# Existing data. Selective privacy.

Canonical: https://phishdestroy.io/steam_dossier/privacy-and-enforcement
Language: en
Author: Agent Noel
Publisher: PhishDestroy
Published: 11 October 2026

EXISTING DATA / ACCESS / REMEDY  REVIEWED 11 OCT 2026 · UTC

THE INFORMATION IS ALREADY THERE.

Valve must account for the power it already uses.

Location signals, device records, payment restrictions and moderation decisions all sit inside the same platform. Invoking privacy against regulation leaves a central question unanswered: how does Valve use that existing control to protect people, and how can a person challenge its use?

[Follow the existing record ↓](https://phishdestroy.io/steam_dossier/privacy-and-enforcement#existing-data)  [The disclosure demands ↗](https://phishdestroy.io/steam_dossier/privacy-and-enforcement#disclosure-demands)

ONE PLATFORM / UNEQUAL VISIBILITY

VALVE CAN **Identify. Correlate. Restrict.**

THE USER NEEDS **The evidence. The reason. A remedy.**

A restriction is an exercise of power. Its justification must be open to challenge.

[01 / TERRITORY **Rules already change by country.** **↘**](https://phishdestroy.io/steam_dossier/privacy-and-enforcement#regional-control)  [02 / AGE **The payer is not necessarily the player.** **↘**](https://phishdestroy.io/steam_dossier/privacy-and-enforcement#wallet-age)  [03 / ENFORCEMENT **Apply the evidential standard consistently.** **↘**](https://phishdestroy.io/steam_dossier/privacy-and-enforcement#moderation)

01

THE BASELINE VALVE’S RESPONSE LEAVES OUT

## A VPN does not erase the account’s history.

Valve describes additional location checks as a new worldwide intrusion. Assessing that claim requires an inventory of the information already collected and the decisions already made with it. [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

The existing record—not a hypothetical new surveillance system

| Layer | Publicly documented capability | The question it raises |
| --- | --- | --- |
| Account & network | The privacy policy lists SteamID, country of residence and logged IP addresses. [E71](https://store.steampowered.com/privacy_agreement/) | How are historical account and location signals used when access rules change? |
| Device & activity | The same policy lists unique device identifiers, operating-system information, settings and application use. [E71](https://store.steampowered.com/privacy_agreement/) | Which identifiers persist between sessions and connect accounts or devices? |
| Authorised devices | Steam Guard distinguishes unrecognised devices and provides an authorised-device review. [E72](https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60) | What protection uses this continuity when the network address changes? |
| Country detection | Steamworks exposes `GetIPCountry`, using an IP-to-location database. [E73](https://partner.steamgames.com/doc/api/ISteamUtils) | What additional precision is needed, for which decision, and with what error rate? |

THE LAYERS THAT ALREADY EXIST

### A VPN changes the route, not the record.

Name the layers. The browser session that registered the account. The game client that still phones home from the same machine. The CDN and ASN fingerprints Valve’s own servers log on every request. [E71](https://store.steampowered.com/privacy_agreement/) [E72](https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60)

A player who registers on the web in New York, connects through a VPN and launches the same client leaves a chain Valve already records: one machine, one client build, one account history, requests crossing Valve’s own network edge at every step. Local transfers move installations between machines; they do not delete the download and authorisation events already logged. [E90](https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43)

**Publish that chain**  — device, client build, network trace, account history — before claiming that only new, total collection can establish location.

THE TECHNICAL POINT

**Changing a network route does not inherently reset an application’s device identifier.**  A long account history followed by a VPN connection can therefore be evaluated alongside existing device and authorisation records. Valve should disclose how those signals are assessed, what they can establish and which less intrusive options it tested.

IP intelligence can classify known VPN and hosting infrastructure. MaxMind documents such classifications and their limits. Valve should publish the location signals it actually uses, the decision thresholds, the treatment of account history and the procedure for correcting a mistaken restriction. [E74](https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/)

THE INVESTIGATION’S TESTS / REGISTRATION

### Registration was refused behind a VPN.

In the investigation’s own tests, account registration was refused while connected through a VPN. That is an observation, not a statistic: the dated reproduction — connection conditions, time, displayed refusal and the resulting account decision — belongs beside the registration and connection records Valve already keeps, which can state the rule that fired and its error rate. [E71](https://store.steampowered.com/privacy_agreement/)

THE OPEN LEAD / NORDVPN

### What share of New York users arrive through NordVPN?

The author’s lead, stated as a question and not as a finding: what share of New York Steam users reach the platform through NordVPN? It is measurable, and Valve’s own connection records can answer it — connection counts by exit network for New York accounts, beside the location decisions those connections produced. No market share is asserted here; the record is the demand. [E74](https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/)

**Device records, network history and Valve’s disclosure duty**

Valve should identify the device fields its clients collect, including whether hardware and network identifiers enter its account-security or location decisions. Publish their purpose, retention, cross-account use and correction process. The relevant records are held by the platform operating the client.

