Are Fixed-URL Requests for Anonymous Gameplay Statistics Allowed Under the VRChat SDK License (Sections 4.1 & 4.2)?

Hi everyone!

I’m developing a VRChat world containing multiple mini-games, and I’d like to collect some basic, anonymous gameplay statistics, such as how many times each mini-game has been started across all world instances.

However, after reading the VRChat SDK License, particularly Sections 4.1 and 4.2, I’m unsure whether this implementation would be permitted.

My Proposed Implementation

The implementation is fairly simple:

  1. When a mini-game starts, UdonSharp uses VRCStringDownloader to make an HTTP GET request to a predefined, fixed URL hosted on Cloudflare Workers.

  2. The Cloudflare Worker increments a counter in a database for that specific mini-game.

  3. The request URL is completely static, with no dynamically generated parameters.

  4. No player IDs, usernames, scores, or other player-specific information are intentionally included in the request.

For example:

Mini-game starts
       ↓
VRCStringDownloader
       ↓
GET https://example.com/api/game-a-start
       ↓
Cloudflare Worker
       ↓
Game A total starts += 1

The purpose is simply to collect aggregate gameplay statistics for world development and balancing, not to track individual players.

My Questions About Section 4.2

Section 4.2 states:

Licensee will not use any internet connected component to send dynamic data from the VRChat Platform to another server, except through VRChat-provided dynamic components.

It also states that internet-connected components may only be used to display remotely downloaded content.

This seems to create two separate restrictions, and I’m particularly interested in understanding how they apply to the following scenarios.

Scenario A: Using a Fixed GET Request Solely for Counting

When a mini-game starts, the world requests a fixed URL, and the server increments its counter.

Nothing is displayed to players.

Based on the first part of Section 4.2, I understand that this may already conflict with the restriction limiting internet-connected components to displaying downloaded content.

Scenario B: Displaying the Updated Counter in the World

What if the Cloudflare Worker also returns the updated total number of game starts, and the world actually displays that information to players?

For example:

Mini-game starts
       ↓
GET (fixed URL)
       ↓
Cloudflare Worker
       ├─ Increment counter
       └─ Return updated total
       ↓
Display in world:
"Total games played: 12,345"

In this case, the downloaded content would genuinely be displayed in the world.

However, the request would still be triggered by an in-world gameplay event.

Would this implementation satisfy the content-display restriction, or would the server-side counting functionality still make it prohibited?

The Main Question: What Constitutes “Dynamic Data”?

The URL itself never changes, and no dynamically generated game data is included in the request parameters.

However, the timing of the request effectively communicates that a mini-game has started.

This leads to my main question:

Does triggering a completely fixed HTTP GET request in response to an in-world event constitute sending “dynamic data” under Section 4.2, even when the URL and request parameters remain unchanged?

And would displaying the server’s response in the world affect how this restriction applies?

What About Section 4.1?

Section 4.1 also restricts sending data collected from users, including usage data, to external servers.

My intention is only to record aggregate game-start counts, without associating them with individual players.

Would these anonymous, aggregate event counts still fall under the definition of user data or usage data?

Response from VRChat Support

I previously contacted VRChat Support to ask for clarification.

Unfortunately, I was informed that they do not provide individual clarifications on the Terms of Service, Community Guidelines, or other documents, although feedback may be considered for future policy updates.

As a result, I still don’t have an official answer regarding this specific implementation.

I’d Appreciate Your Thoughts

I’m interested in hearing how other world creators interpret these restrictions.

  • Has anyone implemented something similar or encountered relevant official public guidance?

  • Do you think triggering a fixed-URL request based on an in-world event constitutes transmitting dynamic data?

  • Would displaying the returned data make a meaningful difference under Section 4.2?

  • If neither approach is permitted, are there any officially supported alternatives for collecting custom aggregate gameplay statistics across world instances?

I understand that community opinions are not official policy interpretations. I’m simply hoping to better understand the restrictions.

I want to make sure my world complies with the SDK License.


English isn’t my first language, so I used ChatGPT to help translate and polish this post. I apologize if there are any mistakes or unclear expressions. Please feel free to ask if anything needs clarification!

Thanks in advance for any insights!

YTS 2.1 - YouTube Search, Subtitles, Quest by syncpulse has a static untrusted URL (dmn.moe/api/v6/hello/2026-09-26-00-live-g1-pcflat0) in the world for an opt-in button and counter.

The Karaoke in Sync! world by CMajor7 collects or used to collect some statistics about video playback error rates with third-party untrusted URLs.

Both of these only work for those with untrusted URLs enabled, obviously.


World analytics is on VRChat’s roadmap.

First of all, thank you to everyone who has taken the time to reply to this thread and share their insights!

I’ve been thinking about the examples mentioned in this discussion, and I feel that the existence of these implementations doesn’t necessarily mean they’re compliant with the SDK License.

For example, regarding YTS 2.1, if pressing its opt-in button causes an external server to record or increment a counter, couldn’t that also be considered collecting usage data from players under Section 4.1? After all, even without identifying individual users, the data would still originate from player actions.

I’m not suggesting that YTS 2.1 or any other world is necessarily violating the rules. I’m simply pointing out how broadly these restrictions could potentially be interpreted.

My concern is that Sections 4.1 and 4.2 seem rather broadly worded and somewhat ambiguous, leaving considerable room for interpretation and enforcement discretion.

If interpreted strictly and literally, it seems that even those existing implementations could potentially violate these restrictions.

It’s also possible that VRChat simply takes a more lenient approach to enforcement in practice, rather than explicitly permitting these implementations.

That’s what worries me. Just because something is currently tolerated doesn’t necessarily mean it will always be allowed. The broad wording of these clauses seems to leave developers in a position where something could be considered a violation depending on how VRChat chooses to interpret or enforce them.

I really hope VRChat will consider providing an official clarification of these provisions, or revising the SDK License to establish clearer boundaries for these kinds of use cases. It would be especially helpful to explicitly define what is and isn’t permitted, so that developers can make informed decisions without having to rely on ambiguous interpretations or assumptions about enforcement practices.