Steam

Steam

Basic Information
Release Year	2003
Product Type	Digital storefront, Video games
In Production	Yes
Official Website	https://store.steampowered.com

Steam is a digital storefront and service for video-game distribution, operated by Valve Corporation. Launched in 2003, it has grown to become the largest digital-distribution platform for PC gaming, with over 130 million monthly active users as of 2024 as well as having an operating system centered primarily around it's digital storefront called SteamOS. The platform offers services for digital rights management (DRM), server hosting, video streaming, and social networking.^[1]

• Collects extensive personal data, including e-mail, location, payment details, and device information^[2]
• Records and stores all user communications through platform features^[2]
• Keeps specific user data indefinitely for "gameplay consistency" even after account deletion^[2]
• Tracks gaming behavior, including preferences, progress, playtime, and device usage^[2]
• Shares user data with game developers and third-party service providers^[2]
• Makes user profile data publicly available through Steamworks API^[2]
• Uses cookies and similar technologies for tracking across websites^[2]
• Retains transaction data for up to 10 years after account closure^[2]

• Users do not own purchased games; they only receive limited licenses.^[3] Although some games work without DRM, information about this is hidden to users.^[4][5]
• Can terminate access to paid content at Valve's discretion^[3]
• No right to transfer or resell purchased games^[3]
• Imposes regional restrictions on game activation and playing via IP address geo-location^[3]
• Can unilaterally modify terms with 30-day notice^[3]
• Mandatory client updates (sometimes over 100MB)^{[citation needed - Personal account]} required to launch Steam & access library^[3]
• Users must accept all changes to maintain access to purchased content^[3]
• No option to opt out of core data collection while using the service^[2]
• Steam can prevent users with non steam copies of games from downloading certain workshop mods, which forces people to only buy games on steam^{[citation needed - Personal account]}

• Provides a clear refund policy for games (any game played for less than 2 hours within 14 days)^[3]
• It will mainly reference instances where the product prevents inspection or is intentionally confusing.
• Maintains detailed system requirements information for all games (developer-submitted)^[3]
• Offers a comprehensive privacy policy in an accessible language^[2]
• Unclear processes for account termination and data removal^[2]
• Limited transparency about content moderation decisions^[3]
• Vague about specific data retention time-frames^[2]
• No clear disclosure of recommendation algorithm factors^[2]

Steam makes money from every purchase of games on the platform, with 30% of the sale going to them.^[6] This drops to 25% after $10 million in revenue, then 20% after $50 million in revenue per game, but is otherwise non-negotiable for most developers.^[7]

If developers sell their game on a competing service at a reduced price or with additional content, they are punished by having their equivalent Steam listing blocked from appearing on the front page, sale visibility and featured lists. As of 2019, developers are also not allowed to release their games, updates, or DLC on competing services before Steam.^[8][9]

Steam also offers a community market where players can buy and sell different types of items, like in-game skins or trading cards, for a fee of 5% (with a minimum fee of $0.01). Any profits made from the market are added to the user's Steam Wallet and can't be withdrawn. This serves as another essential source of revenue for Steam.^[10][11]

As of 2021, Steam has over 132 million players utilizing the service.^[12]

This is a list of all consumer-protection incidents this company is involved in. Any incidents not mentioned here can be found in the Steam category.

In October 2011, Valve temporarily closed the Steam Community forums following security-breach concerns. The company later confirmed that hackers had compromised one of its customer databases. The compromised database contained user information, including encrypted credit card numbers, billing addresses, purchase histories, e-mail addresses, and encrypted passwords for Steam accounts.^[13]

At the time of disclosure, Valve stated they had no evidence that the encrypted credit card numbers or personally identifying information (PII) had been taken, nor was there evidence that the encryption on the credit card numbers or passwords had been cracked. Nevertheless, they advised users to monitor their credit card activity and statements as a precautionary measure.

In April 2015, without warning, all user accounts that had only purchased games from retail stores or received them as gifts were blocked from using most social media features, an example of retroactive policy enforcement. To restore access, users were told to spend at least $5 directly through Steam itself.^[14][15][16] The restrictions were applied retrospectively, regardless of account age, playtime or number of retail games that were purchased.