Name the fields behind the generalisation. “Hardware and network identifiers” has specific candidates: MAC address, motherboard serial, disk serial. The demand is field-level — for each field, whether Steam’s clients collect it, where it is retained, and which account-security or location decisions it enters. Universal collection is not established on this record; field-level disclosure is what would establish or refute it.

Downloads, authorisations and later account access leave a sequence of dated events. Steam also supports local-network installation transfers. Valve should explain which of those records enter its regional checks, how they are combined and why additional collection is necessary when an established account changes its network route. [E90](https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43)

The CS2 client download and its network trace are the concrete case: downloads, authorisations and later account access leave a sequence of dated events across Valve’s own CDN and ASN. That sequence is logged by Valve’s own infrastructure; it should be published with the account decisions it can inform, not folded into a claim that only new collection can locate a user.

The investigation’s VPN and registration tests belong beside that disclosure: connection conditions, time, displayed restriction and the resulting account decision. This makes Valve’s existing regional controls inspectable and gives users a concrete basis for challenging an inconsistent result.

[THE EARLIER DISCLOSURE RECORD **One device. Multiple accounts. Years of retained history.** The dossier’s counsel-correspondence account and its source trail ↗](https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#technical-capability)

02

VALVE’S OWN PRODUCT HISTORY

## The regional switch already exists.

Country-specific container rules are a documented part of Counter-Strike. Valve’s privacy argument must explain what the proposed controls add to this existing system.

25 APR 2018 / BELGIAN MINISTER OF JUSTICE

### Belgium named CS:GO explicitly.

The minister’s release reports the Gaming Commission’s finding that paid loot boxes in CS:GO, FIFA 18 and Overwatch fell under Belgian gambling law. It called for their removal and highlighted the lack of player protection. This is a directly identified Valve game in a primary regulatory record. [E91](https://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving)

The source is a ministerial account of the Commission’s position. The subsequent Valve restriction is documented separately in the July release notes.

NETHERLANDS / 11 JUL 2018 **Trading & Market: restored.**

The ability to exchange was brought back.

THE SAME RELEASE **Container opening: restricted.**

Valve changed access to the paid opening separately. [E75](https://blog.counter-strike.net/2018/07/20618/)

11 JUL 2018

### Netherlands & Belgium: container opening restricted.

Valve’s release notes restored Trading and Market for Dutch customers while restricting container opening in both countries. This was a product-access decision tied to territory. [E75](https://blog.counter-strike.net/2018/07/20618/)

30 SEP 2019

### France: X-Ray Scanner introduced.

Valve introduced a preview mechanism that consumes the container. Advancing to another reveal requires claiming the previous result. [E76](https://blog.counter-strike.net/2019/09/25667/)

16 MAR 2026

### Netherlands & Germany: the scanner becomes the route.

Valve announced X-Ray Scanner access for these players, with an exception for keyless containers such as Souvenir Packages. The Netherlands record therefore changes in 2026; the announcement does not name Belgium. [E77](https://steamcommunity.com/ogg/730/announcements/detail/518615049848226730)

REGIONAL CONTROL / THE DEMONSTRATED CAPABILITY

### Valve can change the product by territory.

Valve should disclose the architecture and effectiveness of the regional control it already operates, including its handling of VPN connections, existing account history and contested decisions. The company owes users an explanation of the alternatives it considered and the remaining gaps.

X-RAY / THE ECONOMIC QUESTION

### What does the next unknown result cost?

The current FAQ requires purchase and receipt of the revealed item before another scan. Analysis must follow the paid sequence, including the cost of advancing, rather than stop at the presence of a preview. [E78](https://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B)

**The Dutch record: the ruling and Valve’s own response**

The Dutch regulator’s April 2018 study found four of ten examined implementations inconsistent with its gambling-law analysis; it linked transferable prizes to economic value. The games were anonymised. [E88](https://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf)

The Council of State’s 9 March 2022 ruling overturned the penalty in the EA FIFA/FUT case. Valve’s own Dutch record is the regional product change documented above: it altered trading access and container opening separately. Those are the mechanisms that its present defence must explain. [E89](https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/)

PUBLIC COMPLAINT / PRIVATE NEGOTIATIONS

### Publish the demand being denounced.

The filed NYAG complaint alleges an age-confirmation checkbox rather than age verification (¶144). Its requested relief does not prescribe universal VPN detection, biometrics or worldwide identity-document collection. Valve’s account of proposed additional collection describes pre-litigation discussions. [E38](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf) [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

**Release the proposals:**  required data, affected users, retention periods and alternatives considered. The public cannot audit a sweeping privacy objection from one party’s summary of unpublished negotiations.

