Nintendo Switch

Warning: *privacy not included with this product

Nintendo Switch

Nintendo
Wi-Fi Bluetooth

Review date: Nov. 9, 2022

|
|

Mozilla says

|
People voted: Not creepy

What would the world be like without Mario, Zelda, and Animal Crossing? Worse, for sure. Whether you play Mario Kart on the Nintendo Switch or on the cheaper Switch Lite, you're still going to have good time. And we've always liked that good guy Nintendo puts a lot of emphasis on easy-to-use parental controls and an easy to read privacy policy. Which is why we're a bit bummed to see Nintendo recently made some changes to their privacy policy that raises some red flags for us. Nintendo has always been pretty good at privacy, so we're feeling a little like getting hit with the triple banana on the last lap here.

What could happen if something goes wrong?

Oh Nintendo, you’re breaking our heart. We don’t want to give you our *Privacy Not Included warning label, we really don’t. You’ve been so good at privacy in the past. But your privacy policy raises some red flags for us and that makes us sad. (And hey, thank you for making your privacy policy easy to find and read and understand, we do appreciate that.)

First off, Nintendo does collect a fair amount of personal information. Things like name, email address, postal address, phone number, date of birth, country of residence, language, gender, device and advertising identifiers and other unique personal or online identifiers, location (with your consent), health information (with your consent), and lots of information about how and when and what games you play.

Nintendo also says they can “receive information about you from other sources, including from other users of our services, and third-party services and organizations.” This worries us a bit because they say they can take this information they receive from third party sources and combine it with information they have about you and build an even bigger profile on you. And they say they can use that information to do things like offer you customized content, provide you with tailored advertising, and send you promotional materials from them or their affiliates and business partners (which could be a pretty good number of companies). So, Nintendo collects a good deal of personal information and says they can use and share that with third parties for targeted, interest-based advertising. None of this is great.

Nintendo also says they can aggregate or de-identify the personal information they collect on you and then that new de-identified data is no longer subject to their privacy policy and they can do pretty much whatever they want with it. Which is pretty common, but still can be a bit of a concern as it’s been found to be pretty easy to re-identify some of this data, especially with location data.

Finally, it seems Nintendo doesn’t specifically say all users, regardless of where they live, have the same rights to access and delete their data, which is what we like to see. Right now they say, “Depending on your place of residence, you may have the right, in accordance with applicable law, to request access to, deletion, and portability of your information.” We believe it’s important for everyone to have the same right to access and delete data, regardless of the data privacy laws they live under. And we believe companies should grant that right, even when they aren’t required to by law. Here’s hoping Nintendo will change their privacy policy to fix this.

That’s the bad news with Nintendo. Now on to some good news. They do say that they do not, and will not, sell your data. That’s good. Too bad they do share it with third parties for advertising purposes. And they do a good job with parental controls on the Switch. So parents, make sure to set those up (here’s some help with that).

As for security, Nintendo did have a data breach in 2020 where 300,000 accounts were compromised and attackers gained access to users' personal information, including date of birth and email addresses. That's not great. And early in 2022, Nintendo had to ask users to stop using their Wi-Fi USB Connector due to security concerns.

So what’s the worst that could happen with your Nintendo Switch? Well, if you don’t set up two-factor authentication (please do this!), it’s possible someone could hack into your Nintendo account and buy a bunch of games at your expense. That could be costly and you don’t want that headache. Here’s hoping you set-up 2FA, lock down your Nintendo privacy settings and opt-out of as much data collection as you can, so you can sit back and enjoy some Mario Kart, Splatoon, or Sonic with your friends.

Tips to protect yourself

  • Check the Nintendo Switch privacy settings
  • Enable two-factor authentication on your Nintendo Switch account
  • Opt out of sharing your eShop data.
  • Do not sign up with third-party accounts. Better just log in with email and strong password.
  • Chose a strong password! You may use a password control tool like 1Password, KeePass etc
  • Use your device privacy controls to limit access to your personal information via app (do not give access to your camera, microphone, images, location unless neccessary)
  • Keep your app regularly updated
  • Limit ad tracking via your device (eg on iPhone go to Privacy -> Advertising -> Limit ad tracking) and biggest ad networks (for Google, go to Google account and turn off ad personalization)
  • Request your data be deleted once you stop using the app. Simply deleting an app from your device usually does not erase your personal data.
  • When starting a sign-up, do not agree to tracking of your data if possible.
mobile Privacy warning Security A.I.

