On our research, we found that the top 5 most popular apps children play, are Minecraft, Stardew Valley, Terraria, Pokemon GO, Toca Life – Vacation. These apps and their developers collect a lot of data from these games. Let’s look at every one of them:

 

App: Minecraft

Data collected: Collects data from you, through their interactions with you and through their products. You provide some of this data directly, and they get some of it by collecting data about your interactions, use, and experiences with their products. The data they collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use. They also obtain data about you from third parties.

 

App: Stardew Valley

Data collected: They may automatically receive your data from third party platforms (such as Steam, Playstation Store, etc), through which you download and play the game. The personal data they collect from third-parties may include, your name, the name of your account associated with the third-party platform, and a list of your saved contacts with the third-party platform. Data they collect about your use of the websites may be collected through cookies and web beacons. Cookies are small files placed on the hard drive of your computer through your web browser that enables them to recognise your browser and capture and remember certain information. Web beacons (also referred as “clear gifs”, “pixel tags”, and “single-pixel gifs”) are small electronic files that enable them to count users whom have visited their pages and for other related website statistics.

 

App: Terraria

Data collected: When you engage in certain activities, such as registering for a membership, ordering a product or service, submitting content and/or posting content in discussion forums or other public areas, entering a contest or sweepstakes, filling out a survey, or sending them feedback, they may ask you to provide certain information about yourself by filling out and submitting an online form. It is completely optional for you to engage in these activities; however, they may ask that you provide them personal information, such as your first and last name, mailing address (including zip code), e-mail address, employer, job title and department, telephone and facsimile numbers, and other PII (“Identity Data”). When ordering products or services on the site, you may be asked to provide a credit card number (“Financial Data”). Depending upon the activity, some of the information they ask you to provide is identified as mandatory and some as voluntary. If you do not provide the mandatory data with respect to a particular activity, you will not be able to engage in that activity. They gather certain information about you based upon where you visit on their site in several ways. This information is compiled and analysed on both a personal and an aggregated basis. This information may include the Web site’s Uniform Resource Locator (“URL”) that you just came from, which URL you next go to, what browser you are using, and/or your Internet Protocol (“IP”) address (“Technical Data”). 

They are also working closely with third parties (including, for example, business partners, service providers, advertising networks, analytics providers, and search information providers) and may receive information about you from them. This may be combined with other information you provide to them, as described above. They may also collect personal information on third party network, platform or service: by playing a game through a social network or other third party platform, or by connecting to such a third party network, platform or service via one of their products and/or Services, you are authorising to (1) collect, store, and use, in accordance with their Privacy Policy, any and all personal information that you agreed the social network or other third party platform could provide to them based on your settings on the third party social network or platform and (2) share any and all of your personal information with the social network or other third party platform, through the social network/third party platform’s Application Programming Interface (API). Your agreement to this takes place when you connect with the third party network, platform or service via their products and/or services, and/or when you connect with, “accept” or “allow” (or similar terms) one of their applications through a social network, or other third party platform or service.

 

App: Pokemon GO

Data collected: When you sign up for their Services you give us Personal Data voluntarily by providing it to them, for example when you sign up for an account. They collect and use that information in order to authenticate you when you register an account and use the Services, to make sure you are eligible and able to receive the Services, and so that you receive the correct version of the Services. That information includes the in-game username you choose to use on our Services, and internal account IDs that they assign to your account.

You must have an account with a supported external single sign-on service to use their Services. As such, the Personal Data they collect also depends on which external accounts you choose to use, their privacy policy, and what your privacy settings with those services allow them to see when you use their services to access Niantic Services.

If you choose to link your Google account to the Services, they will collect your Google email address and an authentication token provided by Google.

If you choose to link your Facebook account to the Services, they will collect a unique user ID provided by Facebook and, if permitted by you, your Facebook registered email address.

If you choose to link your Apple account to the Services, they will collect your email address on file with your Apple ID account or a private relayed email address if you use the Hide My Email option provided by Apple.

Depending on the particular Service you sign up for, they may support other external single sign-on services and collect additional Personal Data from them.

