tThe same policy lists unique device identifiers, operating-system information, settings and application use. [E71]\tWhich identifiers persist between sessions and connect accounts or devices?\nAuthorised devices\tSteam Guard distinguishes unrecognised devices and provides an authorised-device review. [E72]\tWhat protection uses this continuity when the network address changes?\nCountry detection\tSteamworks exposes GetIPCountry, using an IP-to-location database. [E73]\tWhat additional precision is needed, for which decision, and with what error rate?\nTHE LAYERS THAT ALREADY EXIST\nA VPN changes the route, not the record.\n\nName the layers. The browser session that registered the account. The game client that still phones home from the same machine. The CDN and ASN fingerprints Valve’s own servers log on every request. [E71] [E72]\n\nA player who registers on the web in New York, connects through a VPN and launches the same client leaves a chain Valve already records: one machine, one client build, one account history, requests crossing Valve’s own network edge at every step. Local transfers move installations between machines; they do not delete the download and authorisation events already logged. [E90]\n\nPublish that chain — device, client build, network trace, account history — before claiming that only new, total collection can establish location.\n\nTHE TECHNICAL POINT\n\nChanging a network route does not inherently reset an application’s device identifier. A long account history followed by a VPN connection can therefore be evaluated alongside existing device and authorisation records. Valve should disclose how those signals are assessed, what they can establish and which less intrusive options it tested.\n\nIP intelligence can classify known VPN and hosting infrastructure. MaxMind documents such classifications and their limits. Valve should publish the location signals it actually uses, the decision thresholds, the treatment of account history and the procedure for correcting a mistaken restriction. [E74]\n\nTHE INVESTIGATION’S TESTS / REGISTRATION\nRegistration was refused behind a VPN.\n\nIn the investigation’s own tests, account registration was refused while connected through a VPN. That is an observation, not a statistic: the dated reproduction — connection conditions, time, displayed refusal and the resulting account decision — belongs beside the registration and connection records Valve already keeps, which can state the rule that fired and its error rate. [E71]\n\nTHE OPEN LEAD / NORDVPN\nWhat share of New York users arrive through NordVPN?\n\nThe author’s lead, stated as a question and not as a finding: what share of New York Steam users reach the platform through NordVPN? It is measurable, and Valve’s own connection records can answer it — connection counts by exit network for New York accounts, beside the location decisions those connections produced. No market share is asserted here; the record is the demand. [E74]\n\nDevice records, network history and Valve’s disclosure duty\n\nValve should identify the device fields its clients collect, including whether hardware and network identifiers enter its account-security or location decisions. Publish their purpose, retention, cross-account use and correction process. The relevant records are held by the platform operating the client.\n\nName the fields behind the generalisation. “Hardware and network identifiers” has specific candidates: MAC address, motherboard serial, disk serial. The demand is field-level — for each field, whether Steam’s clients collect it, where it is retained, and which account-security or location decisions it enters. Universal collection is not established on this record; field-level disclosure is what would establish or refute it.\n\nDownloads, authorisations and later account access leave a sequence of dated events. Steam also supports local-network installation transfers. Valve should explain which of those records enter its regional checks, how they are combined and why additional collection is necessary when an established account changes its network route. [E90]\n\nThe CS2 client download and its network trace are the concrete case: downloads, authorisations and later account access leave a sequence of dated events across Valve’s own CDN and ASN. That sequence is logged by Valve’s own infrastructure; it should be published with the account decisions it can inform, not folded into a claim that only new collection can locate a user.\n\nThe investigation’s VPN and registration tests belong beside that disclosure: connection conditions, time, displayed restriction and the resulting account decision. This makes Valve’s existing regional controls inspectable and gives users a concrete basis for challenging an inconsistent result.\n\nTHE EARLIER DISCLOSURE RECORDOne device. Multiple accounts. Years of retained history.The dossier’s counsel-correspondence account and its source trail ↗\n02\n\nVALVE’S OWN PRODUCT HISTORY\n\nThe regional switch already exists.\n\nCountry-specific container rules are a documented part of Counter-Strike. Valve’s privacy argument must explain what the proposed controls add to this existing system.\n\n25 APR 2018 / BELGIAN MINISTER OF JUSTICE\n\nBelgium named CS:GO explicitly.\n\nThe minister’s release reports the Gaming Commission’s finding that paid loot boxes in CS:GO, FIFA 18 and Overwatch fell under Belgian gambling law. It called for their removal and highlighted the lack of player protection. This is a directly identified Valve game in a primary regulatory record. [E91]\n\nThe source is a ministerial account of the Commission’s position. The subsequent Valve restriction is documented separately in the July release notes.\n\nNETHERLANDS / 11 JUL 2018Trading & Market: restored.\n\nThe ability to exchange was brought back.\n\nTHE SAME RELEASEContainer opening: restricted.\n\nValve changed access to the paid opening separately. [E75]\n\n11 JUL 2018\nNetherlands & Belgium: container opening restricted.\n\nValve’s release notes restored Trading and Market for Dutch customers while restricting container opening in both countries. This was a product-access decision tied to territory. [E75]\n\n30 SEP 2019\nFrance: X-Ray Scanner introduced.\n\nValve introduced a preview mechanism that consumes the container. Advancing to another reveal requires claiming the previous result. [E76]\n\n16 MAR 2026\nNetherlands & Germany: the scanner becomes the route.\n\nValve announced X-Ray Scanner access for these players, with an exception for keyless containers such as Souvenir Packages. The Netherlands record therefore changes in 2026; the announcement does not name Belgium. [E77]\n\nREGIONAL CONTROL / THE DEMONSTRATED CAPABILITY\nValve can change the product by territory.\n\nValve should disclose the architecture and effectiveness of the regional control it already operates, including its handling of VPN connections, existing account history and contested decisions. The company owes users an explanation of the alternatives it considered and the remaining gaps.\n\nX-RAY / THE ECONOMIC QUESTION\nWhat does the next unknown result cost?