body: A few friends and were having an argument on the following situation:
  
  
  People can sign up for [Steam](https://store.steampowered.com/) accounts for free, letting them purchase games and play games over their network. Users are able to create public profiles for their accounts, a nickname, real name, location, etc - but this is not essential (sometimes people put fake information, but a considerable number of people put legitimate information). Via [OpenID](https://openid.net/what-is-openid/), users are able to authenticate and identify themselves to various other websites.
  
  
  Some games, for example Dota 2 (published by [Valve](https://www.valvesoftware.com/en/), who also run the Steam network) use publicly visible Steam IDs of players as unique identifiers within their games - in order to track information about their users, including reports, statistics, etc.
  
  
  Provided that a user consents, part of their data from matches they play in is exposed via an API. This includes stuff like what character you played, your performance in game, etc. This allows 3rd party websites to show you interesting statistics about the games you play.
  
  
  There is another API (also run by Valve) which allows users to download "replays" of the matches, so users can rewatch what happened. Within these replays are, regardless of what a user's consent status may be, users' uniquely identifiable Steam IDs. This allows 3rd parties to track users even if they've not opted into 3rd party sharing.
  
  
  My questions are:
  
  
  1. Is a Steam ID "personal data"?
  2. Is the sharing of data to a 3rd party by Valve without consent against the GDPR?
  3. If #2, How would I make a formal complaint about this.
  
  
  Answer mostly important for an EU user, but would be interested if there were US comparisons.
  
  
  
title: Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?