Some external providers may notify you that they make additional information, such as your public profile, available to them when you use their single sign-on services. They do not collect that information from them.

They collect and use your device location information as you use our Services (and, if you elect to turn on background location tracking for our Services, while you are not directly interacting with the Services), including how you move around and events that occur during gameplay. Their Services include location based games whose core feature is to provide a gameplay experience tied to your real world location, so they need to know where you are to operate these games for you, and to plan the location of in-game resources (for example PokéStops within Pokémon GO). They identify your location using a variety of technologies, including GPS, the WiFi points you are accessing the Service through and mobile/cell tower triangulation.

They also collect and use your in-game actions and achievements, as well as certain information about your mobile device (including device identifiers, device OS, model, configuration, settings and information about third party applications or software installed on your device), to operate the Services for you and to personalize your gameplay and user experience.

They also use the information above to show in-game sponsored locations that are in your vicinity as part of the gameplay experience.

They further use the information above in order to provide technical and customer support to you.

You also give them Personal Data when you make a purchase through them, subscribe to their publications, register for a live event, enter a competition, promotion, sweepstakes or survey or communicate with them. Depending on which of these Services you use, that may include your name, mailing address, phone number, country of residency, date of birth (as needed to verify eligibility), and email address. They use that information to fulfil those Services to you and to provide related customer support to you. 

In addition, they have and rely on a legitimate interest in using your Personal Data as follows:

Using your IP address, browser type, operating system, the web page you were visiting before accessing their Services, the pages of their Services which you browsed or the features you used, and the time spent on those pages or features, the links on their Services that you click on, device and advertising identifiers, as well as actions you take during gameplay, your in-game user settings and preferences and your in-app purchases to understand who is using their Services and how.

Using your contact information, namely your email address in order to communicate with you to provide technical and customer support.

Using your internal account ID in order to attribute to your account any user content (such as local points of interest) that you elect to submit to Niantic through the Services.

Using your email address and device information in order to share updates and news with you either within the games or by email. You can unsubscribe from these at any time in your device settings or in-app settings.

Analyse your in-game actions and achievements to show you rewards, promotions, or other offers about their Services that are tailored to your personal user experience. 

To provide social features within their games so you can interact and play with other players, including storing your communications with those players, find your friends and be found by them, and share your gameplay experience and achievements with your friends.

To provide AR experiences. In order to do this, Niantic needs to locally derive AR geospatial data from your device camera. This geospatial data is then ingested by Niantic servers to allow you and other players to view and interact with the same virtual objects at the same time in a shared physical space. 

To offer new or additional features for their Services.

To organize and run live events based on or featuring their games. Note that when you participate in live events your in-game actions and achievements, in-game username and your avatar, team, and other components of your in-game profile will be visible to other event participants and to the public (for example on leaderboards displayed at the event and online).

Using your in-game actions and achievements, as well as certain information about your mobile device (including device identifiers, device OS, model, configuration, settings and information about third party applications or software installed on your device), to carry out anti-fraud and anti-cheating measures against behaviours prohibited under their Terms of Service, to ensure that they provide a fair gaming experience to all players.

To make legal or regulatory disclosures and to establish, exercise, or defend legal claims.

They will only use your Personal Data to do the following if they have your consent:

If you elect to turn on background activity tracking in our Services (for example Adventure Sync in Pokémon GO) they will collect your Personal Data as you use the Services as well as in the background when you do not have the Services open on your device. This includes your device location and your fitness activity data (such as Step Count, Calories Burned, and Distance Walked). They use background activity tracking to provide you certain functionalities in the Services such as in-game items and rewards tied to your fitness activity level and alerts for nearby gameplay events. You can change your mind and turn off background activity tracking at any time in your device settings or in-app settings.

With your permission they use your device’s health app (Apple HealthKit if you use an Apple device, or Google Fit if you use an Android device) to collect your fitness activity data: we read and/or write your fitness activity data to your device’s health app to operate background activity tracking and to ensure you get “credit” in your device’s health app for all of the walking you do while playing our games. They do not use data collected through Apple Health Kit or through Google Fit for marketing or advertising purposes. Their Services cannot read from or write to your device’s health app without your consent. You can change your mind and disable their access to any type of fitness activity data at any time in your Apple Health or Google Fit app settings on your device.

