Just had the following email from GOG about account migration for CD Projekt Red games, not quite sure what to make of it. Don't CDPR own GOG? Why do they need to be separated? What does this mean for the long term future of the services?
MIGRATION OF CD PROJEKT RED ONLINE SERVICES
Dear [user],
You are receiving this email due to your use of online features, including Cross Progression and My Rewards, in CD PROJEKT RED games, as well as your participation in platforms like the CD PROJEKT RED Forums. We are migrating these products to a new account system, owned and operated by CD PROJEKT S.A., effective from March 5th, 2024. This consolidation will involve the transfer of governance of your personal data, including your email address and username, from the GOG account system to the CD PROJEKT RED account system.
What does this change?
Starting March 5th, 2024, the above mentioned online features and services will be available through a new CD PROJEKT RED account system.
Do I need to take any action?
No, a new CD PROJEKT RED account will be created for you automatically based on your GOG Account information: user ID, username and email address. This will allow you to continue using features provided by CD PROJEKT RED with no interruption. No action is required on your end.
How can I log in after the migration?
Your new account will use the same email address as your GOG Account. If you’re already logged into any of our games, you will stay logged in when the account change takes place.
What happens to my personal data?
Upon migration, CD PROJEKT S.A. will become a data controller of your personal data connected with CD PROJEKT RED account. Transfer of data will be based on a legitimate interest in ensuring continuity of CD PROJEKT RED online services. For more information see updated CD PROJEKT S.A. Privacy Policy available here.
How does this affect my current GOG account?
Your GOG account and all your GOG purchases remain unaffected. The GOG.com website and the GOG Galaxy app will continue to use the GOG account system. Your GOG account will be separate from your CD PROJEKT RED account.
Can I opt out?
If you do not wish to have a CD PROJEKT RED account created for you, you may opt out of the account creation process by clicking this link. After the account system migration, you will be able to delete your account with the same link.
If you choose to opt out, please note that on March 5th, 2024 you will lose access to Cross Progression, My Rewards, and RED Forums, and all connected data will be permanently deleted.
You can create a new CD PROJEKT RED account at any time.
If you have any questions or need further assistance, please visit our support page.
Warm Regards,
GOG and CD PROJEKT RED Teams
GDPR and pii reasons most likely. It's a nightmare keeping track of why certain data is on certain accounts. This can vastly simplify the GDPR compliance mechanisms. If your GOG account is merged with your PR account, there is probably significantly more "sensitive" data (CC numbers, addresses, etc) in the GOG account. This probably exempts some data that either cdpr or gog tracks from deletion or retrieval requests.
But it isn't a merger, it's a partial transfer. Your GOG account will still exist, but your CDPR games will be moved from GOG to CDPR.
Exactly what this means is unclear, the email and their online FAQ merely says "online features including Cross Progression and My Rewards as well as CDPR Forums" - it does not list everything that's being migrated. It could be that GOG will only sell old games, while new games will be on a separate store, or it could be just that achievements and cross-platform scores will be on CDPR while GOG continues as normal. It could also end up being a gradual change with GOG falling to the wayside, and new games (1st and 3rd party) only being sold on CDPR.
Also, GDPR is hardly a reason. GOG is a CDPR subsidiary, and both are based in Poland, which is in the EU. They're in the same jurisdiction. There's no real issue with GDPR, even if the two services were sharing data - GDPR allows this for the purpose of providing a service.
I've sent a support ticket to them asking for more information.
Separation of data between accounts makes them fall under different retrieval requirements.
As one account, a request for all of the data from that account contains both chunks. Separation of those accounts separates the need to accommodate requests for data from one on the other.
It can also mean that internally they may have a sufficient mechanism that data that was previously identifying to no longer being identifying (breaking userid to data pairings for example) which is sufficient to "anonymize" the data that it no longer needs to be reported or maintained.