Zynga (Words With Friends, Zynga Poker, FarmVille, CSR Racing 2 and other mobile games) is owned by Take-Two Interactive Software, Inc. (NASDAQ: TTWO), which acquired Zynga on May 23, 2022; Take-Two's FY2026 Form 10-K states it 'develop[s], operate[s], and publish[es] products principally through Rockstar Games, 2K, and Zynga.' Zynga's own privacy-policy URL now 301-redirects to Take-Two's unified privacy policy (last updated February 2026), which discloses broad collection categories (identifiers, mobile/advertising device IDs, purchase/gameplay history, device and usage data, and 'Profile Inferences' derived from web/app activity), collection via cookies and third-party tracking technologies, and a self-declared CCPA sale/share of unique identifiers, IP address and behavioral/profile data with third-party advertising providers in the last 12 months, including data about users known to be under 18 with parental permission. Take-Two's 10-K separately discloses that in September 2022 an unauthorized third party accessed and downloaded confidential information from Rockstar Games' systems, and a separate incident exposed 2K Games help-desk vendor credentials used to send a malicious link to players; both were disclosed as remediated with immaterial incremental costs. The 2019 Words With Friends-era breach is documented in Have I Been Pwned's breach catalog, which lists the Zynga incident (breach date September 1, 2019) as affecting approximately 172.9 million accounts, with email addresses, passwords, phone numbers, and usernames among the exposed data classes.
TRACK RECORD
1 BREACH
[2019-09-01] · BREACH
Have I Been Pwned lists a breach record for Zynga: "Zynga".
Approximately 172,869,660 accounts affected, per HIBP.
Take-Two's unified privacy policy (which Zynga's own privacy-policy URL redirects to) states it collects identifiers including mobile device ID, platform/gaming service ID and advertising ID (IDFA, Android ID); purchase and gameplay history; device and usage data; and 'Profile Inferences' — inferences made from a user's information and web activity to build a personalized profile.
Zynga's own privacy-policy URL (www.zynga.com/privacy/policy/) returns an HTTP 301 redirect to Take-Two's unified privacy policy at take2games.com, self-confirming that Zynga's privacy program has been consolidated under its parent Take-Two rather than operated as a separately governed policy.
Take-Two Interactive Software, Inc.'s Form 10-K states it develops, operates, and publishes products principally through Rockstar Games, 2K, and Zynga, and its cover page lists its common stock as trading on the NASDAQ Global Select Market under the symbol TTWO.
The policy self-declares that in the last 12 months, Take-Two has sold and/or shared unique identifiers, IP address, and Internet/Electronic Activity and Profile Inferences with third-party advertising providers to enable personalized advertising, and separately states it may sell or share personal information about users known to be under 18 with parental settings or permission.
Have I Been Pwned's breach catalog lists the "Zynga" incident (zynga.com), breach date 2019-09-01, affecting approximately 172,869,660 accounts. Data classes exposed per HIBP: Email addresses, Passwords, Phone numbers, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Take-Two's Form 10-K discloses that in September 2022 an unauthorized third party illegally accessed and downloaded confidential information from Rockstar Games' systems, including early Grand Theft Auto development footage, and separately that an unauthorized third party accessed compromised credentials for a vendor platform 2K Games uses for help-desk support and sent a malicious link to certain players; both incidents were disclosed as remediated with only immaterial incremental costs.
The policy states information is collected automatically, including through cookies and similar tracking technologies from third parties such as advertising networks, business partners, and third-party information providers.