\n\nThe current FAQ requires purchase and receipt of the revealed item before another scan. Analysis must follow the paid sequence, including the cost of advancing, rather than stop at the presence of a preview. [E78]\n\nThe Dutch record: the ruling and Valve’s own response\n\nThe Dutch regulator’s April 2018 study found four of ten examined implementations inconsistent with its gambling-law analysis; it linked transferable prizes to economic value. The games were anonymised. [E88]\n\nThe Council of State’s 9 March 2022 ruling overturned the penalty in the EA FIFA/FUT case. Valve’s own Dutch record is the regional product change documented above: it altered trading access and container opening separately. Those are the mechanisms that its present defence must explain. [E89]\n\nPUBLIC COMPLAINT / PRIVATE NEGOTIATIONS\nPublish the demand being denounced.\n\nThe filed NYAG complaint alleges an age-confirmation checkbox rather than age verification (¶144). Its requested relief does not prescribe universal VPN detection, biometrics or worldwide identity-document collection. Valve’s account of proposed additional collection describes pre-litigation discussions. [E38] [E14]\n\nRelease the proposals: required data, affected users, retention periods and alternatives considered. The public cannot audit a sweeping privacy objection from one party’s summary of unpublished negotiations.\n\nTHE OBJECTION / 11 MAR 2026\n“Beyond what we normally collect.”\n\nValve’s own words, quoted before they are dismantled: the NYAG proposal would gather additional information “beyond what we normally collect in the course of processing payments” — collection that “would have involved implementing invasive technologies for every user worldwide.” [E14]\n\n“Normally collect” sets a baseline; “invasive technologies for every user worldwide” sets a fear. Both halves are testable against a record Valve itself has already produced.\n\nTHE PRODUCTION / OCT 2025\n830 pages about one account.\n\nMonths before that statement, Valve answered a single user’s Article 15 access request with an 830-page appendix: 902,270 covered characters still extractable beneath the failed masking. No payment processor handed Valve that file — Valve’s own systems produced it, hold it, and disclosed it only under statutory compulsion. [E21] [E13]\n\nPublish what “normally collected” already covers before it is accepted as a narrow baseline. Inspect the 830-page production and its audit trail ↗\n\n03\n\nPAYMENT IDENTITY IS NOT PLAYER AGE\n\nWho funded it? Who opens it?\n\nValve invokes age checks built into most payment methods used by its New York customers. That does not establish the age of the person spending an already funded Wallet. The system itself separates funding from use. [E14]\n\n01\nRETAIL CASH / THE HISTORICAL ROUTE\nPhysical cards put money into Wallet.\n\nThe complaint expressly describes retail gift cards bought with cash (¶29). That route cannot be answered solely by referring to a bank’s checks on a cardholder. [E38]\n\nThe historical record: the cash route is not hypothetical. Valve’s own current FAQ dates the retail programme to 2012 [E79]; GameStop’s 14 May 2012 partnership announcement, preserved in a contemporary reprint, described cash-funded Steam Wallet at physical stores; and a 2019 archival capture of Valve’s gift-card page described the physical cards as suiting cash-in-hand purchases. Valve itself marketed physical cards to buyers without bank instruments — years of its own record, not an invented funding route.\n\n2026 policy change: Valve is ending its retail gift-card programme. Stores will not be restocked; Valve expects stock to run out by the end of 2026. Existing cards remain redeemable, subject to local law. The FAQ attributes the decision to persistent gift-card scams. [E79]\n\n02\nDIGITAL GIFTS / DIFFERENT PEOPLE\nThe person paying can fund someone else.\n\nValve sells digital gifts that credit a recipient’s Wallet. Checking the buyer’s payment method does not identify the recipient currently using the game. Existing Wallet funds cannot buy these digital gift cards. [E80]\n\n03\nTF2 ITEMS / THE MARKET BRIDGE\nA tradable key can become spending balance.\n\nValve’s Mann Co. Supply Crate Key listing marks the TF2 item as tradable and marketable. Eligible Community Market sales produce Wallet funds. An externally acquired item can therefore reach the spending balance without the player’s own card funding that sale. [E81] [E15]\n\nMarket access has separate eligibility conditions, and sales proceeds alone do not remove limited-account status. These are separate gates; neither is a documented verification of the current player’s age. [E66]\n\nTHE FAILURE IN THE RESPONSE\n\nA check on one funding route cannot stand in for a check at the paid random outcome. Valve must identify the control that connects the person opening a container to a verified age, across gifts, item-sale proceeds and pre-existing balances.\n\nA CONCRETE REGIONAL FUNDING RECORDThe Russian top-up question now has a named provider.Official MTS service, territorial statements and linked card-transfer terms ↗\n\nInspect the original service and its linked terms: [E92] [E93]\n\nExternal funding, cryptocurrency and regional top-ups\n\nAn outside item purchase may be settled in money or cryptocurrency while the subsequent Steam sale credits Wallet. The payment, item delivery and Wallet credit are separate records. This page establishes the Steam leg; the fee, hold period and restriction risk for each outside seller are records held by that seller and by Valve, and they must be published beside the Community Market’s own fee schedule and hold periods.\n\nThe Russia, Crimea and Donetsk top-up record now names its provider and settlement centre [E92] [E93]. The contracting entities, transaction dates, settlement path, turnover totals and any Valve agreement are records held by MTS Payment, the settlement bank and Valve; they must publish them, and any sanctions finding rests on those disclosures. Continue through the original Steam Dossier ↗\n\nThe routes establish an age-linkage problem. Valve holds the registered ages of the accounts using each route, and each retailer holds the age checks it applied; those records, not an invented minors statistic, must answer the question.\n\nFOLLOW THE VALUE AFTER AN ACCOUNT COMPROMISEA protected trade is not protection for every route.Market sales, inflated-price purchases, Wallet proceeds and game gifts ↗\n04\n\nRESTRICTION FIRST / EXPLANATION AFTERWARDS\n\nIf the payment failed, show the evidence.\n\nSteam’s chargeback policy restricts associated accounts and purchases. Its standard remedy sends the payment-method owner to the bank to reverse the dispute; return of funds restores the purchase and removes the restriction. If reversal is impossible, the user is directed to Support. [E82]\n\n29—31 AUG2026AMERICAN EXPRESS\nFIRST-PERSON REPORTS\nUsers reported restrictions after payments they said they had not disputed.\n\nIn a Steam forum thread, users described removed purchases and payment restrictions involving AmEx. A 31 August account said Support lifted the restriction as an exception and warned about recurrence. These are direct user accounts of the incident; a confirmed cause from Valve, AmEx or the processor was not found. [E83]\n\nThe unresolved issue is concrete: what can the user challenge when Steam says “dispute” and the bank cannot supply the corresponding record?