Pokémon Go spawns policy and legal puzzles

The game could be the first instance in which augmented reality may get tested legally, presenting privacy and IP issues.

Pokémon Go by now needs little introduction. The Internet has recently been rife with guides about its gameplay and tales of mishaps and freak incidents. Pokémon Go is not the first or the only application of augmented reality (AR), but it is the first AR application that has made it into the mainstream. The app has been downloaded more than a 100 million times, has over 20 million daily active users in the US alone (more than Twitter), and has users spending more daily time on it than on Facebook.

Lawyers are supposed to be social engineers, so when something this dramatic hits society, we notice. AR superimposes created environments over our natural one, and existing law may struggle to accommodate this innovation. Pokémon Go is probably the first instance in which AR may get tested legally, presenting privacy, intellectual property and contract and property law issues, among others.

Here are a few interesting law and policy puzzles arising out of the game, and a ‘visualization’ of issues under Indian laws.

Privacy issues

There was recently a huge uproar over the sweeping access permissions requested by the app (it could originally access and modify virtually all of iPhone users’ Google accounts). But this was later clarified as a mistake by Niantic (the game’s maker) and the app now only requires access to basic account information. But it transmits a variety of other information such as users’ location, in-game messages, phone settings and browser cookies to Niantic.

The Pokémon Go privacy policy allows Niantic to “share aggregated information and non-identifying information with third parties for research and analysis, demographic profiling and other similar purposes”. How Niantic itself can use this information is also left open to interpretation.

The privacy policy states: “Our primary goals in collecting information are to provide and improve our Services, to administer your (or your authorized child’s) use of the Services, and to enable you (or your authorized child) to enjoy and easily navigate our Services.”

While Niantic may not have an incentive to be disrespectful of user privacy, what the game does is create a “honeypot” of valuable user data. This is a treasure trove that hackers will work hard to break into. Niantic would do well to detail more clearly how it uses collected information, as well as the information security practices it employs. For example, it would be helpful to know the encryption policy adopted at all levels.

The game has already been exploited by hackers recently (albeit in a different context) where they mounted a Distributed Denial of Service (DDoS) attack, bringing the game’s servers down for a short period.

The Indian Information Technology Act, 2000, and the rules under it would require the company to implement “reasonable security practices and procedures” i.e., among other things, not collecting sensitive personal information unless necessary; not retaining such information longer than required; providing the user an opportunity to review this information for accuracy; and having a comprehensive documented information security program. Personal information that is not sensitive is also subject to some protection measures. The company would also be required to designate a grievance officer to address user grievances.

As discussed later in the article, Niantic has not formally launched the game in India, but it is no secret that it is being downloaded in the country. So, the question arises whether Niantic is bound by Indian laws if users have downloaded unauthorized versions of the app.

IP and virtual currency

Pokémon Go is a hub of digital commerce and assets. While there is no monetary value associated with Pokémon characters, the game has a virtual currency (“PokéCoins”) through which users can buy virtual items like “Poké Balls”, “Eggs”, “Incense”, “Potions” and “Lure Modules”. PokéCoins are purchased with real currency. The Pokémon Go terms of service state that users have a limited, revocable licence to all in-game items and have no ownership rights in them. They may also not buy or trade these items except as facilitated by Niantic. And PokéCoins and virtual assets are not redeemable for real currency. But the terms of service grant users the right to the content that they generate.

Indian copyright law, like in many common law countries, does not set a high bar of creativity for works to get copyright protection. Even an original selection and arrangement of existing works (in this case, characters, in-game items, etc.) can in some cases receive copyright protection. Photos and videos of gameplay taken from the phone camera are almost certain to be copyrightable (and likely not infringing Niantic’s copyright, since the user receives a limited licence to use game content for permitted purposes).

Besides this, however, it is not clear that players are doing anything more than choosing from a limited set of options provided by the maker. But as the gameplay matures and players “level up”, it is possible that user input can become more creative and merit copyright or trademark protection. Once this is the case, disputes over the rights to in-game content could arise between users and between the user and the game maker.

The law on virtual currencies is still developing in India. Further, due to restrictions under current account transactions rules, there is a view possible that players technically cannot remit funds outside India to participate in such games.

Controversial terms

Besides their provisions on IP, the app’s terms of service require users to sign away various rights. The clause that has got the most attention is a mandatory arbitration clause, which requires users to waive their right to sue unless they opt out by email or regular mail within 30 days of downloading the app. This is a significant issue in jurisdictions like the US where class actions give significant recourse to consumers. Most consumers probably do not know of this clause or the option to opt out of it.