THE OBJECTION / 11 MAR 2026

### “Beyond what we normally collect.”

Valve’s own words, quoted before they are dismantled: the NYAG proposal would gather additional information “beyond what we normally collect in the course of processing payments” — collection that “would have involved implementing invasive technologies for every user worldwide.” [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

“Normally collect” sets a baseline; “invasive technologies for every user worldwide” sets a fear. Both halves are testable against a record Valve itself has already produced.

THE PRODUCTION / OCT 2025

### 830 pages about one account.

Months before that statement, Valve answered a single user’s Article 15 access request with an 830-page appendix: 902,270 covered characters still extractable beneath the failed masking. No payment processor handed Valve that file — Valve’s own systems produced it, hold it, and disclosed it only under statutory compulsion. [E21](https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json) [E13](https://phishdestroy.io/steam_dossier/)

Publish what “normally collected” already covers before it is accepted as a narrow baseline.  [Inspect the 830-page production and its audit trail ↗](https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#technical-capability)

03

PAYMENT IDENTITY IS NOT PLAYER AGE

## Who funded it? Who opens it?

Valve invokes age checks built into most payment methods used by its New York customers. That does not establish the age of the person spending an already funded Wallet. The system itself separates funding from use. [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

01

RETAIL CASH / THE HISTORICAL ROUTE

### Physical cards put money into Wallet.

The complaint expressly describes retail gift cards bought with cash (¶29). That route cannot be answered solely by referring to a bank’s checks on a cardholder. [E38](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf)

**The historical record:**  the cash route is not hypothetical. Valve’s own current FAQ dates the retail programme to 2012 [E79](https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers); GameStop’s 14 May 2012 partnership announcement, preserved in a contemporary reprint, described cash-funded Steam Wallet at physical stores; and a 2019 archival capture of Valve’s gift-card page described the physical cards as suiting cash-in-hand purchases. Valve itself marketed physical cards to buyers without bank instruments — years of its own record, not an invented funding route.

**2026 policy change:**  Valve is ending its retail gift-card programme. Stores will not be restocked; Valve expects stock to run out by the end of 2026. Existing cards remain redeemable, subject to local law. The FAQ attributes the decision to persistent gift-card scams. [E79](https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers)

02

DIGITAL GIFTS / DIFFERENT PEOPLE

### The person paying can fund someone else.

Valve sells digital gifts that credit a recipient’s Wallet. Checking the buyer’s payment method does not identify the recipient currently using the game. Existing Wallet funds cannot buy these digital gift cards. [E80](https://store.steampowered.com/digitalgiftcards/selectgiftcard)

03

TF2 ITEMS / THE MARKET BRIDGE

### A tradable key can become spending balance.

Valve’s Mann Co. Supply Crate Key listing marks the TF2 item as tradable and marketable. Eligible Community Market sales produce Wallet funds. An externally acquired item can therefore reach the spending balance without the player’s own card funding that sale. [E81](https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key) [E15](https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B)

Market access has separate eligibility conditions, and sales proceeds alone do not remove limited-account status. These are separate gates; neither is a documented verification of the current player’s age. [E66](https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A)

THE FAILURE IN THE RESPONSE

**A check on one funding route cannot stand in for a check at the paid random outcome.**  Valve must identify the control that connects the person opening a container to a verified age, across gifts, item-sale proceeds and pre-existing balances.

[A CONCRETE REGIONAL FUNDING RECORD **The Russian top-up question now has a named provider.** Official MTS service, territorial statements and linked card-transfer terms ↗](https://phishdestroy.io/steam_dossier/money-and-enforcement.html#regional-funding)

Inspect the original service and its linked terms: [E92](https://payment.mts.ru/cyber/steam) [E93](https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf)

**External funding, cryptocurrency and regional top-ups**

An outside item purchase may be settled in money or cryptocurrency while the subsequent Steam sale credits Wallet. The payment, item delivery and Wallet credit are separate records. This page establishes the Steam leg; the fee, hold period and restriction risk for each outside seller are records held by that seller and by Valve, and they must be published beside the Community Market’s own fee schedule and hold periods.

