"In light of the recent Facebook data harvesting and Cambridge Analytica profiling allegations and the coming into effect of the GDPR on May the 25th, we've decided to be the change nobody wants to us to be. Forget Steam, GoG is the new Facebook for Young Gamers and Old Gamers alike! Because screw everyone who actually believed in us caring more about morals than money."

I bet the legal team is scratching their head right now wondering whether or not explicit consent is required for the profiling done.

As I laid out, taking the definition the GDPR provides for "personal data", it logically falls under that definition unless someone has taken deliberate steps to divorce their entire dealings with GOG from their natural person, e.g. obfuscate the connection between their personal identity and their account to everyone they know, GOG and their trusted partners. This means that while in some (presumably pretty rare) cases, the data might conceivably be viewed as non-personal - for the average user, it falls under the GDPR's umbrella.

That's funny..............Facebook is one of their “Trusted Partners''

To add to the personal data debate, the question is not whether the data visible to other users is personal data, but whether the information gathered and stored by GoG.com *is*. Think payment information, IP location Login information, E-mail address, Facebook and Twitter 3rd party cookies, etc...

All this information is inferred to create profiles of users, to group them into different categories (e.g. age, income, interests, personality [Does this person buy impulsively? Is this person sociable on the forums?], intelligence, game interests). It's a very efficient way to target the right game to the right kind of person and perhaps to show the right type of reviews (10/10 reviews to impulsive buyers for instance), but of course it is often morally repulsive, hence the recent media outburst regarding online political micro-targeting. There's also the question of whether and how much of the information is shared with third parties.

Profiling is automatic processing, which can, but does not necessarily entail, automatic decision-making. When the process I described above happens automatically, without human interference, the GDPR lists more stringent requirements in article 22 insofar as the decisions taken have a legal or similarly significant influence on the data subject. For instance, requiring explicit consent instead of just 'consent'.

As I said earlier, I don't think it is as easy as a superficial reading of this section could make it appear. Using such a broad definition/scope it would mean that any data, even pseudonymized, could be suddenly considered as "personal data" as soon as appear somewhere in the universe somebody able to, by whatever mean, attach this data to the person behind it.

From what I understood it's not the case, the scope is more limited, just because there is somebody, somewhere, in the world who knows who is the real person behind the username Mueslinator doesn't necessarily mean that said username immediately become a "personal data".

Well, first off, how many games your brother has is irrelevant.
Secondly, how many you have is also irrelevant :)

Yes and now they can also use the number of games you have bought to humiliate you.

I don't recall anyone asking for the profiles to be permanently removed for everyone. They want to not have one, be able to hide all information on them, have the defaults be fully private and maybe have them taken down temporarily while it is fixed. They aren't just arguing for themselves either. They are arguing for the 100s (thousands?) of people who have no idea that this has been introduced and the privacy violation it entails.

Personal data Google search

first results i got when searching: check the underlined text

What is Personal Data- - Data Protection Commissioner - Ireland
https://www.dataprotection.ie/docs/What-is-Personal-Data-/210.htm
"personal data" shall mean any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, ...

What is personal data? | European Commission
https://ec.europa.eu/info/law/law-topic/data-protection/.../what-personal-data_en
Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.
‎Answer · ‎Examples of personal data

Art. 4 GDPR – Definitions | General Data Protection Regulation (GDPR)
https://gdpr-info.eu/art-4-gdpr/
'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more ...

screenshot of the first results: screenshotsearch.png

Anyway, usually companies have people that can work around this ofcourse :D

Maybe many people did not ask for these profiles .... i never asked for profiles or mass sharing info about our number of games we have and how much we play ....

As for other companies like steam everyone knows or knew what Steam is/was about we know about the data they collect the DRM etc etc etc etc .... we also know about all other accounts like the EA , Paradox and all other 3rd party accounts steam games also need we were informed by that.... we knew what we joined :D
with GOG who was against DRM and other unneeded data sharing.

