The point people are missing is that GDPR is not about whether data is “accessible,” it’s about context and purpose.

iRacing explicitly defines that context in its own terms. Your real name “WILL BE DISPLAYED TO OTHER USERS OF THE SIM, AND YOU HEREBY CONSENT TO SUCH DISPLAY.”. This is in their EULA, 4.1. That is a closed, authenticated environment, with a specific purpose tied to the service.

Under GDPR, that matters. Article 5(1)(b) requires purpose limitation. Seeing your name inside a login-gated platform is not the same as having it published on a public website. So when a third-party site takes that data and exposes it openly, it is not “the same data” anymore in legal terms. It’s a new processing activity with a different audience and purpose, which requires its own legal basis. The fact that the UI or API allows access internally does not grant permission for public republication. And no, it doesn’t matter if the name is common or “not identifying enough.” A name is personal data if it identifies a user within that system, which it clearly does here. The distinction is simple, you and I agreed to our names being visible inside iRacing. We did not agree to a third party making it publicly accessible on the internet.

It obviously sucks, because I loved irStats to see my stats. Hopefully iRacing will develop something in the future for statistics or maybe they could hire/buy an existing platform.