\n\nThe reports share a concrete shape: real card owners, transactions that failed or were cancelled outright, account locks that followed — and template support text in reply. [E83]\n\n17—18 AUG 2026\nThe transactions behind the restrictions.\n\nUsers dated the disputed charges to 17—18 August 2026 — purchases they denied ever disputing. One user’s card issuer confirmed two approved authorisations of $8.23 on 17 August, only one of which Steam’s processor captured and posted; the second expired uncollected. That account of an issuer conversation is relayed testimony, not an audited finding. [E83]\n\nAnother user reported the charge never reached AmEx at all: four days of processing attempts visible in Steam’s purchase history, nothing in the cardholder’s AmEx statement. A charge that never completed leaves the card owner nothing to produce — the evidentiary impossibility at the centre of the episode.\n\n29 AUG 2026\nRemoved game, locked account, no route out.\n\nThe thread’s opening report: a game removed after twelve days of play over a charge the bank said it never disputed, with repurchase refused and new payment methods rejected. [E83]\n\n31 AUG 2026\nThe exception, the warning, the re-lock.\n\nSupport lifted one user’s restriction “as an exception,” warning the account could be permanently locked if it happened again — while the disputed purchase stayed removed. Another user reported a second 17 August transaction re-triggering restrictions after an earlier unlock. A third reported Support giving “the same stock responses,” repeating “call American Express” and refusing to supply a Transaction ID or escalate to a payment specialist. [E83]\n\n02 SEP 2026\nRecords removed. Games still not restored.\n\nA user reported the chargeback records had been removed from the account — but AmEx still declined, and the disputed games were still not restored. Removing the flag did not return the purchase, and the basis of the original restriction was never supplied. [E83]\n\nTHE RECORD\nIdentify the payment event.\n\nDistinguish authorisation failure, settlement failure, reversal and a customer-initiated dispute. Supply a transaction reference and the restriction’s actual basis.\n\nTHE REVIEW\nProvide a route out of a mistaken restriction.\n\nState who reviews conflicting records, what evidence is accepted, which functions are restricted and when a decision can be expected.\n\nValve’s restriction policy includes chargebacks under payment fraud and permits restrictions across an individual’s accounts. It also distinguishes account locks, Community Bans, trade bans, VAC bans and suspensions. The relevant notice and effect must be recorded; “banned account” is not a sufficient classification. [E87]\n\nTHE DEMAND\n\nValve and its payment processor should publish the transaction event records behind these account actions. Authorisation, capture, settlement, reversal and dispute status for each transaction, tied to the restriction it produced and the account decision that followed. The parties whose systems generated the events can produce the record; the user cannot produce a statement for a charge that never completed. “Call your bank” is not evidence — it is the absence of one. [E83]\n\nTHE ENFORCEMENT QUESTION\n\nValve can make a payment event immediately consequential for the user. The corresponding obligation is a usable explanation and correction process. Calling a remedy an exception does not explain whether the original classification was right.\n\n05\n\nTHE STANDARD OF PROOF MUST TRAVEL BOTH WAYS\n\nValve can document abuse. Apply that standard consistently.\n\nValve’s discussion of media and real-world violence does not answer the question of threats and abuse inside its own reporting and support systems. The relevant record is what people submitted, how Valve assessed it and what decisions followed. [E14]\n\nSMIRNOV v. VALVE / NEVSKY DISTRICT COURT\nA documented litigation trail.\n\nCase № 2-5519/2022 · UID 78RS0015-01-2021-007838-13\n\n01 SEP 2022\nThe claim was dismissed.\n\nThe Nevsky District Court decision dates to 1 September; final form followed on 2 September. The requested RUB 74,598,433 penalty and RUB 50 million moral-damage award were separate demands. The widely circulated 13 September date concerns reporting of the case. [E84] [E86]\n\n28 JUN 2023\nValve’s side commissioned a linguistic examination.\n\nThe 66-page GLADIS report, published by its authors, identifies an 8 June contract with the Baker & McKenzie CIS branch. It examines the claimant’s correspondence with Steam Support, using submitted screenshots and translated printouts. This was a party-commissioned specialist report. [E85]\n\n22 MAY 2024\nThe cassation court upheld the refusal.\n\nThe court describes escalating Community restrictions and the expert findings on insults, discriminatory statements and threats. It records that the claimant declined the opportunity to seek a court-appointed examination or submit contrary evidence. Case № 88-10528/2024. [E86]\n\nTHE SUBMITTED FILE / A MATERIAL DIMENSION\nAudit the evidentiary package itself.\n\nThe record has a material dimension this page has not audited: the PDF Valve’s side submitted. The report, the translated printouts and the screenshots were filed as evidence — and how that package was assembled and edited shows what Valve’s counsel treats as an acceptable evidentiary file. [E85] [E86]\n\nReproduce the submitted materials, with third-party identifiers protected, and audit the file itself: who compiled it, what was cut, and whether the court received the same text the reports contained. The standard Valve demands of a sanctioned user’s words applies to the file its own side carried into court.\n\nTHE LITIGATION RECORD\nLanguage was examined as evidence.\n\nValve’s side obtained an extended analysis to support a sanction. This demonstrates that its enforcement position can be particularised and tested against a record.\n\nTHE DOSSIER’S DISCLOSURE RECORD\nAbusive reports require the same scrutiny.\n\nThe Steam Dossier describes nationality-based abuse and death wishes in retained reports. Its public audit establishes failed masking across 830 pages and 902,270 extractable covered characters. [E13] [E21]\n\nONE RULE / AN AUDITABLE APPLICATION\n\nWhich reports were used against their target, and what happened to abusive reporters? Publish anonymised decision records showing the allegation, assessment, rule applied, sanction and appeal result. Evidence submitted to justify a sanction must be distinguished from material merely retained in a file.\n\nFollow the report from submission to sanction\n\nThe aggregate audit counts 177 occurrences of the heading “Abuse Reporter Account Name”. That is a document-label count, not a count of unique complainants, abusive reports or proven violations. It does not record the moderation outcome for each report.\n\nFor the reported pornographic link, Valve should produce the processing history and an appropriately redacted exhibit: who assessed it, whether it was relied upon, which rule applied and what decision followed. The audit should expose the handling of the report while protecting third-party identifiers.