FiveM Anticheat Privacy: What Data Is Actually Collected

A FiveM anticheat adds less new data than the identifier set your server already receives. The license hash, Cfx ID, Steam ID, Discord ID and IP address it works with are handed to every server you join by the platform itself, before any anticheat is installed. What a detection system adds is a client-side view of your game process, plus evidence staff capture. FiveM anticheat privacy is mostly a question about staff habits.

Two people search this. If you are a player, you arrived suspicious; start at the top. If you run a server, you need a reply you can paste into a ticket, so the table and owner sections are yours. Each section says who it addresses.

What data does a FiveM anticheat collect?

For players. Two layers. The first is the identifier set FiveM gives every server: a Rockstar Online Services license hash, a Cfx user ID, your Steam and Discord IDs if you connected through them, and your IP address. The second is what a client-side component observes about your game process, plus evidence staff capture during a report.

Only the second layer exists because of the anticheat. The first arrives with the connection.

What identifiers does a FiveM server see when you connect?

The documentation for GetPlayerIdentifiers says the native "Returns a table containing all of the player's identifiers." The documented list is six identifier types across five entries below - not dozens, and not a moving target.

• license and license2 - Rockstar Online Services hashes; the docs say license2 "can be the same value as license".
• steam - a Steam ID in hex, if you connected through Steam.
• discord - a Discord user ID, if Discord is linked.
• fivem - your Cfx user ID.
• ip - your IPv4 address.

Not every player has all six; the Steam and Discord entries depend on how you connected. The glossary post defines each term, so this article will not.

Timing matters more than the list. The official playerConnecting page carries an example that reads identifiers during that event. Your identifiers are readable before you have finished joining, through a documented native, with no consent prompt and no anticheat involved.

The platform even grades identifiers on trust: the server commands reference documents `sv_authMinTrust` as a scale "from least to most trustworthy", and owners should raise it rather than leave it at the shipped value. Hardware-derived tokens sit alongside them - the native docs call tokens "specific to a server" - and their mechanics belong in HWID bans explained.

Is a FiveM anticheat spyware?

For players. Not in the sense the word normally carries. A FiveM anticheat shipped as a server resource is delivered by the server, runs inside the FiveM client's scripting runtime, and stops when you disconnect.

The confusion comes from collapsing two categories. An in-game resource is bounded by the runtime hosting it. A program you download and install outside FiveM is ordinary desktop software with ordinary reach. For the detection side, see what a FiveM anticheat is and how detection works.

What does a client-side component additionally observe, and why?

For both audiences. The server cannot see inside your game process. Server-side checks watch outcomes - positions, transactions, events - the subject of server-side versus client-side detection. One class of problem lives only in the client: code injected into the running game, and unauthorised modification of game memory.

So a client component observes classes of local state: injection into the game process, and memory changes the game would not make itself. We stop at the class names deliberately, because cadence and thresholds help a cheat developer more than they help you.

Does a FiveM anticheat take screenshots of my desktop?

For players. The documented capability captures the game view. The first-party Cfx resource screenshot-basic calls itself "a basic resource for making screenshots of clients' game render targets using FiveM". That is the frame the game draws, including anything a cheat menu drew over it - not your desktop.

Any server can request one with an official resource, anticheat or not. FairShieldAC lists screenshot verification and OCR detection among its features, at that same scope. Where the image goes afterwards is the staff question.

Raw scan data versus a shared verdict

For owners choosing a system, and players judging one. There are two ways to build the client half: ship raw observations off the machine for remote analysis, or evaluate locally and send only the conclusion. Under local evaluation the detail is not sent off the player's machine.

FairShieldAC's on-device deep scan catches injectors and memory hooks locally, and only an encrypted verdict is shared. We will not describe the payload, the transport, or a verdict's contents. The shape is the point: a verdict is a decision, and a decision is a far smaller thing to hold than a scan.

Who can see it, and how long does it live?

