Augmented reality: mobile games know everything about you!

With the release, this summer, of Wizards Unite, a game based on the Harry Potter universe, Niantic has won new players using its augmented reality applications that include titles like Pokémon Go or Ingress. At first glance, excellent news from a developer who wants to get players moving and who sums up his mission in three words: exploration, exercise, and social. However, these games that bring the real world and the virtual world closer together do not only map the Earth; it also tracks its users.

The Kotaku site surveyed Wizards Unite players to understand better how data collection works. They asked ten European players to request their data from Niantic through the General Data Protection Regulation (GDR). They discovered information such as the number of calories burned during a session, the distance covered, the promotions they interacted with, and especially location data.

Privacy threatened by games

Kotaku revealed to these volunteers the information they were able to obtain by analyzing their data. Kotaku employees had almost unanimous reactions of surprise, players not imagining that the applications collected so much information, and especially that it was possible to learn so much about their lives. Some indicated that they had limited their use of the games. The players in question were able to access detailed data through the European regulation, but Niantic has stated that they do not share this data with third parties. All data resold to other companies is anonymized. Statistics such as how many people went to a particular place or how many interacted with an object at stake.

Data collection is a real invasion of privacy, and it is not enough to anonymize data to protect users. Researchers have shown that it takes only four locations associated with the exact time of their survey to identify a user from a data collection. The collection and resale of data in the form of games could lead to a dystopia where privacy has disappeared.

Data allowing to know all the habits of the players

On average, Wizards Unite recorded the location thirteen times per minute during the game, twice as much as Pokémon Go. For one of the players, they discovered at least one piece of information per hour at any time of the day or night, indicating that the game collects data even if it is not open!

By analyzing the data of one of the players, they were able to correctly identify the home and workplace, the path between the two, their daily habits, and even that they regularly eat fast food. In another case, they were able to conclude information when another user deviated from his usual activities. He went to the pharmacy in the morning and did not use the application in the evening. They correctly inferred that he or a member of his family was ill, which the player confirmed, indicating that it was one of his children.