Under GDPR this kind of data collection and sharing HAS to be opt-in i.e. with an informed consent. You can’t just bury it in your TOS and/or privacy policy. The user has to be explicitly shown what they are collection, on what basis they are doing it and how they are using it, then give the user the choice to accept or decline that, and they have to respect that decision.

Well this whole area is mostly based on deceit. Like if they claim they MAY do something they will absolutely do it all the time, if they claim they aren’t getting anything from it, it just means they aren’t getting anything directly, but indirectly instead, or from a different involved party. I also like the message at the top of the page: “Under certain circumstances, you have rights under data protection laws in relation to your personal data.”. Under some circumstances you have rights. Which is weirdly accurate. Because in most circumstances, they will just sh*t on data protection rights. Which is also evident by everything being opt-out, rather than opt-in. And then, most likely, even when you disable everything, data will still flow somewhere. Then again, it’s an industry-wide problem. Not specific to Jagex.

Got some error when using their form to opt out