'Hocus Pocus 2' Review Wi-Fi 6 Router With Built-In VPN Sleep Trackers Capital One Claim Deadline Watch Tesla AI Day Student Loan Forgiveness Best Meal Delivery Services Vitamins for Flu Season
Want CNET to notify you of price drops and the latest stories?
No, thank you

Harry Potter: Wizards Unite tracked users' locations even when they weren't using the app

The company behind Pokemon Go and Harry Potter: Wizards Unite says an Android bug led to the data collection.

The company behind Harry Potter: Wizards Unite previously collected user location data when the game was not being played, according to a Kotaku investigation. 
Érika García / CNET

Niantic, creator of the Pokemon Go and Harry Potter: Wizards Unite mobile AR games, collects extensive amounts of user location data, and recently did so even when users weren't actually playing the games, according to an extensive investigation published by Kotaku on Wednesday. 

Kotaku analyzed more than 25,000 location records shared by 10 Niantic game players. Niantic kept an average of three location records per minute of gameplay on Wizards Unite, according to Kotaku, far more than it did for Pokemon Go. One of those players had at least one location record taken by Niantic during almost every hour of the day, suggesting that the game was collecting data and sharing it with the company even when the app was not in use but open in the background. 

Niantic told Kotaku that this data collection was due to a bug in the Android version of the app, which has since been fixed. The company also said that its privacy policy details the data it collects, and that users can request to delete that data. 

Niantic confirmed to CNET that the bug has been patched. 

Both Pokemon Go and Harry Potter: Wizards Unite track your location up to 13 times per minute while you are using the app, Kotaku found. This could allow Niantic or a malicious third party to track user behavior and locations. 

Pokemon Go -- Niantic's most popular game, with more than 1 billion downloads -- raised similar privacy concerns in the past: Developers were granted full access to users' Google accounts if they used the accounts to log into the game from an iOS device, CNET reported in 2016. Niantic said at the time that it would greatly limit the access it requests in the future, and that it didn't access anything beyond user IDs and email addresses. 

Now playing: Watch this: Harry Potter: Wizards Unite gameplay details revealed