[2023] TIL: Riot's ToS allows them to keep your personal data after request for erasure for business interests of legal obligations (ToS update)

With the new recent pop-up to accept the terms and services, I got curious and decided to google what they contained. Terms of Service ; Didn't Read have a bullet point version of what (I assume is) what we're accepting. I think it's important for the community to understand them, so here they are. tosdr color-codes them depending on how "bad" they are for the user.

Color Code	ToS
Red	You waive your moral rights
Yellow	This service may keep personal data after a request for erasure for business interests or legal obligations
Yellow	The service can delete your account without prior notice and without a reason
Yellow	You waive your right to a class action.
Yellow	This service forces users into binding arbitration in the case of disputes
Yellow	This service reserves the right to disclose your personal information without notifying you
Yellow	The service uses third party tracking pixels to track social media conversion
Yellow	Usernames can be rejected or changed for any reason
Yellow	You must provide your legal name, pseudonyms are not allowed
Yellow	Any liability on behalf of the service is only limited to the fees you paid as a user
Green	User logs are deleted after a finite period of time
Green	Users can access most of the pages on the service's website without revealing any personal information
Green	You can request access and deletion of personal data
Green	If you offer suggestions to the service, they may use that without your approval or compensation, but they do not become the owner
Green	You can opt out of promotional communications

Then there are 28 neutral terms (e.g. "Prohibits the posting of pornographic content").

Riot ToS
Website used for the bullet point list

Not a law expert, but it is interesting how they can simultaneously keep any personal information we add to the account in order to sell to other companies, but they're also required to delete it after a certain time frame.

External link →

Originally posted by RiotBoppenheimer

Hey, I'm not a legal expert but I am a member of our security team, which works closely with our privacy team.

We have a pretty thorough deletion process for personal information, which is called the Right To Be Forgotten. If a player requests their account be deleted, effectively any personal information on them is destroyed within 30 days or so of that request.

The only information that could be tied to a player after that point would be things that we are legally required to keep a record of, and it would be in as anonymized a format as it can be. That information is things we have a justifiable legal interest in. Examples might be a chat log between you and other players, which would be anonymized, for a period of time, or transaction logs.

> but it is interesting how they can simultaneously keep any personal information we add to the account in order to sell to other companies

Riot doesn't sell your personal information to other companies. Any personal information you do give us is limited to the relevant scope within the company - for example, payment information doesn't get used outside of processing payments for purchases.

Our privacy policy and the way we handle personally identifiable information is, in general, shaped by GDPR, regardless of the region you're living in. So if you're living in the US or other regions we operate in, your data is still handled in compliance with the GDPR, broadly speaking.

Confirmed /u/RiotBoppenheimer is legit, just in case anyone was a little 🤨 about lack of flair

Recent League of Legends Posts

Riot leaked NEW ZED R FEATURE?! (120$ Zed Skin Accident)(Zed R Direction Indicator on New Skin)

RiotPhroxzon on the PBE lane swap changes

Report warning. Help me understand!

League of legends matching algorithm study