Can it snoop on me? information

Camera

Device: Yes

App: Yes

Microphone

Device: No

App: Yes

Tracks location

Device: Yes

App: No

What can be used to sign up?

What data does the company collect?

How does the company use this data?

We ding this product as it can combine your data with data from other third-party sources.

"We may also receive information about you from other sources, including from other users of our services, and third-party services and organizations. For example, if you access any social media or similar services through our services to login or to share information about your experience on our services with others, we may collect information from these third-party services. We may also combine the information received from these other sources with information we’ve collected from you."

"We do not, and will not sell your information to third parties. However, we permit third-party service providers to collect personal information, as described here, through some of our services and we share personal information with third party service providers for business purposes as described in this policy, including but not limited to providing advertising on our services and elsewhere based on users’ online activities over time and across different sites, services, and devices."

"If you access third-party services -- such as third-party online gaming services and social media services -- through our services, these third-party services may be able to collect information directly from you or about you, including information about your activity on our services, and they may notify your connections on the third-party services about your use of our services, in accordance with their own privacy policies."

How can you control your data?

It is unclear if all users regardless of location can get their data deleted.

"We may offer you certain controls and choices regarding the information we collect, how the information is used, and how it is shared. These controls and choices may include the ability to update, correct or delete information that you have provided to us or information that we have collected through your use of our services. They may also include the ability to opt-out of receiving notifications, promotions, offers or other advertising from us.

Depending on your place of residence, you may have the right, in accordance with applicable law, to request access to, deletion, and portability of your information. For information on how to submit such a request go here.

We will not discriminate against you for exercising your rights and choices, however some of the functionality and features of our services may change, or no longer be available to you."

What is the company’s known track record of protecting users’ data?

Average

In April 2020, 300,000 Nintendo accounts were compromised in a data breach that granted the attackers access to users' personal information, including date of birth and email addresses.

In 2022, Nintendo had to ask users to stop using their Wi-Fi USB Connector due to security concerns.

Child Privacy Information

"We do not knowingly collect, use or share information from children under the age of 13 without verifiable parental consent or as permitted by law. Where a parent or legal guardian has provided consent, the child may be able to use his or her Nintendo Account to play certain third-party games and applications that are not published by Nintendo. Parents or guardians may review, modify, or delete the child’s personal information, or withdraw consent, by contacting us using the contact information provided at the end of this privacy policy, and may manage which third-party games and applications can access and use the child’s Nintendo Account information through your Nintendo Account profile settings."

Can this product be used offline?

Yes

User-friendly privacy information?

Yes

Nintendo has a privacy policy with fairly easy to read and understand language. Then also provide easy to find links to submit privacy related requests.

Links to privacy information

Does this product meet our Minimum Security Standards? information

Yes

Encryption

Yes

Strong password

Yes

Security updates

Yes

Manages vulnerabilities

Yes

Privacy policy

Yes

Does the product use AI? information

Can’t Determine

Is this AI untrustworthy?

Can’t Determine

What kind of decisions does the AI make about you or for you?

Is the company transparent about how the AI works?

Can’t Determine

Does the user have control over the AI features?

Can’t Determine

*privacy not included

Dive Deeper

  • How to Set Parental Controls on the Nintendo Switch
    Common Sense
  • Nintendo wanted hacker's prison sentence to turn heads
    Axios
  • Nintendo says account breach was even worse than it first thought
    Digital Trends
  • Nintendo asks people to stop using Wi-Fi USB Connector due to security concerns
    Nintendo Everything
  • How to Manage PlayStation, Switch, and Xbox Privacy Settings
    New York Times
  • Nintendo Switch: How to Turn Off Data Sharing via Google Analytics
    Gadgets 360
  • How to Stop Nintendo From Sharing Your eShop Data With Google Analytics
    Lifehacker
  • Nintendo now says 300,000 accounts breached by hackers
    TechCrunch
  • Nintendo Breach: Now 300,000 Accounts Affected
    Infosecurity Magazine
  • Nintendo data breach reportedly caused by credential stuffing
    TechRepublic
  • Nintendo 2FA: How to enable two-factor authentication on your Nintendo Switch account
    Games Radar
  • Open letter: Nintendo’s commitment to privacy on AR developments
    Access Now
  • The Nintendo Switch Camera: Where It Is and How Does It Work?
    Lifewire
  • How to Boost Your Game Console’s Security
    Lifehacker

Comments

Got a comment? Let us hear it.