\n\nSteamworks documents text-filtering functions. Valve should identify the filters and rules actually applied to threats, discriminatory abuse and links submitted through its reporting systems, and release the corresponding decision traces. The same scrutiny it applies to a sanctioned user’s language must reach abusive submissions used against that user. [E73]\n\nPublish comparable sanctions and appeals alongside inventory value, violation category and final remedy. That record would show how consistently Valve applies its rules when the account contains a valuable collection.\n\nTHE ORIGINAL MATERIAL REMAINS IN PLACEClient inspection. Retained data. Failed disclosure.Read the 2014–2026 record and the September access-request closure ↗\n06\n\nA CONCRETE TEST OF VALVE’S POSITION\n\nAccount for the system that already operates.\n\nThe investigation calls for access to existing decision records, minimised and protected where necessary. Expanding data collection is not a prerequisite for examining how Valve exercises its present power.\n\n01\nShow the proposed privacy intrusion.\n\nRelease NYAG’s actual proposals and Valve’s alternatives: data categories, affected users, necessity, retention and safeguards.\n\n02\nMap the data already used.\n\nIdentify location and device fields, cross-account matching, retention, error rates and the decisions they inform.\n\n03\nExplain the age gate at the transaction.\n\nAccount for existing balances, gift funding and Market proceeds; identify how the current player’s age is established.\n\n04\nMake restrictions reviewable.\n\nProvide the reason, evidence reference, scope, reviewer and correction route for payment and commercial-use restrictions.\n\n05\nAudit moderation in both directions.\n\nTrace reports to findings, sanctions and appeals, including abusive submissions and any relationship to inventory value.\n\nTHE FINDING\n\nValve’s existing control is documented. The adequacy and accountability of its use remain the issue. A privacy slogan, a payment-method generalisation and an aggregate ban count do not supply the missing decision record.\n\n07\n\nTHE PUBLIC RECORD\n\nInspect the evidence.\n29 RECORDS\n\nSources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.\n\nResearch method and source status\n\nReviewed 11 October 2026 UTC. Official policies and product announcements establish documented capabilities and rules. The public complaint states the plaintiff’s allegations. Court dates and findings are tied to the cited acts; user incident reports remain attributed testimony.\n\nThe analysis connects existing account and device data, territorial product changes, payment restrictions and moderation records. It asks Valve to account for the decisions already made with that information, the consequences for users and the remedies provided.\n\nCited source records\nE14 · About the New York Attorney General lawsuit against Valve\n\nPublisher: Valve\n\nDate: 11 Mar 2026\n\nSupports: The public collectibles comparison, optional and cosmetic framing, transferability argument, account-ban total, privacy objections and legislative position.\n\nScope: Corporate public response dated 11 March 2026; linked alongside the filed complaint and the investigation’s analysis.\n\nhttps://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5\nE71 · Steam Privacy Policy — existing collection\n\nPublisher: Valve\n\nDate: Current policy · §§3.1–3.8\n\nSupports: SteamID, residence country, IP logs, unique device identifiers and application/device data are publicly disclosed categories.\n\nScope: Valve’s policy lists data categories and their declared purposes; field-level implementation is part of the requested disclosure.\n\nhttps://store.steampowered.com/privacy_agreement/\nE72 · Account Security Recommendations — authorised devices\n\nPublisher: Valve / Steam Support\n\nDate: Current guidance\n\nSupports: Steam Guard checks unrecognised devices and provides an authorised-device review.\n\nScope: Steam’s description of recognised-device authorisation and account protection.\n\nhttps://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60\nE73 · ISteamUtils — country and text-filtering functions\n\nPublisher: Valve / Steamworks\n\nDate: Current developer documentation\n\nSupports: GetIPCountry returns a country code from an IP-location database. FilterText and InitFilterText document filtering facilities.\n\nScope: Documented Steamworks interface functions. The operational decision trail is requested from Valve.\n\nhttps://partner.steamgames.com/doc/api/ISteamUtils\nE90 · Steam Local Network Game Transfers\n\nPublisher: Valve / Steam Support\n\nDate: Current technical guidance\n\nSupports: Game installation and update files can be copied between eligible computers over a local network.\n\nScope: Valve’s documentation of transferring installed game files between devices over a local network.\n\nhttps://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43\nE74 · GeoIP Anonymous IP — VPN and hosting classifications\n\nPublisher: MaxMind\n\nDate: Current technical documentation\n\nSupports: Documented classifications include known VPN and hosting-provider addresses, with stated detection limits.\n\nScope: Industry technique only. No claim that Valve is a customer or uses this particular service.\n\nhttps://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/\nE91 · Belgian loot-box findings expressly name CS:GO\n\nPublisher: Koen Geens / Belgian Minister of Justice\n\nDate: 25 Apr 2018\n\nSupports: The minister’s release reports the Gaming Commission’s finding that paid loot boxes in CS:GO, FIFA 18 and Overwatch fell under Belgian gambling law and called for removal.\n\nScope: The Belgian minister’s contemporary account of the Gaming Commission’s findings and requested action.\n\nhttps://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving\nE75 · Release Notes for 7/11/2018 — Netherlands and Belgium\n\nPublisher: Valve / Counter-Strike\n\nDate: 11 Jul 2018\n\nSupports: Trading and Market restored for Dutch customers; container opening restricted in the Netherlands and Belgium.\n\nScope: July 2018 release notes. The subsequent Netherlands change is recorded separately in E77.\n\nhttps://blog.counter-strike.net/2018/07/20618/\nE76 · France — introducing the X-Ray Scanner\n\nPublisher: Valve / Counter-Strike\n\nDate: 30 Sep 2019\n\nSupports: Country-specific reveal and claim sequence, including consuming a scanned container.\n\nScope: September 2019 release notes describing the French X-Ray mechanism and contemporaneous Market rules.\n\nhttps://blog.counter-strike.net/2019/09/25667/\nE77 · X-Ray Scanner for Germany and the Netherlands\n\nPublisher: Valve / Counter-Strike 2\n\nDate: 16 Mar 2026\n\nSupports: Scanner access for Germany and the Netherlands; keyless containers exempted.\n\nScope: Also verified in the official Steam announcement feed. Belgium is not named in this update.\n\nhttps://steamcommunity.com/ogg/730/announcements/detail/518615049848226730\nE78 · Counter-Strike 2 — X-Ray Scanner\n\nPublisher: Valve / Steam Support\n\nDate: Current FAQ\n\nSupports: The revealed item must be purchased and received before another scan; scanning consumes the container.\n\nScope: Steam’s description of the reveal, purchase and next-scan sequence.\n\nhttps://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B\nE88 · Onderzoek naar loot boxes — Een buit of een last?\n\nPublisher: Kansspelautoriteit\n\nDate: 19 Apr 2018\n\nSupports: Regulatory analysis of ten implementations; four considered noncompliant. Transferability was connected to economic value.