Not every anti-cheat is watching you around the clock — but some are, and the difference comes down to when the driver loads. Vanguard loads at Windows boot and stays active whether or not you're playing. BattlEye and Easy Anti-Cheat load when the game launches and unload when it closes. Same kernel-level access; very different operational footprint on your machine.
If you care about what's running on your PC and when, this distinction matters more than the brand name. Here's which anti-cheats are always-on, which are session-only, and what that means for your privacy and your hardware identity.
Quick reference: when each anti-cheat runs
| Anti-cheat | When it runs |
|---|---|
| Vanguard (Valorant, LoL) | Boot-time, always-on |
| BattlEye | Loads with the game, unloads on close |
| Easy Anti-Cheat | Loads with the game, session-based |
| ACE (Tencent) | Reported to keep running after the game closes |
| Viking (War Thunder) | Ring-3, inside the game client only |
Always-on: the Vanguard model
Vanguard is the clearest example of the always-on approach. It loads a driver at Windows boot and runs continuously, monitoring the system whether or not Valorant is open — disabling it typically requires a reboot before you can play again. That persistence is exactly why Vanguard draws the most privacy scrutiny: a boot-time, always-resident kernel driver is, by design, present for everything your PC does. Our Vanguard deep dive covers how early and deep that load runs, and the broader trade-offs are in kernel anti-cheat and privacy.
Session-only: the BattlEye and EAC model
BattlEye takes the opposite approach. It loads when the game starts and unloads when the game closes, so it isn't monitoring your PC between sessions. Easy Anti-Cheat behaves similarly. Both still operate at the kernel level while active — enough to scan memory and read the identifiers behind a hardware fingerprint — but their window is the game session, not your whole day. For more on these engines, see our BattlEye explainer and Easy Anti-Cheat explainer.
The awkward middle: drivers that linger
Some systems blur the line. Tencent's ACE has been reported to keep running in the background even after you close or uninstall the game, which is the kind of behavior that makes a leftover kernel service both a privacy and a security question — we covered it in our ACE breakdown. If a service still loads at boot after you removed a game, knowing how to fully remove an anti-cheat matters.
What this means for your hardware identity
Whether a driver is always-on or session-only, while it's active it can read the firmware-bound identifiers that anchor a hardware ban — motherboard serial, SMBIOS, TPM. The "when it runs" question is about exposure over time, not whether it can fingerprint you; any of these can build the fingerprint during a session. The always-on models simply have a far larger window, which is why they dominate the privacy debate even though all of them can issue HWID bans.
FAQ
Does Vanguard run when I'm not playing?
Yes. Vanguard loads at boot and runs continuously, which is why disabling it usually requires a restart before you can play.
Does BattlEye monitor my PC after I close the game?
No. BattlEye loads with the game and unloads when it closes, so it isn't active between sessions.
Is an always-on anti-cheat spying on me?
It has the access to read broadly, but in practice these systems focus on cheat-related processes. The concern is capability and persistence, not a confirmed function.
Does session-only mean it's safer?
It has a smaller time window, but while active it has the same kernel-level access. "Session-only" is about exposure over time, not depth.
The takeaway
The real divide in anti-cheat isn't kernel versus user mode alone — it's always-on versus session-only. Vanguard's boot-time persistence gives it the widest window and the loudest privacy debate; BattlEye and EAC confine themselves to the game session; and a few systems linger when they shouldn't. All of them can fingerprint your hardware while active, so the question to ask before installing isn't just how deep an anti-cheat reaches, but how long it stays.