The maker also disclaims liability for personal injury to users and trespass by users. But the fact that players have to hold their phone in front of them to play causes them to be distracted from their surroundings and has already led to significant mishaps. Also, various Pokémon characters and Pokéstops (sites of in-game items) are located on private property, which may require users to enter private property to obtain them.

Under Indian law, what Pokémon Go players do is not likely to be considered criminal trespass, because of the absence of any intent to do harm. However, the tort of trespass to land will apply as soon as there is (unjustifiable) entry into another’s private property. One study found that, of a sample of more than 750 users, 85% admitted to playing while driving a car, and more than 10% admitted to trespassing while playing. Moreover, the legal relationship between the owner of the particular property and the game maker is unclear from the terms of service. In other words, it is unclear what disgruntled owners of Pokéstop locations can do to shoo away players. Some property owners have filed a class action in the US against Niantic, complaining that the “intentional, unauthorized placement” of in-game items on their properties “constitutes a continuing invasion of the class members’ use and enjoyment of their land”.

Users thus face a realistic possibility of the terms adversely impacting them. Courts around the world usually respect terms of service when service providers can show that users knowingly and voluntarily consented to them. But there are several exceptions to this. The Indian Consumer Protection Bill, 2015, for instance, has an explicit provision to void terms of contracts found to be unfair to the consumer. Under existing contract law too, standard terms can be struck down if they are found to be unfair and there is an inequality of bargaining power.

When looking at the Pokémon Go terms disclaiming liability for personal injury or trespass, for instance, Indian courts would carry out a fact-specific analysis that assesses: first, whether the disclaimer is unreasonable because of the game possibly placing the consumer in such situations; and second, whether the consumer had no meaningful choice but to assent to the terms. From a comparative perspective, the UK does not enforce unfair terms in consumer contracts. The US too does not uphold “contracts of adhesion” where users have no comparable alternative to the product/service, and so are forced to accept burdensome terms. Litigation based on the game’s terms of service may throw up many unsettled issues.

Geospatial information

To further complicate matters, the game has not even been officially released in India! How are people playing? Android users can download an “APK” installation file (the equivalent of a .exe file for Windows) from third parties, and iPhone users can use AppStore accounts of countries where the game has been released. (Recently, the Computer Emergency Response Team alerted Indian users to several malware applications masquerading as Pokémon Go.)

This leads to a question about the legal relationship between Indian users and Niantic. The terms of service do not directly address this situation. Niantic can argue that as soon as a person uses the app, they are bound by the terms of service, but users can argue that they are not bound by them since they never downloaded an official release in their own jurisdiction. If the latter argument prevails, users can circumvent requirements like not trading in-game items independently or not assigning real currency value to PokéCoins and in-game items. They can even try to ascribe liability to Niantic on matters which it has disclaimed in the terms, such as liability for personal injury and trespass. Niantic can also argue that downloading the game in the absence of an official release amounts to an infringement of its copyright. However, given that the game is free, and that any Indian users choosing to buy in-game add-ons are paying for them, it would be difficult to prove any loss as a result.

Niantic has announced that it will roll out the app in 200 countries “relatively soon”, but until then, the murky legal status of the game in India remains.

Another issue specific to the Indian experience is the location of the Pokémon characters and of Pokéstops.Pokémon Go locations are chosen based on information gathered by Niantic from its previous game, Ingress. Interestingly, this in turn was gathered in Ingress based on cellular data activity in particular locations, resulting in many places of worship in India becoming Pokémon/Pokéstop locations.

From a legal perspective, the Draft Geospatial Information Regulation Bill, 2016, (recently published for public comments) requires a licence to be obtained before any person/entity can acquire or publish any geospatial imagery or data through platforms such as satellites, or any graphical or digital data relating to geographical features, including maps.

The provisions of the draft bill are very wide in scope and are likely to cover Niantic’s activities because of the location-based nature of Pokémon Go. It remains to be seen in what form the draft bill will, if at all, be introduced in Parliament.

It was recently reported that Pokémon/Pokéstop locations in India have been disappearing, possibly at the initiative of Niantic in its preparations for an India release.

Pokémon Go may only be the latest (some say, dying) craze in our fast-paced technological world. But with numerous other AR applications on the horizon, it is likely only a taste of things to come. The novelty of the law and policy questions it raises is likely to be repeated for every new and exciting tech innovation.

Jaideep Reddy is a technology, corporate and IP lawyer at law firm Nishith Desai Associates’ Palo Alto (Silicon Valley) office in the US. Gowree Gokhale heads the IP, technology, media and entertainment law practice at Nishith Desai Associates, and is based in Mumbai.