Pokemon Go has been a phenomenal success. Almost overnight the game has captured more active users than Twitter.

At the same time the game makers, Niantic, are increasingly coming under fire around privacy concerns re the user data that the game is hoarding – including location. Niantic’s privacy policy notes that it may share aggregated information and non-identifying information with third parties for research and analysis, demographic profiling and other similar purposes.

US Senator Al Franken has asked Niantic, to explain what they do with the user data. He’s also not happy that parents are not informed enough to give meaningful consent. And more recently acclaimed film director Oliver Stone weighed in claiming the game had hit…“a new level of invasion of privacy that could lead to totalitarianism.”

We asked MEF members and the wider mobile community what they think of the privacy issues and how the industry should respond.

Andy Patel

Security Advisor

F-Secure Labs

  

Andy Patel, Security Advisor, F-Secure Labs

There’s absolutely no security risk involved in the game. The game client queries GPS, and the backend for location information the same way that a map application or a location-enabled social media service would. Players do not see the location of other players. As far as the augmented reality portion of the game (which is only enabled when you go to catch a Pokemon), you can turn it off. A lot of people do that to save battery on their phone. When you catch a Pokemon, the game doesn’t save the photo (you have to do that manually).

There was a mild initial security concern when the game launched, based on the fact that the iOS version made a deprecated API call to Google’s authentication service that gave the game full access to a Google account. Since the game’s authentication servers were being hammered, Google authentication was the only way to sign up to the game. This issue is being addressed by Niantic.

Mark Maglaras

VP Sales & Marketing

Novatti

  

Mark Maglaras, VP Sales & Marketing, Novatti

Mobile applications such as Pokémon Go should improve the consumer’s trust by providing more transparency on how users data is being used. This is ideally intertwined with an enhanced user experience and more tailored in-app functionality. For example, if a user receives an email newsletter from their favourite shoes brand, they will suddenly be able (with an in-app purchase) to customise their character to wear said brand. This builds future consumer trust and loyalty with both the brand and the application provider. Privacy and transparency need to go hand in hand to maintain the consumer’s trust.

Gillian Hughes

VP

Veoo

  

Gillian Hughes, VP Corporate Sales, Veoo

There has been a lot in the news recently about the privacy of personal data and quite rightly it’s a very sensitive issue. Users of mobile apps, games and services need to know and trust that their data isn’t going to be misused and that they won’t end up receiving a whole lot of spam after signing up to a loyalty scheme.

However users don’t need to view the collection of data as negative because there are many upsides, such as better and more personalised marketing with more relevant offers, but in order to build trust companies must be totally transparent about how they are going use data and should only request data if there is a legitimate reason, such as improving a service or providing customers with more relevant or personalised communications.

Gone are the days of blasting out uniform advertising to consumers; today’s users want personalised marketing and companies need to respect this by building relationships with their customers before requesting such data. Being a household name alone doesn’t afford brands that level of trust and they should work first on safe levels of engagement by asking for innocuous details, such as name and email address, before asking for more personal data. Sending mobile vouchers via SMS can be a great way to do this, as it allows companies to reach out to their customers with personalised content but doesn’t require them to commit to downloading a full mobile app or signing up to a loyalty scheme.

Bob Gallagher

MD

Appsynth

  

Bob Gallagher, Managing Director, Appsynth

Richard Gomer

Scientist

UoS

  

Richard Gomer, Scientist, University of Southampton

Last week I didn’t know a Pigeotto from a Charizard, but yesterday I proudly caught my first Magikarp. Games designers are brilliant at helping us to understand the fictional worlds that they create – so why won’t anybody help us to understand what they’re doing in the real world?

The work we’re doing at the University of Southampton focusses on “meaningful consent” – the idea that, basically, we should be building a digital world in which consumers actually know what’s going on. The concern around Pokemon should not be whether they are right to process the data (I suspect that for most people it probably isn’t a material risk), but we should be concerned about a world where we can’t make informed decisions.

Consumers are losing out because values like privacy don’t exert meaningful pressure in the absence of knowledge, and services lose out because consumers rightly wonder what they’re hiding.

Ken Munro

Partner

Pen Test Partners

  

Ken Munro, Partner in Pen Test Partners

Niantic is not unique in its use of blanket permissions. From a marketing perspective, it makes perfect sense to request more permissions to access data that can be monetised in the future. But more data means more responsibility and that could see app developers compromise user privacy.

There’s also been an erosion of user control. It’s often difficult or impossible to alter these permissions retrospectively but it hasn’t always been this way. The facility to control permissions was in the Android OS as far back as Jelly Bean, but removed from Kit Kat and Lollipop. Google really dropped the ball with this, effectively paving the way for mass permissions. However, with Marshmallow, Android now have a great granular permissions feature. It means that users can select the permissions that an app is allowed e.g. Calendar, Camera, Contacts, Location etc. can all be customised. That user control has to be preserved

Serge Huber

CTO

Jahia

  

Serge Huber, CTO, Jahia

Typically, users do not want to have to think or care about data permissions. Most don’t understand it nor they do they understand the consequences of these data collection systems. But really, they should care as the data is at risk of being misused for commercial purposes or being sold to a third-party.

Of course, in the case of data breaches, which are known to happen, users should care.

The incoming GDPR should give users a new reason to care. The new legislation protects consumers against organisations moving their data without their knowledge and also protects their ‘right to be forgotten’. For example, Pokemon Go players are having data collected about their behaviour. Give it 50 years and they may not agree to that anymore. What can one do about data that was previously collected without one’s knowledge?

Jill Brittlebank

Senior Director

Zeta Interactive

  

Jill Brittlebank, Senior Director, Zeta Interactive

Brand trust is paramount: customers must be reassured that their data is safe. But businesses must pay more than lip service to this guarantee. If brands are to earn their customer’s trust, they must show they are using the data sparingly and thoughtfully, rather than deluging the customer.

The challenge for businesses now is to be clear about what data they are using, at the same time as showing how it adds value to the customer. Offering some form of opt-in will ensure consumers know what they are signing up to. Meanwhile, using data smartly and sensitively proves to customers that the more they let a brand know about them, the better their experience. Once brands can demonstrate the benefits outweigh the risks, customers will become ever more willing to divulge their data.

Richard Stiennon

CSO

Blancco Technology Group

  

Richard Stiennon, Chief Strategy Officer, Blancco Technology Group

When users sign up to the Pokémon Go app via their Google or Facebook account, Niantic reserves the right to gain access to all prior information that has been shared with the two platforms. The app then uses third party companies to analyse this data.

Having such a large collection of users’ personal mobile data makes it quite possible for the data to be accessed and even stolen at a later date. The app’s data sharing policy also leaves Facebook and Google at risk of violating EU GDPR, which takes a hard-line stance on ensuring users’ right to be forgotten.

Given how obsessed everyone is with the Pokémon Go app, it’s only as matter of time until the app’s millions of users become at risk of data theft. Niantic, Facebook and Google have a responsibility not to let this happen.

If you would like to contribute a comment to this article contact us at editorial@mefmobile.org or leave your thoughts in the replies below.