Anyway I hope the client will never be forced upon us to use it in order to run a game be it online or offline, i also hope they wont 'add' extra code to a offline game that secretly shares info like all the other gameplatforms already do but we know these others like steam do share info.... so we were warned .....

Apologies for the long post; I'll try to make each point as succinctly as possible (and I've placed bold font on the main points for tl;dr).
What a sad thing to have to acknowledge, but I believe you're right: This seems to be where we're headed. I've never been a doomsayer (here or in RL) but from Gog's current position it does make sense from a business point of view to court publishers who demand this kind of information. And the crazy thing is: If Galaxy eventually becomes mandatory, then it in itself will be the DRM, as there would be no more standalone executables. (The other alternative would be to make those standalone executables phone home with the information, but that would require publicly acknowledging DRM usage instead of trying to hide it in a client, and I'm not sure they would go that far.)

I'm not against change; change is good. It drives us forward. However, Gog seems to be forgetting one important thing:
The world doesn't need two Steams. We already have one. In making this latest move toward profiles, Gog has finally placed themselves in direct competition with Steam and, frankly, there is no contest. Steam's activity wall is better, as is their wish list system and forum and achievement integration. They also have additional features such as trading cards and user created Groups. Their catalog is nearly seven times larger than Gog's (and will likely maintain that balance; as Gog grows, so does Steam), and they even sell DRM-free games as well as "good old games" for, often, better prices (for example, compare the 3 classic Cinemaware games here for $17.97 (U.S.) against the 13 game collection available on Steam for $9.99). So: How long before most of us oldies realize there's no point in sticking around now that Gog has become "Steam-lite" when we already have Steam? How many potential new customers without an account at either store would compare them both and choose Steam-lite over Steam?

Instead of listening to their dedicated, vocal customers and building upon what they'd started, instead of improving forum integration and making GogMixes an integral part of the system, instead of hiring developers to create new "classic" content (as Groupees has done), instead of hiring classic content mod developers to create new games (as Valve has done), they've favored homogenization over innovation and rushed out a decision that could be the live bullet in the chamber. That makes me frustrated and sad, but it is a business, they've made their choices, and they'll either thrive or die. I hope they thrive, but I'm not sure I see that happening.
No worries, my friend; we have lives. :)

(Edited to remove a redundancy and place bold font on the main points for tl;dr.)

Well, for online it is already forced upon us in several cases. There are too many games that require Galaxy for online play and don't offer the possibility to set up dedicated servers yourself or LAN or any other client-free multiplayer options.

Unfortunately the profile debacle and how it is being handled (not at all) shows again how little respect GOG has left for their customers. Sure, they make big words about seeing their customers as family. But their actions show the opposite. (unless it's a really abusive family ... )

I also got that message. Not really surprised.

I got the same message and it's disappointing. It should be obvious to GOG that there are many problems with these profiles that still need to be fixed. At the very least there should be an option for a user to turn off the profile entirely.

It is not superficial reading. I have to abide by the GDPR myself, albeit in a different context. The core of the regulation is one of an obligation to the minimization of data. In fact, some of the literature that deals with the GDPR explicitly mention online order details as being personal data - under which the number of games you have ordered through a specific service ostensibly falls.

Now, you can still process such data to third parties if that data is sufficiently pseudonymized toward those third parties (like your friend list, or anyone with a GOG account). You can of course argue that a account name that is different from a person's real name serves as pseudonymization. The question becomes if it is sufficient pseudonymization. As discussed, a lot of people know who's behind such a name. And in those cases, pseudonymization has been breached, and the data once again counts as personal data that warrants protection. This is called "reidentification risk" It is up to the data controller (i.e. GOG) to mitigate that risk. Which means their best bet would be to simply enable every user to disable the sharing of that data at their own discretion ("consent").

Isn't consent where you say yes, not where you don't say no?