A piece of software called Red Shell that's used by game developers for marketing analysis has caused an uproar among gamers who are concerned by its ability to generate detailed "fingerprints" of users—in many cases without them knowing about it.
"Imagine a game developer is running an ad on Facebook and working with a popular Twitch channel," the Red Shell website explains. "The developer wants to know which of those ads is doing a better job of showcasing the game. Red Shell is the tool they use to measure the effectiveness of each of those activities so they can continue to invest in the ones that are working and cut resources from the ones that aren't."
In other words, if you click a Red Shell tracking link and then launch the releated game, the developer is able to determine that the link led to a sale. The site states that Red Shell does not collect personal information about users, such as names, addresses, or emails. It doesn't track users across games, and the data it collects is not used for targeted ads. "Red Shell tracks information about devices. We collect information including operating system, browser version number, IP address (anonymized through one-way hashing), screen resolution, in-game user id, and font profiles," it says.
"We have no interest in tracking people, just computers for the purposes of attribution. All of the data we do collect is hashed for an additional layer of protection."
Those reassurances don't carry much weight in this Reddit thread, however, which begins by pointing out that users typically don't have a say in whether or not Red Shell is installed in the first place. Games using the software "may offer an opt-out for any type of data/analytics services they use," Red Shell says, but that places the responsibility for declining the software entirely on the user, and could be in violation of opt-in privacy laws—and that's assuming the developer makes the option available at all.
The list of games found to be running Red Shell is surprisingly broad, and includes everything from indies like Holy Potatoes! We're In Space? and My Time At Portia to high-profile hits including Civilization 6, Kerbal Space Program, The Elder Scrolls Online, and Vermintide 2. Some developers have promised to remove the software, but there's also widespread insistence that there is nothing sinister or spyware-like about it.
Vermintide developer Fatshark, for instance, described it as "no more than a tool we can use to improve our marketing campaigns in the same way a browser cookie might," while Total War studio Creative Assembly stated that it's ditching the software only because "it will be difficult" to reassure players that it's not being used for nefarious purposes.
And some studios have said that they will continue to use the software despite the furor. ZeniMax Online, maker of The Elder Scrolls Online, said in a Reddit post that Red Shell was mistakenly added to a live build while it was still being tested. ZeniMax said it would remove the program, but added: "We are still investigating how to use this technology in the future to grow and sustain ESO more effectively. When/if we do so, we will give everyone a heads up with clear instructions as to what it is doing, how it is doing it, and how to opt-out should you so desire."
Dire Wolf Digital, formerly of The Elder Scrolls: Legends, said something similar about the presence of Red Shell in its new project, Eternal: "Red Shell is not 'spyware'; that’s a scary-'Let’s-burn-the-witch!'-word that’s getting thrown around without a lot of information behind. No personally identifying information is collected anywhere in this process," it wrote. "That’s basically it; there’s nothing nefarious going on here, just some under-the-hood analytics that help us understand how our advertisements perform."
Reddit's rundown games containing Red Shell as of June 18 is below, although I wouldn't be surprised to see more games added to it as people become aware of them—you'll probably want to check the thread if you want to be sure you're up to date. There's also a publicly-available Google spreadsheet that contains more detailed information on how each one was identified. For games that don't offer one, Red Shell maintains its own per-game opt-out option here.
Updates:
Team17 contacted us on June 19, 2018, to say that Red Shell integration in My Time at Portia, The Escapists 2, Yoku’s Island Express and Raging Justice has been fully removed.
On June 21, 2018, HypeTrain Digital contacted us to say that Red Shell has been removed from The Wild Eight and Desolate; CI Games informed us that Red Shell was no longer present in Sniper: Ghost Warrior 3; and Gavra Games said that it had been removed from Warriors: Rise to Glory.
"HypeTrain Digital has been using RedShell in 2 projects (The Wild Eight, Desolate) to analyse the efficiency of marketing campaigns. We haven't collected any personal user data aside from marketing KPIs (CTR, conversions)," a rep told us. "We have no plans to implement RedShell or any other similar tool in our future releases."
CI Games said essentially the same thing about Red Shell in Sniper: Ghost Warrior 3: "The software was used for marketing purposes, and there are no plans to use it in future releases."
Crytek informed us on June 25, 2018, that Hunt: Showdown no longer makes use of Red Shell.
Doborog Games contacted us on June 26, 2018, to say that Red Shell had been removed from Clone Drone in the Danger Zone on May 24, 2018, as part of its GDPR privacy policy update; and Skydance Interactive said that Red Shell is no longer present in Archangel: Hellfire, and is not being used in any other Skydance games.
Games which used Redshell which removed or pledged to remove it (as of June 18, 2018):
- Elder Scrolls Online (Pledged to remove it )
- Conan Exiles (Pledged to remove it )
- Ylands (Removed it )
- Holy Potatoes! We’re in Space?! (Removed it )
- All Total War games (Pledged to remove it )
- Warhammer: Vermintide II (Pledged to remove it )
- Dead by Daylight (Pledged to remove it )
- Battlerite (Pledged to remove it )
- AER Memories of Old (Pledged to remove it )
- Magic the Gathering Arena (closed beta, not on Steam) (Pledged to remove it for now )
- Secret World Legends (Pledged to remove remains of it )
- Hunt: Showdown (Pledged to remove it )
- Omensight (Pledged to remove it )
- Ballistic Overkill (Pledged to remove it )
Games still using Redshell according to community reports (as of June 18, 2018):
- Civilization VI
- Kerbal Space Program
- Guardians of Ember
- The Onion Knights
- Realm Grinder
- Heroine Anthem Zero
- Warhammer 40k Eternal Crusade
- Krosmaga
- Eternal Card Game
- Astro Boy: Edge of Time
- Cabals: Card Blitz
- CityBattle | Virtual Earth
- Doodle God
- Doodle God Blitz
- Dungeon Rushers
- Labyrinth
- My Free Farm 2
- NosTale
- RockShot
- Shadowverse
- SOS & SOS Classic
- SoulWorker
- Stonies
- Tales from Candlekeep: Tomb of Annihilation
- War Robots
- Survived By
- Injustice 2
- Trailmakers
- Vaporum
- Robothorium
- League of Pirates
- Doodle God: Genesis Secrets
- Skyworld
