Harry Potter: Wizards Unite tracked users' locations even when they weren't using the app

The company behind Pokemon Go and Harry Potter: Wizards Unite says an Android bug led to the data collection.

Alison DeNisco Rayome Managing Editor
Managing Editor Alison DeNisco Rayome joined CNET in 2019, and is a member of the Home team. She is a co-lead of the CNET Tips and We Do the Math series, and manages the Home Tips series, testing out new hacks for cooking, cleaning and tinkering with all of the gadgets and appliances in your house. Alison was previously an editor at TechRepublic.
Expertise Home Tips, including cooking, cleaning and appliances hacks Credentials
  • National Silver Azbee Award for Impact/Investigative Journalism; National Gold Azbee Award for Online Single Topic Coverage by a Team; National Bronze Azbee Award for Web Feature Series
Alison DeNisco Rayome
2 min read

The company behind Harry Potter: Wizards Unite previously collected user location data when the game was not being played, according to a Kotaku investigation. 

Érika García / CNET

Niantic, creator of the Pokemon Go and Harry Potter: Wizards Unite mobile AR games, collects extensive amounts of user location data, and recently did so even when users weren't actually playing the games, according to an extensive investigation published by Kotaku on Wednesday. 

Kotaku analyzed more than 25,000 location records shared by 10 Niantic game players. Niantic kept an average of three location records per minute of gameplay on Wizards Unite, according to Kotaku, far more than it did for Pokemon Go. One of those players had at least one location record taken by Niantic during almost every hour of the day, suggesting that the game was collecting data and sharing it with the company even when the app was not in use but open in the background. 

Niantic told Kotaku that this data collection was due to a bug in the Android version of the app, which has since been fixed. The company also said that its privacy policy details the data it collects, and that users can request to delete that data. 

Niantic confirmed to CNET that the bug has been patched. 

Both Pokemon Go and Harry Potter: Wizards Unite track your location up to 13 times per minute while you are using the app, Kotaku found. This could allow Niantic or a malicious third party to track user behavior and locations. 

Pokemon Go -- Niantic's most popular game, with more than 1 billion downloads -- raised similar privacy concerns in the past: Developers were granted full access to users' Google accounts if they used the accounts to log into the game from an iOS device, CNET reported in 2016. Niantic said at the time that it would greatly limit the access it requests in the future, and that it didn't access anything beyond user IDs and email addresses. 

Watch this: Harry Potter: Wizards Unite gameplay details revealed