The Niantic Data Loophole

How Pokémon GO became a robot navigation company without ever "selling" anyone's data.

Source: MIT Technology Review, March 10, 2026

Timeline

The Core Legal Mechanism

What the privacy policies say

Both Niantic's original policy and Niantic Spatial's new policy (effective May 29, 2025) include two key provisions:

"We do not sell or share your Personal Data as those terms are defined under the CCPA."

"If we are acquired by a third party as a result of a transaction such as a merger, acquisition, or asset sale... some or all of our assets, including your Personal Data, will be disclosed or transferred to a third-party acquirer in connection with the transaction."

Why this is technically legal

• Under CCPA/CPRA, a corporate restructuring or asset transfer is not classified as a "sale" of personal data
• Players consented (via ToS) to Niantic using their gameplay data to "improve AR features" and "build a 3D understanding of real-world places"
• Niantic's ToS granted broad rights to "use, modify, and transfer" contributed content "for any purpose"
• The trained AI model is treated as Niantic's intellectual property, not as personal data

The loophole in plain English

1. Collect it through a game kids love. Every PokéStop scan, every Gym visit, every AR photo becomes a training sample.
2. Train a billion-dollar AI model on it. The model is intellectual property. The raw data dissolves into weights and embeddings.
3. Spin that model into a separate company. Asset transfer, not a data sale. Privacy policy permits it by design.
4. License the model to robot fleets. Coco Robotics delivers pizza using centimeter-accurate maps built from children's gameplay.

At no point did anyone "sell personal data" under the legal definition. The value was extracted, laundered through model training, and monetized via corporate restructuring.

COPPA Analysis

Protections in place

• Pokémon GO requires parental consent for under-13s via Niantic Kids program (FTC safe-harbor certified)
• Niantic claims they don't knowingly collect or keep children's data without consent
• Under-13 data reportedly not shared with outside analytics partners

Gaps and concerns

• Did parents understand that "help improve AR features" meant training commercial navigation AI for delivery robots?
• Parental consent was for the game. The consent did not contemplate a corporate spin-out that transfers derived data products to a new entity.
• The opt-in for contributing scans ("to build a 3D understanding of real-world places") is vague enough to cover almost anything.
• No recent FTC actions, lawsuits, or enforcement actions tie this specific restructuring to a COPPA violation.
• Privacy advocates have raised concerns since 2016 (senator letters, EPIC complaints), but Niantic responded with policy tightening, not structural changes.

The Bigger Pattern

This isn't just a Niantic story. It's a template.

This pattern is replicable by any company sitting on large user datasets: fitness apps (movement patterns), photo apps (visual data), social platforms (behavioral data), navigation apps (driving patterns).

Editorial Position: The Buffett Paradox

Warren Buffett has spent decades exploiting every legal tax advantage available to Berkshire Hathaway. He does this because fiduciary duty requires it. If the rules allow it and your competitors use it, you're not being virtuous by leaving money on the table. You're being negligent.

But Buffett also says the rules are broken. He's argued publicly, repeatedly, that he shouldn't pay a lower tax rate than his secretary. He exploits the system and advocates for fixing it at the same time. These are not contradictory positions. They're the only intellectually honest ones.

The Niantic data loophole works the same way. If you're a founder-operator sitting on a valuable user dataset, you should understand this structure. Your competitors do. Your investors expect you to. Your fiduciary obligations demand it.

That does not make it right.

The idea that you can collect location data from millions of children playing a game, train a commercial AI model on it, spin that model into a new company, and then claim you "never sold anyone's data" is a legal fiction. It's technically compliant and morally bankrupt. The fact that the privacy policy permits it is an indictment of the privacy policy, not a defense of the practice.

Open Questions

1. FTC position: Has the FTC weighed in on whether derived AI models trained on children's data constitute a "use" that requires separate COPPA consent?
2. Legal precedent: What precedent exists for treating model training as a fundamentally different "use" than the original data collection purpose?
3. Class action viability: Could a class action succeed arguing that the asset transfer clause doesn't cover spinning out a new company (vs. being acquired)?
4. International implications: GDPR has stricter rules on purpose limitation and legitimate interest. Would this fly in the EU?
5. Right to deletion: If a player deletes their Pokémon GO account, does their contribution to the 30B image training set get removed? (Almost certainly not, since the model is treated as derived IP.)
6. Downstream contracts: What exactly is Coco Robotics receiving: raw scans, processed maps, or API access to the VPS?

Why This Matters for Founder-Operators