\n\nScope: The Dutch regulator’s 2018 study of ten anonymised implementations and the economic significance of transferable prizes.\n\nhttps://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf\nE89 · EA / FIFA-FUT — ECLI:NL:RVS:2022:690\n\nPublisher: Raad van State\n\nDate: 9 Mar 2022\n\nSupports: The Council of State overturned the penalty against EA on the implementation-specific record before it.\n\nScope: The Council of State’s 9 March 2022 ruling on EA’s FIFA/FUT implementation.\n\nhttps://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/\nE38 · People of New York v. Valve Corporation — filed complaint\n\nPublisher: New York Attorney General / NYSCEF\n\nDate: 25 Feb 2026\n\nSupports: Court, filing date, index 450952/2026, allegations, statutory bases and requested remedies.\n\nScope: NYSCEF document 2; 52-page court-stamped complaint. Requested relief appears on PDF pages 50–51.\n\nhttps://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf\nE21 · Disclosure audit — 830-page appendix\n\nPublisher: PhishDestroy\n\nDate: Published audit · reviewed 20 Sep 2026\n\nSupports: Page-level redaction geometry, character counts and source-file SHA-256 for the appendix to the October 2025 access response.\n\nScope: The public audit contains aggregate findings and the source hash; the original personal-data appendix is withheld.\n\nhttps://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json\nE13 · The Steam Dossier — rules, routes and accountability\n\nPublisher: PhishDestroy\n\nDate: Related investigation\n\nSupports: The parent investigation supplies the historical registration and consent exhibits, transfer-substitution sequence, route register, ownership and recovery records, and correspondence used by this companion investigation.\n\nScope: The parent PhishDestroy investigation; linked as the wider editorial and infrastructure context.\n\nhttps://phishdestroy.io/steam_dossier/\nE79 · Steam Wallet — retail gift-card phase-out\n\nPublisher: Valve / Steam Support\n\nDate: FAQ v18 · metadata 10 Jun 2026\n\nSupports: Retail stocks are not replenished; expected exhaustion by the end of 2026. Existing cards remain redeemable, subject to local law. Valve cites persistent scams.\n\nScope: Retrieved 11 October 2026; includes the page’s embedded update timestamp.\n\nhttps://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers\nE80 · Digital Gift Cards — funding another account\n\nPublisher: Valve / Steam Store\n\nDate: Current gift-card FAQ\n\nSupports: A payer can buy Wallet credit for a recipient. Existing Wallet funds cannot buy digital gift cards.\n\nScope: A digital Wallet gift differs from a game gift. Country and recipient eligibility rules apply.\n\nhttps://store.steampowered.com/digitalgiftcards/selectgiftcard\nE81 · TF2 — Mann Co. Supply Crate Key\n\nPublisher: Valve / Steam Community Market\n\nDate: Current official item listing\n\nSupports: The listing’s asset data marks the key as tradable and marketable; the item has a Steam Market order interface.\n\nScope: Steam’s item listing, showing the trading and Market attributes of the TF2 key.\n\nhttps://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key\nE15 · Steam Community Market FAQ — Wallet proceeds and market limits\n\nPublisher: Valve / Steam Support\n\nDate: Live FAQ · reviewed 10 Oct 2026\n\nSupports: Market sale proceeds in Steam Wallet and the approximate US$1,800 listing limit.\n\nScope: Steam’s own market and Wallet mechanics, used in the ownership and outside-price comparison.\n\nhttps://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B\nE66 · Limited User Accounts\n\nPublisher: Valve / Steam Support\n\nDate: Live FAQ · reviewed 10 Oct 2026\n\nSupports: Qualifying $5 spending and specified restricted community features.\n\nScope: Steam’s published requirements for access to trading and the Community Market.\n\nhttps://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A\nE92 · Russia-facing Steam top-ups — published service and territorial statements\n\nPublisher: MTS Payment\n\nDate: Retrieved 11 Oct 2026\n\nSupports: The official service offers ruble-funded Steam top-ups for Russian accounts. Its FAQ explicitly discusses delays or failures for Crimea, LNR and DNR accounts.\n\nScope: Provider’s public offer and descriptions; no transaction was made. Settlement intermediaries, any Valve agreement and sanctions compliance require separate records.\n\nhttps://payment.mts.ru/cyber/steam\nE93 · Public offer — bank-card money-transfer service\n\nPublisher: MTS Payment / Murmansk Settlement Bank\n\nDate: 2026 document · retrieved 11 Oct\n\nSupports: The linked card-transfer offer identifies the settlement centre as Murmansk Settlement Bank LLC and the transfer currency as Russian rubles.\n\nScope: Terms governing the named card-transfer service and its participants.\n\nhttps://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf\nE82 · Payment Disputes and Chargebacks\n\nPublisher: Valve / Steam Support\n\nDate: Current policy · metadata 15 May 2024\n\nSupports: Associated account/purchase restrictions, bank-reversal route, restoration when funds return, and Support escalation when reversal is impossible.\n\nScope: Steam’s published payment-dispute policy and described restrictions.\n\nhttps://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2\nE83 · STEAM payment system broken? — AmEx incident reports\n\nPublisher: Steam Community users\n\nDate: 29–31 Aug 2026\n\nSupports: First-person reports of removed purchases and payment restrictions; one user reports a Support exception and warning on 31 August.\n\nScope: Unverified participant testimony. No published confirmation of root cause from Valve, AmEx or the processor was found in this review.\n\nhttps://steamcommunity.com/discussions/forum/0/590688141302606461/\nE87 · Restricted Steam Account — reasons and restriction types\n\nPublisher: Valve / Steam Support\n\nDate: Current policy · metadata 22 May 2025\n\nSupports: Payment-fraud and commercial-use grounds; distinctions among locks, Community Bans, trade bans, VAC bans and suspensions.\n\nScope: The actual account notice and decision record are needed to establish the scope and basis of an individual restriction.\n\nhttps://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23\nE84 · Smirnov v. Valve — case 2-5519/2022\n\nPublisher: Nevsky District Court, Saint Petersburg\n\nDate: 1 Sep 2022 · final form 2 Sep 2022\n\nSupports: Official case identity and first-instance refusal. UID 78RS0015-01-2021-007838-13.\n\nScope: Court hosting can be intermittently unavailable. The later cassation act independently records the 1 September decision date.\n\nhttps://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1\nE86 · Smirnov v. Valve — cassation 88-10528/2024\n\nPublisher: Third Cassation Court of General Jurisdiction\n\nDate: 22 May 2024\n\nSupports: Procedural history, monetary demands, Community restrictions and the court’s treatment of the linguistic report.\n\nScope: Copy of the court act hosted by T—J. It records an opportunity to seek a court examination or contrary evidence, declined by the claimant.\n\nhttps://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf\nE85 · Specialists’ report on Smirnov’s Steam Support correspondence\n\nPublisher: GLADIS / Guild of Linguistic Experts\n\nDate: 28 Jun 2023 · 66 pages\n\nSupports: Author-hosted report identifies an 8 June 2023 contract with the Baker & McKenzie CIS branch and the correspondence examined.\n\nScope: A 66-page, party-commissioned specialist report; the commissioning relationship and date appear in the report.\n\nhttps://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf",
