Dead Island 2 Review

Dead Island 2 by Deep Silver is typical spyware with a variety of snooping services, involved third parties, and a prime example of how companies self-legitimize exploiting end users.

What does the product do?

As is well known, every game, every program starts with an installation on the respective device. Here it can be observed that alongside the product itself, the Epic Games Launcher is also installed in the background. Included are the EOS Overlay Renderer and, of course, mandatory integration with the Epic Online Service (EOS for short) along with accompanying telemetry services.

But it would have been too nice if that had been all. Because Dead Island 2 is a digital surprise egg with lots of colorful things. However, gameplay, fun and excitement fall by the wayside.

What follows is another forced integration with the Denuvo Anti-Tamper service for DRM, mandatory connections to various Google services such as Google Cloud Optimization Guide, Google Accounts, Google Safebrowsing, Google Update, Google Chrome. For those who still haven't had enough, you may also agree to Deep Silver's marketing analysis and, by the way, get signed up on the PRISM platform   (a platform that provides online services for selected future games from Saber Interactive, Deep Silver, PLAION, Prime Matter).

Personally, I've an aversion to PRISM terms since the Snowden leaks, but that's just by the way. Well, the purpose is the same... unauthorized snooping and extensive non-transparent data collection.

Who operates the product?

In-house production: Developed by Dambuster Studios (formerly Free Radical Design, formerly Crytek UK, acquired in 2014 by Koch Media GmbH (now Plaion) and distributed by Deep Silver (again Plaion)

Which service providers are involved?

Dambuster Studios – Nottingham, United Kingdom
PLAION GmbH – Embracer Platz 1 – A-6604 Höfen, Austria
Irdeto Access B.V. - Taurusavenue 105, P.O Box 3047, 2132 LS Hoofddorp, The Netherlands
Amazon.com, Inc. - 410 Terry Avenue North, Seattle, Washington, 98109, USA
Google, Inc. - 1600 Amphitheatre Pkwy Building 43, Mountain View, CA 94043, USA
Epic Games, Inc. - 620 Crossroads Blvd., Cary, NC 27518, USA
Valve Corporation - 10400 NE 4th St, Suite 1500, Bellevue, WA 98004 USA

What data is collected

A lot of data is collected and transmitted non-transparently via the gRPC (HTTP/2 Google Protobuf based) protocol.

Epic Online Service (EOS)
Along with the hidden software installation -> As has often been described, EOS is a complete package with many functions. In addition to the linked telemetry service, it is responsible for achievements, anti-cheat, ecommerce, leaderboards, lobbies, matchmaking, metrics, player data storage, statistics, title storage, voice chat, and much more. This always includes! a login, product ID, user ID, account IDs, display names, gaming platform used, timestamps, device IDs, network information, operating system details, logins, language settings, passwords, cookies, session data, data on STUN servers, rate limit functions, account linking, friends lists, tokens, and much, much more.

In older games, it was easier to block telemetry services in Unreal Engine games. Today, these snooping services have been fully integrated into the API and are inseparably interwoven. Epic Games, Inc. takes advantage of this and delights us with not one but two of these permanently active mechanisms.

Google Services
Google Account Services: Silent user tracking, even without being actively logged into Google accounts.
Google Cloud Optimization Guide: Optimization of machine learning workflows
Google Update: Initiates the download of the subsequent Google package installation
Google Package Installation: Download of Google Translate, CRX files (triggered by Google Update)
Google Safe Browsing API: Invalid request along with dummy token

DeepARC Telemetry
SID, BID, GID, PID, UID, SessionID, Hardware: Chipset, GPU, Generation, SKU, Service, Vendor, UserID, Screen type/name, Menu names, Language, DLC entitlements

The variable list of in-game tracking is somewhat larger, but includes everything—whether a weapon was repaired, mobs spawned, players died, an item was equipped or used for crafting, matchmaking, error tracking, Amazon Game Controller, voice commands, matchmaking, etc.


Although users are informed about the marketing telemetry data in the game (including opt-in/out), the function as well as the notice is useless.

PRISM (Prism Ray Online Services)
Mandatory integration with Plaion's attempt to launch its own platform. e.g. UUIDs / device IDs / session IDs, platform & system, Steam login, registration, cross-save, QR code, telemetry configuration, ad banners and graphics and much more.

To make sure users swallow the pill, the service is directly tied to a reward system. Giving up digital self-determination and legally enshrined rights for digital items? Great! Woof, woof *tail wagging* ∪･ω･∪

Denuvo Anti-Tamper
You’re better off asking the warez scene about that

Captive Portal Check
The game enforces a client connection to Valve's Captive Portal service

Privacy Policy/Terms of Use and Opt-Out/In?

The terms of use  [ on Steam are only available in English. There is merely a reference to DRM (Denuvo Anti-Tamper), online activation (on several Platforms and services), account binding (likewise) and no third-party data recipients are named—neither specifically (e.g., Google) nor functionally (e.g., update, security, or analytics services).

Although there is a reference to a privacy policy  , neither the services involved nor their behavior are mentioned there either. On top of that, the link in the terms of use leads to a 404 error page, and the actual privacy policy is again only available in English.

All in all, the game can be classified as spyware and a PUA (Potentially Unwanted Application). Customers are neither properly nor transparently informed about the actual behavior of the product. Many of the involved services are not technically necessary. In this respect, there are multiple GDPR violations of various legal bases, information, transparency and consent requirements.

In-game opt-outs are placebo functions, as even if users deactivate the corresponding items via the menus, connections are still made to the mentioned services and a lot of data is exchanged.

Can the behavior be blocked?

Well, users who absolutely want to play Dead Island 2 in its entirety will have to bite the bullet and get digitally naked.

All others are advised to avoid the product altogether or to block all connections either individually via hosts, DNS resolvers or alternatively with blocked exe files by firewalls. Minimal Denuvo must be allowed for initial and periodic forced activation.

Note
After uninstalling the game, the installed programs from Epic Games, Inc. remain on the hard disk. The same applies to obsolete files of Dead Island 2 itself. Unfortunately, the developers are incapable of programming their uninstallation routines cleanly, so that a lot of junk data is left on users' hard disks.

Note 2
If the Epic Launcher files are updated, this is done at the expense of the playing time. This is important for the 2 hour refund limit on Steam.