Those who downloaded the game to an iPhone and chose to sign in via Google gave the game’s developer, a company called Niantic Labs, complete access to their Google accounts. Those who chose to sign in with a Pokémon “Trainer Club” account are not affected.
There’s no evidence that Niantic is playing “catch ’em all” with players’ personal info, but full access would make it easy to do so. The setting grants a third party access to one’s search history, email contents, Google Photos, Google drive docs and much more, according to the search engine’s help site. The sign-in issue is mostly affecting iOS users, but a few Android owners have reported similar problems, according to Engadget.
To take permission away from Niantic, players can follow this link and adjust settings.
The company sent a statement to Engadget confirming the reports, saying that the “Pokémon Go account creation process on iOS erroneously requests full access permission for the user’s Google account.” Niantic says they only access basic profile information – user ID and email address – and doesn’t collect or access any other information.
Niantic says they are working to issue a fix, but players may want to be cautious in the meantime.
See Niantic’s full statement to Engadget here.