The Russia, Crimea and Donetsk top-up record now names its provider and settlement centre [E92](https://payment.mts.ru/cyber/steam) [E93](https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf). The contracting entities, transaction dates, settlement path, turnover totals and any Valve agreement are records held by MTS Payment, the settlement bank and Valve; they must publish them, and any sanctions finding rests on those disclosures.  [Continue through the original Steam Dossier ↗](https://phishdestroy.io/steam_dossier/)

The routes establish an age-linkage problem. Valve holds the registered ages of the accounts using each route, and each retailer holds the age checks it applied; those records, not an invented minors statistic, must answer the question.

[FOLLOW THE VALUE AFTER AN ACCOUNT COMPROMISE **A protected trade is not protection for every route.** Market sales, inflated-price purchases, Wallet proceeds and game gifts ↗](https://phishdestroy.io/steam_dossier/money-and-enforcement.html#market-losses)

04

RESTRICTION FIRST / EXPLANATION AFTERWARDS

## If the payment failed, show the evidence.

Steam’s chargeback policy restricts associated accounts and purchases. Its standard remedy sends the payment-method owner to the bank to reverse the dispute; return of funds restores the purchase and removes the restriction. If reversal is impossible, the user is directed to Support. [E82](https://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2)

29—31 AUG **2026**  AMERICAN EXPRESS FIRST-PERSON REPORTS

### Users reported restrictions after payments they said they had not disputed.

In a Steam forum thread, users described removed purchases and payment restrictions involving AmEx. A 31 August account said Support lifted the restriction as an exception and warned about recurrence. These are direct user accounts of the incident; a confirmed cause from Valve, AmEx or the processor was not found. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

The unresolved issue is concrete: **what can the user challenge when Steam says “dispute” and the bank cannot supply the corresponding record?**

The reports share a concrete shape: real card owners, transactions that failed or were cancelled outright, account locks that followed — and template support text in reply. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

17—18 AUG 2026

### The transactions behind the restrictions.

Users dated the disputed charges to 17—18 August 2026 — purchases they denied ever disputing. One user’s card issuer confirmed two approved authorisations of $8.23 on 17 August, only one of which Steam’s processor captured and posted; the second expired uncollected. That account of an issuer conversation is relayed testimony, not an audited finding. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

Another user reported the charge never reached AmEx at all: four days of processing attempts visible in Steam’s purchase history, nothing in the cardholder’s AmEx statement. A charge that never completed leaves the card owner nothing to produce — the evidentiary impossibility at the centre of the episode.

29 AUG 2026

### Removed game, locked account, no route out.

The thread’s opening report: a game removed after twelve days of play over a charge the bank said it never disputed, with repurchase refused and new payment methods rejected. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

31 AUG 2026

### The exception, the warning, the re-lock.

Support lifted one user’s restriction “as an exception,” warning the account could be permanently locked if it happened again — while the disputed purchase stayed removed. Another user reported a second 17 August transaction re-triggering restrictions after an earlier unlock. A third reported Support giving “the same stock responses,” repeating “call American Express” and refusing to supply a Transaction ID or escalate to a payment specialist. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

02 SEP 2026

### Records removed. Games still not restored.

A user reported the chargeback records had been removed from the account — but AmEx still declined, and the disputed games were still not restored. Removing the flag did not return the purchase, and the basis of the original restriction was never supplied. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

THE RECORD

### Identify the payment event.

Distinguish authorisation failure, settlement failure, reversal and a customer-initiated dispute. Supply a transaction reference and the restriction’s actual basis.

THE REVIEW

### Provide a route out of a mistaken restriction.

State who reviews conflicting records, what evidence is accepted, which functions are restricted and when a decision can be expected.

Valve’s restriction policy includes chargebacks under payment fraud and permits restrictions across an individual’s accounts. It also distinguishes account locks, Community Bans, trade bans, VAC bans and suspensions. The relevant notice and effect must be recorded; “banned account” is not a sufficient classification. [E87](https://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23)

THE DEMAND

**Valve and its payment processor should publish the transaction event records behind these account actions.**  Authorisation, capture, settlement, reversal and dispute status for each transaction, tied to the restriction it produced and the account decision that followed. The parties whose systems generated the events can produce the record; the user cannot produce a statement for a charge that never completed. “Call your bank” is not evidence — it is the absence of one. [E83](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

THE ENFORCEMENT QUESTION

**Valve can make a payment event immediately consequential for the user.**  The corresponding obligation is a usable explanation and correction process. Calling a remedy an exception does not explain whether the original classification was right.

