Harry Potter: Wizards Unite tracked users' locations even when they weren't using the app
The company behind Pokemon Go and Harry Potter: Wizards Unite says an Android bug led to the data collection.
- National Silver Azbee Award for Impact/Investigative Journalism; National Gold Azbee Award for Online Single Topic Coverage by a Team; National Bronze Azbee Award for Web Feature Series
The company behind Harry Potter: Wizards Unite previously collected user location data when the game was not being played, according to a Kotaku investigation.
Niantic, creator of the Pokemon Go and Harry Potter: Wizards Unite mobile AR games, collects extensive amounts of user location data, and recently did so even when users weren't actually playing the games, according to an extensive investigation published by Kotaku on Wednesday.
Kotaku analyzed more than 25,000 location records shared by 10 Niantic game players. Niantic kept an average of three location records per minute of gameplay on Wizards Unite, according to Kotaku, far more than it did for Pokemon Go. One of those players had at least one location record taken by Niantic during almost every hour of the day, suggesting that the game was collecting data and sharing it with the company even when the app was not in use but open in the background.
Niantic told Kotaku that this data collection was due to a bug in the Android version of the app, which has since been fixed. The company also said that its privacy policy details the data it collects, and that users can request to delete that data.
Niantic confirmed to CNET that the bug has been patched.
Both Pokemon Go and Harry Potter: Wizards Unite track your location up to 13 times per minute while you are using the app, Kotaku found. This could allow Niantic or a malicious third party to track user behavior and locations.
Pokemon Go -- Niantic's most popular game, with more than 1 billion downloads -- raised similar privacy concerns in the past: Developers were granted full access to users' Google accounts if they used the accounts to log into the game from an iOS device, CNET reported in 2016. Niantic said at the time that it would greatly limit the access it requests in the future, and that it didn't access anything beyond user IDs and email addresses.
