SPT Score - GOG.com

GOG.com (formerly Good Old Games) is a digital distribution platform for video games and films. It is operated by GOG sp. z o.o., a wholly owned subsidiary of CD Projekt based in Warsaw, Poland. GOG.com delivers DRM-free video games through its digital platform for Microsoft Windows, macOS and Linux. Taken from Wikipedia.

Terms of Service, Privacy Policy.

Part I: Accounts

• -10 --- Requires email when signing up.

Also so they can spam you with games you're probably not interested in.

• +10 --- Accepts email aliases.

Tested with AnonAddy, Simplelogin works as well. Unlike most, two dots and @.xyz domains can be used.

• -10 --- Requires contacting customer support for account deletion.

You'll need to email the folks at privacy@gog.com and request for the deed. Aw man.

• -20 --- Retains data after account deletion.

"If you choose to close your GOG account, limited data that we collect about you may still be retained for tax, legal and accounting purposes". Tsk.

Score for Part I: -30

Part II: Use of service

• -10 --- Logs IPs.

I'm no longer surprised.

• -10 --- Logs device information.

"This is technical data about our users and their actions and patterns, which does not provide personal information".
I mean yeah but fingerprinting exists doofus.

• -20 --- Logs geolocation.

They don't even request it they just grab it when they can.

• -10 --- Logs actions when using the service.

Because gaming.

• -10 --- Does not support E2EE messaging.

They even admit that they will read messages to other GOG users. At least they're honest.

• -10 --- Utilizes 3rd party services.

These guys use way too many of them I won't even bother listing them down.

• -10 --- Utilizes 1st party adverts.

If I had a penny for the amount of emails I got for games I don't wanna buy, I'd have uhh... a couple dollars actually.

• -20 --- Utilizes and shares info with 3rd party advertisements.

Once again, Google is a culprit.

• -20 --- Utilizes telemetry/analytics.

3rd party and no opt out. I should give an additional deduction for this honestly.

• +10 --- Data use and/or retention period is limited to the minimum.

"We will retain your personal information only for as long as we will be required in order to fulfil the purposes outlined in this Privacy Policy." Tax and legal obligations are apparently the only cases where they'll make an exception (and the aforementioned limited data in Part I).

Score for Part II: -110

Part III: Miscellaneous

• -10 --- Closed source 1st party clients.

I find it ironic that the first major video game distributor to officially support Linux never open sourced the official client.

• +5 --- Open source 3rd party clients.

Heroic and MiniGalaxy to name a few.

• +10 --- Is not reliant on advertising companies/known privacy abusers for revenue.

I think all the preorders of Cyberpunk 2077 can speak for this.

Score for Part III: +5

===========================================================================

Total Score: -35

Analysis: I was expecting this to come dangerously close to Steam's SPT but regardless, GOG is my second recommendation for gaming on Linux. The DRM free approach to selling games in an age where nearly everything has Denuvo embedded in it have made it a popular choice for people who don't like DRMs. Hell they even started an initiative against DRMs and literally named it "FCK DRM", although the site just redirects you to the GOG homepage for some reason. Regardless if you want to Game in Private (yeah!) then using GOG with an open source 3rd party client is a pretty decent choice if you don't want to use Steam.