Pokemon GO caught millions of players and their data.

• Position: PRIVACY

Within days of its July release in the United States, Pokemon GO attracted millions of users, boosted Nintendo's market value by $9 billion and counting, and garnered attention around the world.

But few realized that while they were walking around playing and collecting Pikachus, the company behind the game was catching their personal data.

When they downloaded Pokemon GO to their iPhones, millions of people inadvertently granted access to large amounts of user data to the game's developer, Niantic Inc., the Wall Street Journal reported. The company said it quickly fixed the issue with an app update, but the attention made many consumers aware of what and how much information similar apps regularly collect and how easy it is for apps to gain access to users' private data.

Like most apps that work with the GPS in smartphones, Pokemon GO can tell a lot of things about players based on their movement as they play: where they go, when they went there, how they got there, how long they stayed, and who else was there. And, like many developers who build such apps, Niantic collects that information.

According to the Pokemon Go privacy policy, Niantic may collect users' e-mail addresses, IP addresses, the web pages they were perusing before logging into Pokemon GO, usernames, and locations, among other things. Also, if they use their Google account for sign-in and use an iOS device, Niantic can access their entire Google account unless they specifically deny them that access. That means Niantic could have access to their e-mail, Google Drive docs, and more.

It also may share this information with other parties, including the Pokemon company that co-developed the game, "third-party service providers," and "third parties" to conduct "research and analysis, demographic profiling, and other similar purposes." Its policy also says it may share any information it...