If you elect to enable the Facebook User Friends permission available in some of their games, they will import from your linked Facebook account the list of your friends who also play the game and enabled Facebook User Friends. If you enable that permission, your Facebook profile picture and the name on your Facebook account will be visible to your friends in-game. You can change your mind and unfriend other players at any time from your in-app Friends settings. You can also revoke Facebook permissions for their games directly from your Facebook account settings.

If you elect to add information about Niantic live or in-game events to your mobile calendar, they will, with your permission, access your device’s calendar and write in these events. They do not access or collect any other information from your calendar. You can change your mind and disable access to your calendar at any time in your device settings.

If you elect to help Niantic in its efforts to develop new Augmented Reality (AR) mapping technology, you have the option, in participating games, to opt in to film public spaces around points of interest and send them your video recordings, along with associated device geospatial information. They do not collect audio on these recordings. They will anonymise this information through various means, including blurring, and use it to build a 3D understanding of real-world places, with the goal of offering new types of AR experiences to their users. You can change your mind at any time by disabling this feature in your in-app settings.

If you elect to connect your game account with an authorized external device, such as the Pokémon Go Plus or Poké Ball Plus, they request Bluetooth permissions from your mobile device in order to connect it with the external device and enable associated game features. You may change your mind at any time by disabling their access to Bluetooth in your device settings or by disconnecting the external device from the game.

Send you marketing materials by email or via in-app notifications. You can unsubscribe from these at any time in your device settings or in-app settings.

They also rely on your consent where they use cookies or similar technologies. Insofar as cookies collect Personal Data, they will process it only based on your explicit consent, in anonymized form, or under a pseudonym.

While you may disable the usage of cookies through your browser settings, Niantic currently does not respond to a “Do Not Track” signal in the HTTP header from your browser or mobile application due to the lack of industry standard on how to interpret that signal.

 

App: Toca Life: Vacation

Data collected: There are two types of data that may be collected. The first one is called personal data. This is personally identifiable information that identifies a user as an individual. Toca Boca may collect personal data that parents voluntarily provide on the website. The second type is non personal data which doesn’t directly identify an individual or which may have been personal information but has had the personally identifiable information removed. Toca Boca may collect non personal information about the use of the website and apps to help us improve their services.

They collect personal data when a parent makes a purchase through their online store, subscribes to a newsletter or alert, submits content to a forum or blog, or requests technical support. This data may include a name (screen or nickname), gender, birth date, email address, mailing or shipping address, telephone number, and payment information. This information may be used to provide services and the sites to you, to process and fulfil your orders, to contact parents about their orders and new services and features and to send push notifications if consent to receive them has been given. If you contact them for help they will only use your email address to reply to your question. Please note that if a parent posts personal information about themselves in a community forum or blog in the parent section, in addition to being collected, this data is made public for others to see. The parent is responsible for the disclosure of any such data in those forums. 

They may use cookies and web beacons to help deliver and analyse their services (e.g., by counting the number of times a page or advert has been viewed).

Toca Boca may also use third parties from time to time to deliver a service to parents only, such as payment processing, sending emails, infrastructure and IT services, or helping with customer or technical support. They only work with companies that follow this privacy policy and agree not to use your information for any other purposes.

 

This was a scary research. Even we didn’t expected to find all these informations, but we believe that we helped you understand that, in these days, everyone tries to collect as much information about people as possible.

A bit of advice? Try to pay more attention on the games your child plays, and restrict as much as possible the tracking in those apps, or share as little information as possible. Alternatively, you can submit an official Subject Access Request to any game or developer, ask them for a copy of your child’s data, and restrict the way they process it or even request the deletion of that information.

Get in touch with us and we will provide all the help and support you need.

Thank you.

 

#keepitprivate #dataprivacy #dataprotection