    "headings": [
      {
        "level": 1,
        "text": "Existing data. Selective privacy.",
        "anchor": "pd-privacy-and-enforcement--hero-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#hero-title"
      },
      {
        "level": 2,
        "text": "A VPN does not erase the account’s history.",
        "anchor": "pd-privacy-and-enforcement--existing-data-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#existing-data-title"
      },
      {
        "level": 3,
        "text": "A VPN changes the route, not the record.",
        "anchor": "pd-privacy-and-enforcement--heading-3",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#network-layers"
      },
      {
        "level": 3,
        "text": "Registration was refused behind a VPN.",
        "anchor": "pd-privacy-and-enforcement--heading-4",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#vpn-observations"
      },
      {
        "level": 3,
        "text": "What share of New York users arrive through NordVPN?",
        "anchor": "pd-privacy-and-enforcement--heading-5",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#vpn-observations"
      },
      {
        "level": 2,
        "text": "The regional switch already exists.",
        "anchor": "pd-privacy-and-enforcement--regional-control-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control-title"
      },
      {
        "level": 3,
        "text": "Belgium named CS:GO explicitly.",
        "anchor": "pd-privacy-and-enforcement--heading-7",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#belgium-record"
      },
      {
        "level": 3,
        "text": "Netherlands & Belgium: container opening restricted.",
        "anchor": "pd-privacy-and-enforcement--heading-8",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control"
      },
      {
        "level": 3,
        "text": "France: X-Ray Scanner introduced.",
        "anchor": "pd-privacy-and-enforcement--heading-9",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control"
      },
      {
        "level": 3,
        "text": "Netherlands & Germany: the scanner becomes the route.",
        "anchor": "pd-privacy-and-enforcement--heading-10",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control"
      },
      {
        "level": 3,
        "text": "Valve can change the product by territory.",
        "anchor": "pd-privacy-and-enforcement--heading-11",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control"
      },
      {
        "level": 3,
        "text": "What does the next unknown result cost?",
        "anchor": "pd-privacy-and-enforcement--heading-12",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control"
      },
      {
        "level": 3,
        "text": "Publish the demand being denounced.",
        "anchor": "pd-privacy-and-enforcement--heading-13",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#nyag-record"
      },
      {
        "level": 3,
        "text": "“Beyond what we normally collect.”",
        "anchor": "pd-privacy-and-enforcement--heading-14",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#privacy-objection-record"
      },
      {
        "level": 3,
        "text": "830 pages about one account.",
        "anchor": "pd-privacy-and-enforcement--heading-15",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#privacy-objection-record"
      },
      {
        "level": 2,
        "text": "Who funded it? Who opens it?",
        "anchor": "pd-privacy-and-enforcement--wallet-age-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#wallet-age-title"
      },
      {
        "level": 3,
        "text": "Physical cards put money into Wallet.",
        "anchor": "pd-privacy-and-enforcement--heading-17",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#wallet-age"
      },
      {
        "level": 3,
        "text": "The person paying can fund someone else.",
        "anchor": "pd-privacy-and-enforcement--heading-18",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#wallet-age"
      },
      {
        "level": 3,
        "text": "A tradable key can become spending balance.",
        "anchor": "pd-privacy-and-enforcement--heading-19",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#wallet-age"
      },
      {
        "level": 2,
        "text": "If the payment failed, show the evidence.",
        "anchor": "pd-privacy-and-enforcement--payment-enforcement-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#payment-enforcement-title"
      },
      {
        "level": 3,
        "text": "Users reported restrictions after payments they said they had not disputed.",
        "anchor": "pd-privacy-and-enforcement--heading-21",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#payment-enforcement"
      },
      {
        "level": 3,
        "text": "The transactions behind the restrictions.",
        "anchor": "pd-privacy-and-enforcement--heading-22",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#amex-timeline"
      },
      {
        "level": 3,
        "text": "Removed game, locked account, no route out.",
        "anchor": "pd-privacy-and-enforcement--heading-23",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#amex-timeline"
      },
      {
        "level": 3,
        "text": "The exception, the warning, the re-lock.",
        "anchor": "pd-privacy-and-enforcement--heading-24",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#amex-timeline"
      },
      {
        "level": 3,
        "text": "Records removed. Games still not restored.",
        "anchor": "pd-privacy-and-enforcement--heading-25",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#amex-timeline"
      },
      {
        "level": 3,
        "text": "Identify the payment event.",
        "anchor": "pd-privacy-and-enforcement--heading-26",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#payment-enforcement"
      },
      {
        "level": 3,
        "text": "Provide a route out of a mistaken restriction.",
        "anchor": "pd-privacy-and-enforcement--heading-27",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#payment-enforcement"
      },
      {
        "level": 2,
        "text": "Valve can document abuse. Apply that standard consistently.",
        "anchor": "pd-privacy-and-enforcement--moderation-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation-title"
      },
      {
        "level": 3,
        "text": "A documented litigation trail.",
        "anchor": "pd-privacy-and-enforcement--heading-29",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 4,
        "text": "The claim was dismissed.",
        "anchor": "pd-privacy-and-enforcement--heading-30",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 4,
        "text": "Valve’s side commissioned a linguistic examination.",
        "anchor": "pd-privacy-and-enforcement--heading-31",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 4,
        "text": "The cassation court upheld the refusal.",
