XR-014: Player Data and Personal Information

FMA scenario severities

See the XR-014 reference for the underlying certification requirement.

Scenario	Severity	Platform
No current scenario.	Not Relevant (-4)
No current scenario.	Very Minor (1)
No current scenario.	Minor (2)
No current scenario.	Moderate (6)
No current scenario.	Critical (12)
The title shares personal information with other users and/or consoles.	Catastrophic (22)	XBOX One, XBOX Series
The title accesses or transmits sensitive personal information or presents that information on the screen (same device or remote device).	Catastrophic (22)	XBOX One, XBOX Series

Notes

Examples of personal information: email address, real name, age, date of birth, place of birth, profile passcode, secret question, passwords, credit card details, phone number.
Examples of sensitive personal information: location (anything more specific than country/region), profile passcode, secret question, passwords, credit card details.
The title might access a user’s IP address to determine their location.
If a user has to specifically perform an action that results in the user showing their IP address, it’s not an issue as it’s on the user. If it’s displayed by default, then it’s a concern for us.

Scenario	Severity	Platform
No current scenario.	Not Relevant (-4)	XBOX One, XBOX Series
No current scenario.	Very Minor (1)	XBOX One, XBOX Series
No current scenario.	Minor (2)	XBOX One, XBOX Series
No current scenario.	Moderate (6)	XBOX One, XBOX Series
No current scenario.	Critical (12)	XBOX One, XBOX Series
The title requests personal information from a Child XBOX profile beyond the scope of verifying age, acquiring parental consent, or publisher account linking.	Catastrophic (22)	XBOX One, XBOX Series
The title requests information from a Child XBOX profile required for verifying age, acquiring parental consent, or publisher account linking (birth date, parent/child email address) and doesn’t state what the data will be used for.	Catastrophic (22)	XBOX One, XBOX Series

Notes

Examples of personal information: email address, real name, age, date of birth, place of birth, profile passcode, secret question, passwords, credit card details, phone number.
Examples of sensitive personal information: location (anything more specific than country/region), profile passcode, secret question, passwords, credit card details.
The XR only applies in cases where the data is being entered by the user manually.
The title might access a user’s IP address to determine their location.
If a user has to specifically perform an action that results in the user showing their IP address, it’s not an issue as it’s on the user. If it’s displayed by default, then it’s a concern for us.