Harry Potter: Wizards Unite is an augmented reality game. It collects your location data, among other things, to show you Inns, Fortresses, Greenhouses, Traces, and Ingredients as you move around the world, playing the game.
But what else do they collect?
And do you need to worry about it?
Niantic Data Collection
On October 16th, Kotaku published an article titled “The Creators Of Pokémon Go Mapped The World. Now They’re Mapping You.” In this article, they detailed how Niantic collected user data, and what this data could be used for. They focused especially the users that play Wizards Unite.
Of course, when you installed Wizards Unite, you gave the app a fair few permissions that are necessary for gameplay. If the game couldn’t track where you are, you simply couldn’t play. If the game didn’t have access to your camera, you couldn’t open Portkeys or take AR photos.
Kotaku asked a number of Wizards Unite players in Europe to ask Niantic for the data collected from them (specifically Europeans, since the EU law GDPR forces Niantic to comply with such a request). These players then shared this data with Kotaku.
What kind of information had Niantic saved on these players?
- Their movements, tracked through GPS, Wi-Fi and mobile cell tower triangulation.
- The number of calories they likely burned during playing sessions.
- The distance they traveled.
- Promotions they engaged with.
- Timestamped location data, with latitudes and longitudes.
On average, there were three location records per minute of gameplay, which is nearly twice as many records as kept per minute of Pokémon GO gameplay.
What’s worse was that one player had the game send these location pings even when they weren’t playing, and the game wasn’t active. Kotaku did ask Niantic about this, and Niantic answered that it was a bug that has since been fixed. The game is only meant to send pings while you are actively playing.
The game does, of course, need to track you, but bear in mind that the information Niantic gets through your location can tell them a lot about you. Where you live, where you work, your patterns of behavior, and when and how you deviate from these patterns. Kotaku could go into amazing detail about their volunteers’ daily routines and habits.
Why does Niantic save this data?
This data needs to be collected, but not saved, for the purpose of providing gameplay.
Saving the data for a little while to find spoofers might be reasonable. If a ping comes from location A one minute and location B, miles away, the next, this is a good indication that the player is cheating.
But why save it longer than that?
Niantic does share this data with third parties, in the form of their sponsors. Always anonymized, they hand data over on how many people go to these in game locations, and what they do with them – fight in Fortresses, get food from the Inns. This is information I would want as a sponsor, to see if my sponsorship actually brought any people to my business.
Kotaku does point out that it is not impossible to use anonymized data to identify the person behind it – you, the player. This is likely not something the sponsors are in the habit of doing, but it might still be good to keep in mind.
In Niantic’s own words
- Device location information – of course, the game needs to know where you are while playing. It finds this out through GPS coordinates, as well as WiFi points you may be accessing, and mobile/cell towers your phone interacts with. As a default, this data is only collected while you play the game, although if Adventure Sync, or a similar service that will allow you to walk Portkeys even while not playing the game, is ever implemented, you will have the option to give the game permission to use information gathered from the third party app you use to synchronize your distance – Google Fitness or a similar service.
- What you do in the game – when you interact with Inns, Greenhouses, Fortresses, when you pick up Ingredients, do Encounters and so on. Anything you do in the game is, of course, data that the game collects from you. Otherwise, you couldn’t receive items or rewards.
- Certain information about your device, including OS, model, certain settings and information about what third party apps you have on your phone. This is, in part, in order to make sure you are not using other apps to spoof your location or otherwise perform actions that go against Niantic’s Terms of Service.
If you want a complete list of the permissions the app has, your phone or app store will have that information. Google how to find app permissions for your particular phone model or operating system.
More important, perhaps, is who Niantic themselves say they share your data with, and for what purposes:
- Niantic’s Serices Providers – this is other companies and entities that Niantic have employed to perform administration, analytics, administer events, competitions, provide customer support or process any payments when you buy tickets or items in the game.
- Other players. This is any information that is shared with your friends in the game, or teammates in Fortresses. It’s also what allows your name to show up as you have placed a Dark Detector at an Inn.
- Third Parties – mostly anonymized data is shared with third parties for analysis, although personal data may also be shared with Niantic’s publishing partners for the purpose of direct marketing – although this is only done if you have actively given them permission to do so.
- Law Enforcement, or private parties when required by law or in order to protect themselves or other players.
- If Niantic, at any point, is bought by or merged with another company, they will share your data with this new company who are going to continue running the game.
How long will they keep your data? As long as they need it. There’s no easy answer to this, they will keep your data until they don’t need to keep it, neither for legal reasons or for their own purposes, such as analytics and game development.
Are you still worried?
You can contact Niantic and ask them to send you all the data they have collected on you. While Kotaku focused on EU citizens because of the GDPR law, Niantic will comply with this request no matter where you live. You can also ask them to remove any data they have collected about you. Be aware, though, that much of the data they do collect, is necessary for the game. You can’t ask them to stop tracking your location or what you do in the game, since these things are necessary pieces of information for the game to even function. If you contact them with such a request, they will explain why they can’t comply.
Also, to be real for a moment. Niantic is not the only entity gathering this kind of information.
Google, Facebook and a plethora of other apps and companies, are also gathering a lot of information about you. It’s a price we pay for being on the internet, for using all the convenient programs and helpful apps that are out there.
I don’t know if this calms you down or not, but at least Niantic is providing an amazing gameplay experience in return for this data.