Unless you’ve been offline or focused on a distorted national anthem rendition for the past week, you know that Pokémon Go has taken the world by storm with millions of people wandering around searching for virtual Pokémon characters. The game was officially released in Canada on the weekend – it started first in the U.S., Australia, and New Zealand – with millions of people already playing it.

My weekly technology law column (Toronto Star version, homepage version) notes that Pokémon Go provides a first peek at the potential of widespread use of “augmented reality”, which combines real space places such as parks or buildings with virtual characters or objects that appear on a computer or smartphone. In this case, the app uses GPS on smartphones to identify players’ physical location with the goal of collecting and training virtual Pokémon characters located there.

The immediate popularity of the game has shattered records as reports indicate that it is already the biggest mobile game ever in the U.S. In fact, this week Pokémon Go passed Twitter for the number of daily users. SimilarWeb estimates that six per cent of Canadian Android users have installed the game without official availability in the country.

Given the rapid pace of adoption, there has scarcely been time to consider the legal challenges raised by Pokémon Go. For example, the privacy issues are significant given the vast amount of data –  much of it involving locational information – collected through the app.

The makers of Pokémon Go are forthright about their collection and use of personal data that may be shared with service providers and third parties (though the terms of use policy has generated criticism over a 30 day period to opt-out of mandatory arbitration over potential disputes. The privacy policy indicates that sharing of information with third parties, which may include marketers or other businesses, will be limited to aggregated data that can then be used for research, analysis, and demographic profiling.

While the Pokémon Go privacy policy offers few choices, there are two notable exceptions that highlight how laws can make a difference. The policy distinguishes between U.S. and European users for commercial email, with U.S. users automatically registered for emails unless they take steps to opt-out, while European users provided with the stronger safeguard of an opt-in approach. Once the service formally launches in Canada, users will presumably be offered the higher standard of protection due to Canadian anti-spam laws.

Similarly, the policy provides the option of opting out of data transfers to the U.S. (though with the warning that some services may be unavailable for those that do so). The choice of “localizing” personal information reflects mounting concerns with U.S. surveillance activities and may signal increasing demand from the public to have the choice of having their data kept outside that country.

The privacy issues, including concerns over initial settings that shared detailed Google account information with the company, prompted U.S. Senator Al Franken to demand public answers on the privacy practices. The Google information sharing setting has since been altered, but even more interesting may be the Pokémon Go issues that are unique to games that blend the real and virtual.

For example, trespass laws may arise as players find themselves wandering into private spaces in search of virtual characters. For instance, the U.S. Holocaust Memorial Museum and Arlington National Cemetery have both requested that players refrain from catching characters there.

There are also reports of potential physical harm for players as they visit places that may be unsafe or unknown. The Pokémon Go terms unsurprisingly state that the company disclaims all liability for any property damage or personal injury, but the foreseeability of potential harm suggests that these terms may ultimately face legal challenge.

The use of augmented reality is at a very early stage, but given the massive popularity of Pokémon Go, there is every reason to believe that the technology – and the legal issues that come with it – are here to stay.