Pokémon Go is a reminder that many apps snoop

SAN FRANCISCO – The wildly popular Pokémon Go game app could be a “teachable moment” for the country when to comes to privacy.

“This is Privacy 101 at a mass scale,” said Jim Steyer, CEO of Common Sense Media, a non-profit advocacy group that promotes safe technology and media for children.

Worries about privacy quickly followed the spike in popularity of the app made public a week ago.

When it was initially released, it requested full access to users' Google accounts when activated on Apple devices through a user's Google account. That meant, according to Google's support page, that the app would have permission to see and modify nearly all information in the user's Google account, from Gmail to Google Drive to Google Maps.

Its creator Niantic Labs said it was a mistake and changed the setting in an update.

But that doesn't mean there aren't security concerns, as there are with many applications, say privacy experts.

Apps are notorious for both collecting and sharing data, often in ways that have nothing to do with the functionality of the app, said Omer Tene, vice president of research and education for the International Association of Privacy Professionals.

There are legitimate reasons for apps to want users' data, but many go far beyond that. Users need to pay attention and actively manage what they allow apps to collect and pass on about them.

“For example, if I’m using the Pokémon Go app, I certainly want to share my location with the app, because that’s part of the game. But on the other hand, I don’t want to share my location with the app when I’m not using it,” Tene said.

WHAT IT USES

The game collects users' Internet protocol address and webpages they visited before using the app. This paints
a fairly comprehensive picture of you that can be used to target and profile you, said Michelle De Mooy with the non-profit Center for Democracy and Technology in Washington, D.C.

In addition, "Niantic has a vast network of third-parties companies that it shares data with (beyond Google, which is a large investor)," she said.

For Steyer of Common Sense Media, the game is great because it gets kids outside and running around, but also “shows you the pros and the cons of the 24/7 digital universe" by its aggressive collection of location data.

Not only can it be used for targeted marketing based on proximity but also for longer term and less obvious uses.

The data “will be incorporated into data profiles that you the consumer will never be able to access,” he said.

PRIVACY POLICY

To play the game, users must have an account with either Pokémon Trainer Club, Google or Facebook.

In its privacy policy, Pokémon Go says it collects the personally identifiable information that users’ privacy settings permit it access to. That could include email addresses, user names and potentially other information.

For children under 13, a parent or legal guardian must register for the child.

The game and some third-party service providers it works with also set persistent cookies on the user’s device. These are small text files that identify users when they log onto the game and how they use it over time.

The app also tracks users’ Internet address, the type of browser and operating system used and the web page they visited before they began the game, as well as collecting and storing information about users’ locations.

According to Niantic’s privacy policy, the company may share aggregated information about users with third parties, as well as non-identifying information. It will be used for research and analysis, demographic profiling and other similar purposes. However, the information shared will not include users’ personally identifiable information, it says.

If the company is bought by another company, any personally identifiable information it has collected “may be disclosed or transferred to a third-party acquirer in connection with the transaction.” Users would have 30 days to refuse disclosure or transfer of their information, the policy states.

To refuse to have information collected, users must notify the company at pokemongo-privacy@nianticlabs.com. But doing so could mean “you may not be able to access and use all or a portion of the services,” the privacy policy says.

SETTINGS

For those who want to limit what they allow apps to know and pass on about them, privacy advocates offer these suggestions:

- Turn off the service that can be used to collect location information when you’re not playing the game.

- Avoid giving out personally identifiable information, like Social Security numbers. For example, according to the CDT, Pokémon Go asks for them when parents are registering for children older than 13.

- Create a separate email address and use it exclusively for games. Give it a different user name and even different demographics, so that it can’t be cross-referenced with your other online activities.

- At the very least, create a separate login for Pokémon Go. Don’t use your “social login,” meaning your Facebook, Google or Twitter accounts. When you use those, marketers can cross-reference your online actions.

- Take a moment to look at what access your other apps use and give them the least amount possible. On iPhones, tap Settings and scroll your listed apps to see what permissions you've given them. On Android phones, tap Settings and then Apps under the Device Settings, then choose an app and select Permissions to see what it's allowed to do.

- Steyer recommends resetting your online advertising ID each month. This limits how many companies are collecting information about your via your phone. On an iPhone, go to Settings -> Privacy -> Advertising, then turn “limit ad tracking” on. On an Android phone, go to Google Settings -> Ad, the click “opt out of interest-based ads."