        "anchor": "pd-privacy-and-enforcement--heading-32",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 3,
        "text": "Audit the evidentiary package itself.",
        "anchor": "pd-privacy-and-enforcement--heading-33",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#evidence-package-demand"
      },
      {
        "level": 3,
        "text": "Language was examined as evidence.",
        "anchor": "pd-privacy-and-enforcement--heading-34",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 3,
        "text": "Abusive reports require the same scrutiny.",
        "anchor": "pd-privacy-and-enforcement--heading-35",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation"
      },
      {
        "level": 2,
        "text": "Account for the system that already operates.",
        "anchor": "pd-privacy-and-enforcement--disclosure-demands-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands-title"
      },
      {
        "level": 3,
        "text": "Show the proposed privacy intrusion.",
        "anchor": "pd-privacy-and-enforcement--heading-37",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands"
      },
      {
        "level": 3,
        "text": "Map the data already used.",
        "anchor": "pd-privacy-and-enforcement--heading-38",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands"
      },
      {
        "level": 3,
        "text": "Explain the age gate at the transaction.",
        "anchor": "pd-privacy-and-enforcement--heading-39",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands"
      },
      {
        "level": 3,
        "text": "Make restrictions reviewable.",
        "anchor": "pd-privacy-and-enforcement--heading-40",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands"
      },
      {
        "level": 3,
        "text": "Audit moderation in both directions.",
        "anchor": "pd-privacy-and-enforcement--heading-41",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands"
      },
      {
        "level": 2,
        "text": "Inspect the evidence.",
        "anchor": "pd-privacy-and-enforcement--sources-title",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#sources-title"
      },
      {
        "level": 2,
        "text": "Cited source records",
        "anchor": "pd-privacy-and-enforcement--cited-sources",
        "source_url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement#sources"
      }
    ],
    "links": [
      {
        "label": "Live article",
        "url": "https://phishdestroy.io/steam_dossier/privacy-and-enforcement"
      },
      {
        "label": "Original 11 October edition · complete text →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/privacy-and-enforcement.html"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E71]",
        "url": "https://store.steampowered.com/privacy_agreement/"
      },
      {
        "label": "[E71]",
        "url": "https://store.steampowered.com/privacy_agreement/"
      },
      {
        "label": "[E72]",
        "url": "https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60"
      },
      {
        "label": "[E73]",
        "url": "https://partner.steamgames.com/doc/api/ISteamUtils"
      },
      {
        "label": "[E71]",
        "url": "https://store.steampowered.com/privacy_agreement/"
      },
      {
        "label": "[E72]",
        "url": "https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60"
      },
      {
        "label": "[E90]",
        "url": "https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43"
      },
      {
        "label": "[E74]",
        "url": "https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/"
      },
      {
        "label": "[E71]",
        "url": "https://store.steampowered.com/privacy_agreement/"
      },
      {
        "label": "[E74]",
        "url": "https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/"
      },
      {
        "label": "[E90]",
        "url": "https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43"
      },
      {
        "label": "THE EARLIER DISCLOSURE RECORDOne device. Multiple accounts. Years of retained history.The dossier’s counsel-correspondence account and its source trail ↗",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#technical-capability"
      },
      {
        "label": "[E91]",
        "url": "https://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving"
      },
      {
        "label": "[E75]",
        "url": "https://blog.counter-strike.net/2018/07/20618/"
      },
      {
        "label": "[E75]",
        "url": "https://blog.counter-strike.net/2018/07/20618/"
      },
      {
        "label": "[E76]",
        "url": "https://blog.counter-strike.net/2019/09/25667/"
      },
      {
        "label": "[E77]",
        "url": "https://steamcommunity.com/ogg/730/announcements/detail/518615049848226730"
      },
      {
        "label": "[E78]",
        "url": "https://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B"
      },
      {
        "label": "[E88]",
        "url": "https://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf"
      },
      {
        "label": "[E89]",
        "url": "https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/"
      },
      {
        "label": "[E38]",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E21]",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "Inspect the 830-page production and its audit trail ↗",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#technical-capability"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E38]",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "[E79]",
        "url": "https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers"
      },
      {
        "label": "[E79]",
        "url": "https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers"
      },
      {
        "label": "[E80]",
        "url": "https://store.steampowered.com/digitalgiftcards/selectgiftcard"
      },
      {
        "label": "[E81]",
        "url": "https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key"
      },
      {
        "label": "[E15]",
        "url": "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B"
      },
      {
        "label": "[E66]",
        "url": "https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A"
      },
      {
        "label": "A CONCRETE REGIONAL FUNDING RECORDThe Russian top-up question now has a named provider.Official MTS service, territorial statements and linked card-transfer terms ↗",
        "url": "https://phishdestroy.io/steam_dossier/money-and-enforcement.html#regional-funding"
      },
      {
        "label": "[E92]",
        "url": "https://payment.mts.ru/cyber/steam"
      },
      {
        "label": "[E93]",
        "url": "https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf"
      },
      {
        "label": "[E92]",
        "url": "https://payment.mts.ru/cyber/steam"
      },
      {
        "label": "[E93]",
        "url": "https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf"
      },
      {
        "label": "Continue through the original Steam Dossier ↗",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "FOLLOW THE VALUE AFTER AN ACCOUNT COMPROMISEA protected trade is not protection for every route.Market sales, inflated-price purchases, Wallet proceeds and game gifts ↗",