05

THE STANDARD OF PROOF MUST TRAVEL BOTH WAYS

## Valve can document abuse. Apply that standard consistently.

Valve’s discussion of media and real-world violence does not answer the question of threats and abuse inside its own reporting and support systems. The relevant record is what people submitted, how Valve assessed it and what decisions followed. [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

SMIRNOV v. VALVE / NEVSKY DISTRICT COURT

### A documented litigation trail.

Case № 2-5519/2022 · UID 78RS0015-01-2021-007838-13

01 SEP 2022

#### The claim was dismissed.

The Nevsky District Court decision dates to 1 September; final form followed on 2 September. The requested RUB 74,598,433 penalty and RUB 50 million moral-damage award were separate demands. The widely circulated 13 September date concerns reporting of the case. [E84](https://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1) [E86](https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf)

28 JUN 2023

#### Valve’s side commissioned a linguistic examination.

The 66-page GLADIS report, published by its authors, identifies an 8 June contract with the Baker & McKenzie CIS branch. It examines the claimant’s correspondence with Steam Support, using submitted screenshots and translated printouts. This was a party-commissioned specialist report. [E85](https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf)

22 MAY 2024

#### The cassation court upheld the refusal.

The court describes escalating Community restrictions and the expert findings on insults, discriminatory statements and threats. It records that the claimant declined the opportunity to seek a court-appointed examination or submit contrary evidence. Case № 88-10528/2024. [E86](https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf)

THE SUBMITTED FILE / A MATERIAL DIMENSION

### Audit the evidentiary package itself.

The record has a material dimension this page has not audited: the PDF Valve’s side submitted. The report, the translated printouts and the screenshots were filed as evidence — and how that package was assembled and edited shows what Valve’s counsel treats as an acceptable evidentiary file. [E85](https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf) [E86](https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf)

**Reproduce the submitted materials** , with third-party identifiers protected, and audit the file itself: who compiled it, what was cut, and whether the court received the same text the reports contained. The standard Valve demands of a sanctioned user’s words applies to the file its own side carried into court.

THE LITIGATION RECORD

### Language was examined as evidence.

Valve’s side obtained an extended analysis to support a sanction. This demonstrates that its enforcement position can be particularised and tested against a record.

THE DOSSIER’S DISCLOSURE RECORD

### Abusive reports require the same scrutiny.

The Steam Dossier describes nationality-based abuse and death wishes in retained reports. Its public audit establishes failed masking across 830 pages and 902,270 extractable covered characters. [E13](https://phishdestroy.io/steam_dossier/) [E21](https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json)

ONE RULE / AN AUDITABLE APPLICATION

**Which reports were used against their target, and what happened to abusive reporters?**  Publish anonymised decision records showing the allegation, assessment, rule applied, sanction and appeal result. Evidence submitted to justify a sanction must be distinguished from material merely retained in a file.

**Follow the report from submission to sanction**

The aggregate audit counts 177 occurrences of the heading “Abuse Reporter Account Name”. That is a document-label count, not a count of unique complainants, abusive reports or proven violations. It does not record the moderation outcome for each report.

For the reported pornographic link, Valve should produce the processing history and an appropriately redacted exhibit: who assessed it, whether it was relied upon, which rule applied and what decision followed. The audit should expose the handling of the report while protecting third-party identifiers.

Steamworks documents text-filtering functions. Valve should identify the filters and rules actually applied to threats, discriminatory abuse and links submitted through its reporting systems, and release the corresponding decision traces. The same scrutiny it applies to a sanctioned user’s language must reach abusive submissions used against that user. [E73](https://partner.steamgames.com/doc/api/ISteamUtils)

Publish comparable sanctions and appeals alongside inventory value, violation category and final remedy. That record would show how consistently Valve applies its rules when the account contains a valuable collection.

[THE ORIGINAL MATERIAL REMAINS IN PLACE **Client inspection. Retained data. Failed disclosure.** Read the 2014–2026 record and the September access-request closure ↗](https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#privacy)

06

A CONCRETE TEST OF VALVE’S POSITION

## Account for the system that already operates.

The investigation calls for access to existing decision records, minimised and protected where necessary. Expanding data collection is not a prerequisite for examining how Valve exercises its present power.

