FIFA player uses GDPR to find out everything EA has on him, realises he's spent over $10,000 in two years on Ultimate Team

A FIFA player used GDPR to find out everything publisher EA had on him - and realised he'd spent an incredible $10,000 on the game in just two years.

Michael, 32, from the UK (Michael asked we not publish his second name) told Eurogamer he made the request of EA on 25th May - the day General Data Protection Regulation (GDPR) came into effect in Europe - and was motivated by a belief in "momentum" in the FIFA games, as well as the ongoing controversy surrounding loot boxes.

We've covered both of these topics as they relate to FIFA extensively. Momentum is the belief among some FIFA players that the game cheats. The idea is under the hood, FIFA creates "dramatic moments" by giving the losing team a helping hand or making life harder for the winning team. (EA has always denied this is the case.)

Loot boxes as they relate to FIFA have to do with FIFA Ultimate Team card packs. These virtual football sticker packs can be bought with a virtual currency bought with real world money (FIFA Points) or a virtual currency earned through playing FUT (FIFA Coins). Like a standard loot box, FUT packs contain a random assortment of cards, which players use to build their FIFA Ultimate Team squads.

"I was intrigued to see if any of the data related to any of these topics," Michael told Eurogamer.

Michael submitted the GDPR request through EA's customer service telephone number.

"The advisor seemed a tad confused but after liaising with other departments, he was able to start the process," Michael said. EA asked Michael for some personal information (name, address, email etc) as well as a photograph of his government-issued identification. The 30-day countdown - stipulated by GDPR - began when this information was processed.

Sure enough, 30 days later, Michael was sent a data dump by EA via two PDF files each over 100 pages long. This amounted to a huge number of files, which include engagement data, FIFA 18 stats, device information and more than 10 audio files (these are recordings of his calls to EA support). It also included details of every player Michael bought and sold over the past two years in FUT.

After running through the data, Michael published some files to Imgur and took to reddit to discuss using an alternative account. Redacted content in black (for example internal IDs) was done by EA, while redacted content in red (personal information) was done by Michael himself.

"I would play Ultimate Team more or less everyday," Michael said. "I used it as my downtime and my hobby. Depending on the time I have free, I can spend anything from 30 minutes to six hours playing.

"I play Weekend League every week and this is obviously time consuming." (For more on Weekend League, check out our feature on FIFA's most gruelling mode.)

EA also provided data relating to how much real world money (in dollars) Michael had spent on FIFA Points, and he told Eurogamer he was "gobsmacked" to discover he'd spent over $10,000 in just two years.

"Upon reflection, the figure EA stated would be correct," he told Eurogamer. "Special events such as Black Friday, TOTY, FUT Birthday, TOTS, Futties, etc, I would have thrown in thousands upon thousands of FIFA Points without even a second thought.

"Myself and my fiancee are fortunate to have a healthy disposable income, so this kind of amount wouldn't have caused a strain on us financially. I do however, have the utmost sympathy for those in a position of low income who may also be or become addicted to buying loot boxes."

While the data provided to Michael lists FIFA 16, 17 and 18, he bought FIFA 16 just a few days before FIFA 17 came out, and so did not spend any money with that game. This means his purchase history is reserved for two games: FIFA 17 and FIFA 18 - and spread across two years.

Michael may have even spent more money on FUT than he thinks. EA's spending data for Michael, which he has not published to Imgur but has shown Eurogamer, shows two figures for the amount spent, each relating to two different periods. One figure is $6144 spent between 2nd November 2016 and 29th August 2017, the other $10,010, spent between 25th September 2017 and 21st May 2018. In total, this would mean Michael has spent $16,154 over two years, not just over $10,010 as Michael first thought.

"That could be correct," Michael told Eurogamer after we pointed this out. "I'm not entirely sure as I was assuming the $6k was over FIFA 17 and the remainder up to $10k was FIFA 18. Looking at the stats again, it is possible the amounts are for separate titles."

Whether it's $16,000 or $10,000, Michael was so shocked at seeing the amount he'd spent on FUT in black and white that he spoke with his partner to discuss his spending - and it sounds like he will try and calm it down for FIFA 19.

"I took the time to talk to my other half about this," Michael said. "We have a healthy disposable income but you can imagine my shock that over the past two years, I had given EA just over $10,000.

"If anything, the data EA has provided me has made me realise that FIFA Points are just not worth it and $10,000 will be better spent over the next two years."

Perhaps most noteworthy about the data provided is, while there is a huge list of FUT transfers and purchases on the list, EA failed to supply pack pulls. That is, EA did not tell Michael which cards he received from packs.

"What surprised me was EA could tell me every player I bought and sold, but could not tell me what players I packed when purchasing loot boxes," Michael said.

"The data did not even tell me what pack I had purchased, just the amount of FIFA Points the pack cost. Another surprise was the audio files attached to the data. I understand that organisations record calls but I did not expect EA to retain those calls for two years."

EA's decision to not supply information relating to packed players or which packs were purchased may have to do with protecting trade secrets and its anti-cheat methods.

In its correspondence with Michael, EA used legalese to explain why it had withheld certain data:

"We have also withheld data impacting the security and integrity of EA products and services, data that, if disclosed, would affect the rights and freedoms of others, including EA, and any other EA or third-party trade secrets."

And:

"Automated decision making, including profiling, and information about the logic involved and the significance of and envisaged consequences: We do not consider any automated decision making by EA Inc. to have any legal or other significant effect on data subjects. For more information on our anti-cheat please see section 3D of the Privacy & Cookie Policy."

Michael said he's far from satisfied with the data EA supplied, and criticised the company's decision to leave out pack information.

"To me, this is EA using loopholes to avoid providing full disclosure to their customers," he said. "This is the kind of data I was wanting to see."

When we put Michael's case to EA, the company said it was working to improve its responses to players who make GDPR requests, and promised to help Michael get the data he wanted.

"We take our responsibility to protect player's data privacy very seriously, and it is absolutely our intent to provide choice and control over their information. EA takes great care to respond to data access requests like these in a timely manner and consistent with each players' requests.

"Also, in full disclosure, we're working on the responses that players will see to GDPR requests like this. The quotes below are from some of our legal language, and obviously not all that helpful to a lot of players. Going forward, players requesting info will see a response that is clearer."