        "url": "https://phishdestroy.io/steam_dossier/money-and-enforcement.html#market-losses"
      },
      {
        "label": "[E82]",
        "url": "https://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E87]",
        "url": "https://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23"
      },
      {
        "label": "[E83]",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E84]",
        "url": "https://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1"
      },
      {
        "label": "[E86]",
        "url": "https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf"
      },
      {
        "label": "[E85]",
        "url": "https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf"
      },
      {
        "label": "[E86]",
        "url": "https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf"
      },
      {
        "label": "[E85]",
        "url": "https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf"
      },
      {
        "label": "[E86]",
        "url": "https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E21]",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json"
      },
      {
        "label": "[E73]",
        "url": "https://partner.steamgames.com/doc/api/ISteamUtils"
      },
      {
        "label": "THE ORIGINAL MATERIAL REMAINS IN PLACEClient inspection. Retained data. Failed disclosure.Read the 2014–2026 record and the September access-request closure ↗",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#privacy"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "https://store.steampowered.com/privacy_agreement/",
        "url": "https://store.steampowered.com/privacy_agreement/"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60",
        "url": "https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60"
      },
      {
        "label": "https://partner.steamgames.com/doc/api/ISteamUtils",
        "url": "https://partner.steamgames.com/doc/api/ISteamUtils"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43",
        "url": "https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43"
      },
      {
        "label": "https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/",
        "url": "https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/"
      },
      {
        "label": "https://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving",
        "url": "https://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving"
      },
      {
        "label": "https://blog.counter-strike.net/2018/07/20618/",
        "url": "https://blog.counter-strike.net/2018/07/20618/"
      },
      {
        "label": "https://blog.counter-strike.net/2019/09/25667/",
        "url": "https://blog.counter-strike.net/2019/09/25667/"
      },
      {
        "label": "https://steamcommunity.com/ogg/730/announcements/detail/518615049848226730",
        "url": "https://steamcommunity.com/ogg/730/announcements/detail/518615049848226730"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B",
        "url": "https://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B"
      },
      {
        "label": "https://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf",
        "url": "https://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf"
      },
      {
        "label": "https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/",
        "url": "https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/"
      },
      {
        "label": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers",
        "url": "https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers"
      },
      {
        "label": "https://store.steampowered.com/digitalgiftcards/selectgiftcard",
        "url": "https://store.steampowered.com/digitalgiftcards/selectgiftcard"
      },
      {
        "label": "https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key",
        "url": "https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
        "url": "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A",
        "url": "https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A"
      },
      {
        "label": "https://payment.mts.ru/cyber/steam",
        "url": "https://payment.mts.ru/cyber/steam"
      },
      {
        "label": "https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf",
        "url": "https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2",
        "url": "https://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2"
      },
      {
        "label": "https://steamcommunity.com/discussions/forum/0/590688141302606461/",
        "url": "https://steamcommunity.com/discussions/forum/0/590688141302606461/"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23",
        "url": "https://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23"
      },
      {
        "label": "https://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1",
        "url": "https://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1"
      },
      {
        "label": "https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf",
        "url": "https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf"
      },
      {
        "label": "https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf",
        "url": "https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf"
      }
    ],
    "tables": [
      {
        "id": "table-1",
        "caption": "The existing record—not a hypothetical new surveillance system",
        "rows": [
          [
            "Layer",
            "Publicly documented capability",
            "The question it raises"
          ],
          [
            "Account & network",
            "The privacy policy lists SteamID, country of residence and logged IP addresses. [E71]",
            "How are historical account and location signals used when access rules change?"
          ],
          [
            "Device & activity",
            "The same policy lists unique device identifiers, operating-system information, settings and application use. [E71]",
            "Which identifiers persist between sessions and connect accounts or devices?"
          ],
          [
            "Authorised devices",
            "Steam Guard distinguishes unrecognised devices and provides an authorised-device review. [E72]",
            "What protection uses this continuity when the network address changes?"
          ],
          [
            "Country detection",
            "Steamworks exposes GetIPCountry, using an IP-to-location database. [E73]",
            "What additional precision is needed, for which decision, and with what error rate?"
          ]
        ]
      }
    ],
    "cited_source_ids": [
      "E14",
      "E71",
      "E72",
      "E73",
      "E90",
      "E74",
      "E91",
      "E75",
      "E76",
      "E77",
      "E78",
      "E88",
      "E89",
      "E38",
      "E21",
      "E13",
      "E79",
      "E80",
      "E81",
      "E15",
      "E66",
      "E92",
      "E93",
      "E82",
      "E83",
      "E87",
      "E84",
      "E86",
      "E85"
    ]
  },
  "resources": [
    {
      "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json",
      "sha256": "971a37262865935b4057cc84f26c07fdf22b77006643e84eb21a99b18e124bc1",
      "bytes": 154697
    }
  ]
}