1. 01

### Show the proposed privacy intrusion.

Release NYAG’s actual proposals and Valve’s alternatives: data categories, affected users, necessity, retention and safeguards.
2. 02

### Map the data already used.

Identify location and device fields, cross-account matching, retention, error rates and the decisions they inform.
3. 03

### Explain the age gate at the transaction.

Account for existing balances, gift funding and Market proceeds; identify how the current player’s age is established.
4. 04

### Make restrictions reviewable.

Provide the reason, evidence reference, scope, reviewer and correction route for payment and commercial-use restrictions.
5. 05

### Audit moderation in both directions.

Trace reports to findings, sanctions and appeals, including abusive submissions and any relationship to inventory value.

THE FINDING

**Valve’s existing control is documented. The adequacy and accountability of its use remain the issue.**  A privacy slogan, a payment-method generalisation and an aggregate ban count do not supply the missing decision record.

07

THE PUBLIC RECORD

## Inspect the evidence.

29 RECORDS

Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.

**Research method and source status**

Reviewed 11 October 2026 UTC. Official policies and product announcements establish documented capabilities and rules. The public complaint states the plaintiff’s allegations. Court dates and findings are tied to the cited acts; user incident reports remain attributed testimony.

The analysis connects existing account and device data, territorial product changes, payment restrictions and moderation records. It asks Valve to account for the decisions already made with that information, the consequences for users and the remedies provided.

## Cited source records

### E13 · The Steam Dossier — rules, routes and accountability

Publisher: PhishDestroy
Date: Related investigation
Reviewed: 10 October 2026

[Original record](https://phishdestroy.io/steam_dossier/)

The parent investigation supplies the historical registration and consent exhibits, transfer-substitution sequence, route register, ownership and recovery records, and correspondence used by this companion investigation.

Record scope: The parent PhishDestroy investigation; linked as the wider editorial and infrastructure context.

### E14 · About the New York Attorney General lawsuit against Valve

Publisher: Valve
Date: 11 Mar 2026
Reviewed: 10 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5)

The public collectibles comparison, optional and cosmetic framing, transferability argument, account-ban total, privacy objections and legislative position.

Record scope: Corporate public response dated 11 March 2026; linked alongside the filed complaint and the investigation’s analysis.

### E15 · Steam Community Market FAQ — Wallet proceeds and market limits

Publisher: Valve / Steam Support
Date: Live FAQ · reviewed 10 Oct 2026
Reviewed: 10 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B)

Market sale proceeds in Steam Wallet and the approximate US$1,800 listing limit.

Record scope: Steam’s own market and Wallet mechanics, used in the ownership and outside-price comparison.

### E21 · Disclosure audit — 830-page appendix

Publisher: PhishDestroy
Date: Published audit · reviewed 20 Sep 2026
Reviewed: 10 October 2026

[Original record](https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json)

Page-level redaction geometry, character counts and source-file SHA-256 for the appendix to the October 2025 access response.

Record scope: The public audit contains aggregate findings and the source hash; the original personal-data appendix is withheld.

### E38 · People of New York v. Valve Corporation — filed complaint

Publisher: New York Attorney General / NYSCEF
Date: 25 Feb 2026
Reviewed: 10 October 2026

[Original record](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf)

Court, filing date, index 450952/2026, allegations, statutory bases and requested remedies.

Record scope: NYSCEF document 2; 52-page court-stamped complaint. Requested relief appears on PDF pages 50–51.

### E66 · Limited User Accounts

Publisher: Valve / Steam Support
Date: Live FAQ · reviewed 10 Oct 2026
Reviewed: 10 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A)

Qualifying $5 spending and specified restricted community features.

Record scope: Steam’s published requirements for access to trading and the Community Market.

### E71 · Steam Privacy Policy — existing collection

Publisher: Valve
Date: Current policy · §§3.1–3.8
Reviewed: 11 October 2026

[Original record](https://store.steampowered.com/privacy_agreement/)

SteamID, residence country, IP logs, unique device identifiers and application/device data are publicly disclosed categories.

Record scope: Valve’s policy lists data categories and their declared purposes; field-level implementation is part of the requested disclosure.

### E72 · Account Security Recommendations — authorised devices

Publisher: Valve / Steam Support
Date: Current guidance
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60)

Steam Guard checks unrecognised devices and provides an authorised-device review.

Record scope: Steam’s description of recognised-device authorisation and account protection.

### E73 · ISteamUtils — country and text-filtering functions

Publisher: Valve / Steamworks
Date: Current developer documentation
Reviewed: 11 October 2026

[Original record](https://partner.steamgames.com/doc/api/ISteamUtils)

GetIPCountry returns a country code from an IP-location database. FilterText and InitFilterText document filtering facilities.

Record scope: Documented Steamworks interface functions. The operational decision trail is requested from Valve.