For owners. Ordinary management tooling records far more about your players than a detection verdict does. txAdmin's logging documentation describes its Server Logs stream as "all actions that happen inside the server, for example player join/leave/die, chat messages, explosions, menu events, commands", defaulting to 1-day rotation, seven files and a 10 GB cap, while Admin Logs run a 7-day interval with no file limit. Division of labour: anticheat versus txAdmin.

Access control is coarse. The txAdmin permissions reference lists "View Player IDs in-game" as one grantable permission, beside "View txAdmin Log" and "View server logs". Ban records carry identifiers directly, and which fields are populated depends on the build and the ban tooling.

Then the layer with no retention policy at all - screenshots pasted into staff Discord channels, appeal threads quoting identifiers, webhook alerts feeding a channel half the team can scroll. That is where player data actually accumulates. The fix is process: a defined staff workflow and a deliberate alerting setup.

Can people pull my players' IP addresses from the server list?

For owners, and the players who ask them. Not from the HTTP endpoints on current server builds. `sv_endpointPrivacy` is documented as "a boolean variable that, if true, hides player IP addresses from public reports output by the server", but the current server source removes it and prints: "sv_endpointPrivacy has been removed. Player endpoint addresses are no longer exposed on any HTTP endpoint." The protection is now unconditional, so the only action left is to keep your artifacts current and delete the stale line from server.cfg.

If that line is still in your server.cfg, your console is telling you to delete it. This is master-branch behaviour and the docs page still carries the old description, so trust your console.

What a player can reasonably ask a server owner

For players. Each maps to something an owner can check. Paste them into a ticket.

• Which anticheat do you run, and does it evaluate on my machine or send data off it?
• Who holds the in-game View Player IDs permission?
• Are your server logs at txAdmin defaults, or has retention been extended?
• Where does an evidence screenshot go, and when is it deleted?
• How long do you keep ban records, and which identifiers are attached?
• Do you share ban data with other servers, and if so, what crosses?

An owner who answers all six is running a tight operation. One who stumbles on the permissions and screenshot questions has a staff discipline gap rather than an anticheat problem. Appeals are the other moment stored evidence surfaces, so ask about false positives early.

Frequently asked questions

Does a FiveM anticheat collect data my server did not already have?

Mostly no. The identifier set - license, license2, steam, discord, fivem and ip - reaches every server you join through a documented platform native. What a detection system adds is client-side observation of the game process and the records of any detection it produces.

Can a FiveM anticheat read my files or see my other programs?

It depends which category it belongs to. A server resource runs inside the FiveM client's scripting runtime, so its reach is whatever that runtime exposes. A program you download and install is ordinary software with ordinary reach, and deserves the scrutiny of any install. Ask the owner which one they run.

How long is FiveM anticheat data kept, and who can see it?

There is no single answer, and one confident number usually describes a product rather than the platform. FairShieldAC's published privacy policy states that "Detection and ban data may be retained longer for security and analytical purposes", with access restricted to authorised personnel. Ban records last as long as the ban.

Does a FiveM anticheat share my data with other servers?

It can, and it is worth asking rather than assuming. FairShieldAC runs a global ban network using HWID, IP, Steam and Discord identifiers, screened at connect - cross-server bans are the point of it. The on-device deep scan is separate: only an encrypted verdict is shared.

What to do next

For owners. Do the cheap audit. List who holds the in-game View Player IDs permission. Check whether sv_endpointPrivacy is still in your config. Decide where evidence screenshots may live. Then write four honest sentences in your rules channel about what you collect and who sees it; a specific paragraph settles the ticket, and silence never does.

If you are comparing systems on this basis, weigh the client design alongside the detection list: local evaluation with a shared verdict is a different posture from shipping raw scan data. Privacy posture belongs on the same shortlist as detection coverage when you narrow down the best FiveM anticheat candidates for your server. Our roundup of the best FiveM anticheat options for 2026 covers the field, how to test your anticheat safely covers verification without breaking your server, and VPN detection picks up the IP question. FairShieldAC's plans include a free trial.