It's nothing to do with VR in particular. This is the top-10 from https://store.steampowered.com/charts/topselling/US, half of them are collecting data to share (and one to sell) to advertisers. The fact that this is surprising you is kind of the point, Valve's not providing enough transparency or doing enough (any?) policing of this. You won't even find the disclosures in the EULAs, at best they link to a separate privacy policy. I suspect lack of EULA isn't necessarily a good indicator of no data being collected either.
The breadth of data being collected includes browsing, installed software, identity and account identifiers, location, device and OS characteristics.
- WarDogs: not sharing/selling https://www.wardogs.com/privacy
- Marvel Rivals: not sharing/selling https://protocol.unisdk.easebar.com/release/latest_v475.html
- CounterStrike: is Valve's
- Borderlands 4: https://www.take2games.com/privacy/en-US/
"In the last 12 months, Take-Two has sold and/or shared unique identifiers, IP address, as well as Internet/Electronic Activity and Profile Inferences with third-party advertising providers to enable us to provide personalized advertising to you and others like you. We may sell or share personal information about users that we know are under the age of 18 (or older, in certain locations) with their (or depending on age, their parent's) settings or permission."
- Halloween: https://www.illfonic.com/privacy-policy-eula
"Some advertising we engage in may be “targeted advertising,” which is the practice of showing you more relevant or personalized ads based on your activity over time and across non-affiliated services. Targeted advertising often involves us incorporating third party tracking technologies into our Service or disclosing (often hashed) identifiers, such as email addresses or Ad IDs, with third parties. These third parties then match our data with their own (or their partners’ data) to deliver ads to you or similar audiences. For example, we may incorporate the Meta pixel on our website to serve ads to Meta audiences based on the data we provide.
We also use audience modeling services, where we and a partner each disclose (often hashed) identifiers to a technology provider. The technology provider then matches common factors between our and the partner’s data to help us understand audience overlap and improve campaign performance."
- Baldur's Gate 3: not sharing/selling https://larian.com/privacy
- Overwatch: https://www.blizzard.com/en-us/legal/a4380ee5-5c8d-4e3b-83b7...
"We disclose this personal information to: Online marketing or advertising partners including on our mobile games These partners may combine this personal information with information that they have collected about you when you use their services (or the websites and services of third parties) to personalize your experience or to improve the accuracy of their analytics, targeting, and measurement systems."
- Apex Legends: https://tos.ea.com/legalapp/WEBPRIVACY/US/en/PC/
"We also may share information relating to your device and your use of our Services with our third-party advertising partners so they may deliver targeted advertisements to you when you visit third-party services and websites within their networks. This practice is commonly referred to as "interest-based advertising," "online behavioral advertising," or "targeted advertising
- The Blood of Dawnwalker: not sharing/selling https://bandainamco.com/privacy-policy/
- Bodycam: not sharing/selling https://www.playbodycam.com/en-US/personal-data
Thanks for breaking that down. I actually did think on Steam that if there was anything like this Steam would mark it as having a EULA. I don't tend to play games from big companies like that, but the use and sale of your info when you don't even agree to or even know about it is disturbing. All this stuff should be marked up front before you even purchase or interact with the game.