### E74 · GeoIP Anonymous IP — VPN and hosting classifications

Publisher: MaxMind
Date: Current technical documentation
Reviewed: 11 October 2026

[Original record](https://dev.maxmind.com/geoip/docs/databases/anonymous-ip/binary/)

Documented classifications include known VPN and hosting-provider addresses, with stated detection limits.

Record scope: Industry technique only. No claim that Valve is a customer or uses this particular service.

### E75 · Release Notes for 7/11/2018 — Netherlands and Belgium

Publisher: Valve / Counter-Strike
Date: 11 Jul 2018
Reviewed: 11 October 2026

[Original record](https://blog.counter-strike.net/2018/07/20618/)

Trading and Market restored for Dutch customers; container opening restricted in the Netherlands and Belgium.

Record scope: July 2018 release notes. The subsequent Netherlands change is recorded separately in E77.

### E76 · France — introducing the X-Ray Scanner

Publisher: Valve / Counter-Strike
Date: 30 Sep 2019
Reviewed: 11 October 2026

[Original record](https://blog.counter-strike.net/2019/09/25667/)

Country-specific reveal and claim sequence, including consuming a scanned container.

Record scope: September 2019 release notes describing the French X-Ray mechanism and contemporaneous Market rules.

### E77 · X-Ray Scanner for Germany and the Netherlands

Publisher: Valve / Counter-Strike 2
Date: 16 Mar 2026
Reviewed: 11 October 2026

[Original record](https://steamcommunity.com/ogg/730/announcements/detail/518615049848226730)

Scanner access for Germany and the Netherlands; keyless containers exempted.

Record scope: Also verified in the official Steam announcement feed. Belgium is not named in this update.

### E78 · Counter-Strike 2 — X-Ray Scanner

Publisher: Valve / Steam Support
Date: Current FAQ
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/7336-6EBC-1923-EE1B)

The revealed item must be purchased and received before another scan; scanning consumes the container.

Record scope: Steam’s description of the reveal, purchase and next-scan sequence.

### E79 · Steam Wallet — retail gift-card phase-out

Publisher: Valve / Steam Support
Date: FAQ v18 · metadata 10 Jun 2026
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59#retailers)

Retail stocks are not replenished; expected exhaustion by the end of 2026. Existing cards remain redeemable, subject to local law. Valve cites persistent scams.

Record scope: Retrieved 11 October 2026; includes the page’s embedded update timestamp.

### E80 · Digital Gift Cards — funding another account

Publisher: Valve / Steam Store
Date: Current gift-card FAQ
Reviewed: 11 October 2026

[Original record](https://store.steampowered.com/digitalgiftcards/selectgiftcard)

A payer can buy Wallet credit for a recipient. Existing Wallet funds cannot buy digital gift cards.

Record scope: A digital Wallet gift differs from a game gift. Country and recipient eligibility rules apply.

### E81 · TF2 — Mann Co. Supply Crate Key

Publisher: Valve / Steam Community Market
Date: Current official item listing
Reviewed: 11 October 2026

[Original record](https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key)

The listing’s asset data marks the key as tradable and marketable; the item has a Steam Market order interface.

Record scope: Steam’s item listing, showing the trading and Market attributes of the TF2 key.

### E82 · Payment Disputes and Chargebacks

Publisher: Valve / Steam Support
Date: Current policy · metadata 15 May 2024
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/783F-5E0F-9834-22D2)

Associated account/purchase restrictions, bank-reversal route, restoration when funds return, and Support escalation when reversal is impossible.

Record scope: Steam’s published payment-dispute policy and described restrictions.

### E83 · STEAM payment system broken? — AmEx incident reports

Publisher: Steam Community users
Date: 29–31 Aug 2026
Reviewed: 11 October 2026

[Original record](https://steamcommunity.com/discussions/forum/0/590688141302606461/)

First-person reports of removed purchases and payment restrictions; one user reports a Support exception and warning on 31 August.

Record scope: Unverified participant testimony. No published confirmation of root cause from Valve, AmEx or the processor was found in this review.

### E84 · Smirnov v. Valve — case 2-5519/2022

Publisher: Nevsky District Court, Saint Petersburg
Date: 1 Sep 2022 · final form 2 Sep 2022
Reviewed: 11 October 2026

[Original record](https://nvs--spb.sudrf.ru/modules.php?delo_id=1540005&name=sud_delo&name_op=doc&new=&number=812812802&srv_num=1&text_number=1)

Official case identity and first-instance refusal. UID 78RS0015-01-2021-007838-13.

Record scope: Court hosting can be intermittently unavailable. The later cassation act independently records the 1 September decision date.

