This won’t surprise many readers, but Campfire, the social media messenger app built by Niantic for its games, is not working as promised and in fact is leaking gamers’ data against their explicit instructions.
According to Pokemon GO datamining group PokeMiners, players who instruct the app to share the new Catch Cards made in Pokemon GO with only themselves will find that their data are being shared much more widely than that anyway. The cards themselves are meant to be a fun way to mark where and when a pokemon was captured – such as for reporting rare pokemon to nearby players without shouting it in the streets – but as designed, sharing that info means revealing the player’s location at a specific time and on a specific date, which means that if the game is broadcasting location data against the players’ instructions, it could be used by malicious actors to narrow down their activities.
A warning about the privacy issues with the catch card feature.
While you can select sharing options in the campfire app selecting "Only Me" actually still sends everyone on your friends list a notification and shows the entire post, location etc on the map.
— PokeMiners (@poke_miners) December 5, 2022
This isn’t the first time Niantic’s apps have been accused of oversharing player data against players’ wishes; readers will recall that Pikmin Bloom featured flower trails not turning off or properly deleting data when players requested the app or Niantic support do so. We also reported on Pokemon GO gyms being used for stalking in a method nearly identical to methods exploited in Ingress. In fact, Niantic’s problem with respecting customers’ privacy goes back at least as far as 2010, when its boss was caught up in Google’s Wi-Spy scandal.
Niantic can’t claim this is just a beta issue pertaining only to players invited to test as essentially everything Niantic releases is in beta (the running gag is that New Zealand and Australian players are unpaid POGO beta testers); moreover, Niantic’s been plagued with communication failures, buggy content, broken promises, and rigged events this year, so this is yet another black mark on the MMOARG company in 2022. Players should always be aware of the data they share when playing games, but unfortunately it’s becoming especially true with Niantic’s titles.