On 20 January 2021, the European Commission fined Valve, owner of Steam, €1.6 million for breaching EU anti-trust rules by engaging in geo-blocking practices through Steam within the European Economic Area (EEA). Five PC video game publishers have also been fined for engaging with Valve through Steam in geo-blocking practices by "requesting Valve to set up geographical restrictions and to provide geo-blocked Steam activation keys"(EU Commission, 2021). The fines for the publishers were reduced due to the cooperation of the five publishers with the Commission. Valve did not cooperate with the Commission.^[17]

Main article: Valve removes arbitration requirement from Steam Subscriber Agreement

In September 2024, Steam implemented significant changes to its subscriber agreement that altered user rights and game-ownership terms. Additionally, it removed forced arbitration from the Steam Subscriber Agreement.^[18][19] Key changes included:

• Enhanced ability to terminate accounts for violations
• Additional data collection and sharing provisions
• Modified dispute resolution procedures

Main article: Valve allows ISPs and payment processors to censor content on Steam

In an update for Steam's Rules and Guidelines for developers,^[20] a new rule was added within the section detailing what content cannot be included on Steam:

15. Content that may violate the rules and standards set forth by Steam’s payment processors, related card networks, banks, or internet network providers. In particular, certain kinds of adult-only content are used.

This addition was made with pressure from payment processors such as Visa, Mastercard, and PayPal. Most, if not all, content taken down from the platform was adult in nature^[21] however, allowing both payment processors and ISPs to judge whether or not content on the platform can be taken down puts consumer choice at risk. Reportedly, Japanese developers creating "adult-oriented" games were also refused payment via their banks just after this rule change.^[22]

In addition, game developers and consumers have noticed that some content was removed or de-listed despite not being 18+ while having LGBT tags or themes.^[23]

As of 2026 games bought to work with and made for Windows 7 are no longer accessible on the Windows 7 operating system — a system these games were made to work on and were sold for. This includes titles that might not even work on modern Windows installments.^{[citation needed - Any examples of such games?]}

This is done by forcing updates before the launching of any title. If there was a patch it will always fail before finishing the update process. Thus, if an user is unwilling to move to the newer Windows versions for whatever reason, the user is locked out of their purchase.

Valve had announced back in March 2023 that official support for these operating systems would be ended on 1 January 2024, and that the Steam client could stop working for these systems on a later date. This later date ended up being circa February 2026. The main reason listed by Valve for this decision was the ending of security updates for these operating systems, which could make these outdated systems open for attack when connected to the internet, due to security issues no longer getting patched by Microsoft for these systems.^{[24][25][26][27][28]}

In December 2025, hobbyists released a modified client that runs on Windows 7 and 8.^[29][30]

Valve Anti-Cheat (VAC) describes itself as "an automated system designed to detect cheats installed on users' computers".^[31] However, the Steam Subscriber Agreement says incidents of cheating may be enforced "using both automated detection methods and human review".^[3] Users have been VAC banned for using CD key changers^[32] and manually banned after using information leaked by Valve employees in order to acquire digital in-game items.^[33][34]

In 2018, players of Abstractism were infected with a cryptocurrency miner.^[35]

In 2023, NanoWar: Cells VS Virus and a number of other titles were updated to infect player devices with malware. Up to 99 users were infected. In response, two-factor SMS authentication became mandatory for developer accounts publishing updates from 24th October 2023.^[36][37]

Between May 2024 and January 2026, the following games released on the platform infected approximately 8,000 users with info-stealing malware, with users collectively having approximately $220,000 in cryptocurrency stolen in the attack:^[38][39]

• BlockBlasters
• Chemia
• Dashverse/DashFPS
• Lampy
• Lunara
• PirateFi
• Tokenova

In March 2026, Duet Night Abyss users were infected with a trojan.^[40]

In May 2026, the free horror game Beyond The Dark infected users with info-stealing malware.^[41]

Steam Workshop, a tool used to distribute game modifications, has also been abused to distribute malware:

• In February 2026, mods of Sniper: Phantom's Resolution infected users.^[42]
• In March 2026, 14 mods of Project Zomboid infected players.^[43]
• In June 2026, a wallpaper app was used to distribute malware.^[42]
• In July 2026, custom Meccha Chameleon maps infected users with a Remote Access Trojan (RAT).^[44]
• In February and September 2026, the title People Playground has been used to distribute malware through mods.^[42][45]

A local privilege escalation security vulnerability in the Windows client took approximately 6 months to be patched after being reported.^[42]

Steam does not allow users to secure their accounts using FIDO keys, and has not announced any plans to do so, despite most competing services offering it.^[46]

• itch.io