Yearly recaps are a stark reminder that gaming and tech companies have all your sensitive data

The end of the year draws near, and it's time for one of the more recently developed traditions to take center stage: The yearly digital recap. Throughout December and the early New Year, eager social media users will post the summaries to proudly show off how excellent their listening tastes are, how embarrassingly low the hours in their favorite game are, and how much time they've spent on Reddit. 

Since 2016, with the start of Spotify Wrapped, the viral recap compilation has both delighted and embarrassed its users. This year, it feels like there are more recaps than ever before, with the Reddit Recap, Steam Replay, Valorant Flashback 2022, Twitch Recap, and more, all blighting your social media timelines. 

But behind this harmless fun exists an uncomfortable truth about just how much our favorite apps and games are tracking our every action. And how our data is being used by these companies for both free advertisement and predatory upselling.

So why are recaps dangerous? On the most benign end of things, Recaps are just a cool way for marketers, who have access to huge amounts of data on their customers, to do something interesting. Marketers are able to compile huge databases of customers, but GDPR rules, ethical considerations, or an unwillingness to use the data means that their efforts are somewhat muted. So recaps provide a way to use all this powerful data in something viral and exciting.

However, by incentivizing and making it easy for users to share these recaps on social media, companies have effectively given themselves an avenue of free advertising. The online world is driven by content, and recaps provide a shred of free and low-effort content for creators who would otherwise have to think of something new to say or do on social media. So giving Riot, Reddit, or Valve some free advertising is a small price to pay for not having to post anything else on Twitter for the day.

What's more, recaps show just how much data these companies collect and how normalized the storing of huge amounts of data by companies has become. Tech and gaming companies know precisely how long you use sites, games, and apps for, what device you're using, where you use that device, which friends you play with, your contact details, your purchasing history, your payment details, and more.

From this, companies can build a profile of just what kind of spender you are. And then upsell around that. Are you a whale who drops huge amounts of cash on loot boxes? Well, don't be surprised if they start advertising big deals just when your paycheck comes in. Are you a lower-spending user who just buys in the sales? Well, guess who's getting an email in their inbox just as those sales start, and a few more throughout the sale just to make sure! It doesn't help that we just hand this data over as well. Who reading isn't guilty of having a dozen games in their Steam Wishlist? And aren't we always pleasantly surprised when we receive a notification that it's on sale!

Recaps justify legally the retaining of this data. Many data protection laws force companies to delete or not gather user data if it's not of legitimate interest or being used. For example, a gaming company can't gather data on your eating habits, or physical health, because that's none of their business. 

Similarly, it's not really anyone's business how long you're at a computer or how long you spend playing games. However, by incorporating that data into a recap, a company can justify gathering it on the basis of legitimate interest. 

Of course, some of this data is already legitimate interest, but recaps also have the handy effect of acting as both markers of consent for gathering data, and a big refresher button on how long they can store that data.

For example, companies that have to comply with the GDPR can only keep data for as long as its purpose is unfulfilled. So, for example, a store could send you a questionnaire, asking, "how many times do you plan on visiting us in 2023?" Once you've answered, they can store that data until the end of 2023, when the answer is no longer relevant. The data's purpose has been fulfilled and must be deleted. But with recaps, the data never becomes unfulfilled. Because the recap needs the data for the next year, and the next year, ad infinitum.

It's become increasingly difficult for us to do anything about the gathering of our data. Companies make it incredibly difficult to use their services without giving them your data. Some sites barely function without cookies, and games increasingly need real phone numbers or two-step verification. Smurfs and alts are often frowned upon, and all your games are in digital libraries tied to your identity. Your data is with the companies now, and there's little you can do to claw it back.

What's more, in some cases you want this data with the companies. It's nice to get recommendations of things you'll like! It's good that your user experience is easier! (Although how much Spotify and Steam mess with the algorithm to just show you what they want remains to be seen).

Ultimately, it will be up to stricter legislation to force companies to store less data about their consumers. However, with each passing year, it seems less and less likely that legislators will catch up to the ever-shifting tech landscape. Even so, perhaps it's time to think twice before posting that next wrapped, recap, or rewind. Instead, why not allow your own, imperfect memory to remember what you did last year. It might not be data-accurate, but there's a good chance it'll be nicer to think about.