### E85 · Specialists’ report on Smirnov’s Steam Support correspondence

Publisher: GLADIS / Guild of Linguistic Experts
Date: 28 Jun 2023 · 66 pages
Reviewed: 11 October 2026

[Original record](https://rusexpert.ru/public/expertizy-pdf/ZaklGLADSmirnvsValve2023.pdf)

Author-hosted report identifies an 8 June 2023 contract with the Baker & McKenzie CIS branch and the correspondence examined.

Record scope: A 66-page, party-commissioned specialist report; the commissioning relationship and date appear in the report.

### E86 · Smirnov v. Valve — cassation 88-10528/2024

Publisher: Third Cassation Court of General Jurisdiction
Date: 22 May 2024
Reviewed: 11 October 2026

[Original record](https://opis-cdn.tinkoffjournal.ru/mercury/delo-88-10528-2024.pdf)

Procedural history, monetary demands, Community restrictions and the court’s treatment of the linguistic report.

Record scope: Copy of the court act hosted by T—J. It records an opportunity to seek a court examination or contrary evidence, declined by the claimant.

### E87 · Restricted Steam Account — reasons and restriction types

Publisher: Valve / Steam Support
Date: Current policy · metadata 22 May 2025
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/4F62-35F9-F395-5C23)

Payment-fraud and commercial-use grounds; distinctions among locks, Community Bans, trade bans, VAC bans and suspensions.

Record scope: The actual account notice and decision record are needed to establish the scope and basis of an individual restriction.

### E88 · Onderzoek naar loot boxes — Een buit of een last?

Publisher: Kansspelautoriteit
Date: 19 Apr 2018
Reviewed: 11 October 2026

[Original record](https://kansspelautoriteit.nl/sites/default/files/onderzoek_naar_loot_boxes_-_een_buit_of_een_last_-_nl.pdf)

Regulatory analysis of ten implementations; four considered noncompliant. Transferability was connected to economic value.

Record scope: The Dutch regulator’s 2018 study of ten anonymised implementations and the economic significance of transferable prizes.

### E89 · EA / FIFA-FUT — ECLI:NL:RVS:2022:690

Publisher: Raad van State
Date: 9 Mar 2022
Reviewed: 11 October 2026

[Original record](https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/)

The Council of State overturned the penalty against EA on the implementation-specific record before it.

Record scope: The Council of State’s 9 March 2022 ruling on EA’s FIFA/FUT implementation.

### E90 · Steam Local Network Game Transfers

Publisher: Valve / Steam Support
Date: Current technical guidance
Reviewed: 11 October 2026

[Original record](https://help.steampowered.com/en/faqs/view/46BD-6BA8-B012-CE43)

Game installation and update files can be copied between eligible computers over a local network.

Record scope: Valve’s documentation of transferring installed game files between devices over a local network.

### E91 · Belgian loot-box findings expressly name CS:GO

Publisher: Koen Geens / Belgian Minister of Justice
Date: 25 Apr 2018
Reviewed: 11 October 2026

[Original record](https://www.koengeens.be/news/2018/04/25/loot-boxen-in-drie-videogames-in-strijd-met-kansspelwetgeving)

The minister’s release reports the Gaming Commission’s finding that paid loot boxes in CS:GO, FIFA 18 and Overwatch fell under Belgian gambling law and called for removal.

Record scope: The Belgian minister’s contemporary account of the Gaming Commission’s findings and requested action.

### E92 · Russia-facing Steam top-ups — published service and territorial statements

Publisher: MTS Payment
Date: Retrieved 11 Oct 2026
Reviewed: 11 October 2026

[Original record](https://payment.mts.ru/cyber/steam)

The official service offers ruble-funded Steam top-ups for Russian accounts. Its FAQ explicitly discusses delays or failures for Crimea, LNR and DNR accounts.

Record scope: Provider’s public offer and descriptions; no transaction was made. Settlement intermediaries, any Valve agreement and sanctions compliance require separate records.

### E93 · Public offer — bank-card money-transfer service

Publisher: MTS Payment / Murmansk Settlement Bank
Date: 2026 document · retrieved 11 Oct
Reviewed: 11 October 2026

[Original record](https://staticpayment.ssl.mts.ru/upload/%D0%9F%D1%83%D0%B1%D0%BB%D0%B8%D1%87%D0%BD%D0%B0%D1%8F_%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0_2026.pdf)

The linked card-transfer offer identifies the settlement centre as Murmansk Settlement Bank LLC and the transfer currency as Russian rubles.

Record scope: Terms governing the named card-transfer service and its participants.