Fri. Feb 3rd, 2023
Who's that behind you?  Oculus's prying eyes, that's who!

Who’s that behind you? Oculus’s prying eyes, that’s who!


Critical comments on Oculus’ privacy policy reached Capitol Hill Thursday, when Sen. Al Franken (D-Minn.) demanded that Oculus and its parent company Facebook respond to the data its new headset collects from virtual reality users.

“Oculus’ creation of an immersive virtual reality experience is an exciting development,” Franken wrote in an open letter to Oculus CEO Brendan Iribe, “but it remains important to understand the extent to which Oculus may be collecting personal information from Americans, including sensitive location data and sharing that information with third parties.”

The question is, what exactly is Oculus asking to collect – and how much worse is it compared to other online services’ EULAs?

A real House of cards

The website UploadVR was the first to know about the original story in a report last week that detailed the most extreme parts of the privacy policy – and the .exe in the middle. The headset currently requires Oculus’ software suite to work, which headset wearers must use to load games and find more software in the online Oculus Store. The software requires an internet-connected process called OVRServer_x64, which sends and receives data even when you’re not in a game, and the privacy policy describes at least some of what’s in those transmissions.

The short version is that Facebook can track what software you use through the Oculus Home hub, where you use your Oculus, and your headset’s positional tracking — and will likely share that data with other Facebook-owned companies.

“I believe Americans have a fundamental right to privacy, and that right includes an individual’s access to information about what data is collected about them, how the data is treated and with whom the data is shared,” Franken said in a statement. public statement.

However, Franken’s statement didn’t mention any other major online services, so this is a good opportunity to review whether Oculus is actually walking into any new, privacy breaches.

Let’s go through those cases one by one. For starters, “information about your interactions with our services” is a long-winded way of saying “we’re going to study anonymized data about general Oculus usage.” The same goes for any connected entertainment network you’ve used in the past five years, including Xbox Live, PlayStation Network, Hulu, Amazon Video, and Netflix. In fact, Netflix was shameless enough to admit it House of cards came as a result of studying the viewing habits of its customers.

Facebook also doesn’t say much interesting with its clause about tracking a user’s “location information.” For starters, your IP address is pretty revealing, as is any shipping information you provided with your Oculus pre-order (since that’s the only way people can currently buy the hardware). Furthermore, GPS tracking in privacy statements of online services isn’t really new, although that’s usually because the service or device in question provides useful services once we’ve given it permission to stalk us. That doesn’t mean that the Oculus Rift headset includes a GPS sensor, but that it’s the same statement of service that a Samsung GearVR user will see when using its Oculus-powered app.

We imagine Oculus’s smartphone-powered systems will soon see more GPS-powered apps (especially as mobile-friendly, GPS-tracked games like Qonqor or Enter ever take a VR leap), so Oculus has to admit it will at least have access to that data. And Facebook has already made it clear that it analyzes users’ GPS activity “to customize our services for you and others,” so this isn’t a huge step for a company in the same corporate umbrella.

The last part, which “collects information about your physical movements and dimensions when you use a virtual reality headset,” seems the most curious. Good news, anyway: those movements aren’t captured as photographic images, as the Oculus Rift “Constellation” sensor only tracks infrared light. This means that if you want to wave your bare butt at your headset, you’ll have to go to town (that is, as long as you don’t cover your cheeks with infrared sensors). That simply leaves positional tracking of the headset halfway through the game and the times when the headset is left unused on a desk.

While we can understand reasons for foregoing one of these data donation pools, we imagine VR users would like Oculus to have as much position data as possible, as this is the material researchers will mine as they work on the problems of VR nausea and discomfort. Anonymized data from thousands of retail headset carriers could answer questions that a smaller pool of dev kit owners simply couldn’t answer.

Conversely, the ability to collect data on, say, where we direct our VR “gaze” is a little disturbing. However, we imagine that Oculus’s app does not record such detailed data, because a lot of recording and processing, which would detract from PC performance. Oculus probably wants users to hit a rock solid 90fps visual refresh far more than they want to know how long you’re staring at the caterpillar in Lucky’s story. (But the amount of time you spend in each app, game, or visual experience? Every other streaming video and online gaming service records that information, too.)

Was only set in stone after preorders started

Should headset owners not want to fill the Oculus and Facebook data cases with their own usage history, we’re not sure there’s any option other than “don’t use the Oculus Rift”. There’s sort of an internet requirement to use Oculus’ “home” launch pad, in that you always have to log in online to launch the app. At that point, you can cut off the app’s internet access indefinitely and play offline games, but we don’t know if the Oculus app collects that data even when you’re offline, waiting for a new connection to upload everything. (The privacy policy is written so that Oculus will at least allow uploads after disconnection.)

VR is a new frontier for user experience, but not for privacy policies around a gold rush for data collection. The only complaint we’d make specifically to Oculus is that the privacy and legal policy pages weren’t set in stone until February – a full month after the headset pre-order campaign got underway in earnest – so we certainly understand why some customers prefer it provided that information before making a purchasing decision.

Otherwise, we hope congressional leaders like Franken are aware that what Oculus is doing here is incredibly typical – and if he wants to take legal action over privacy policies and who a company shares its users’ data with, he’s got a bigger boat.

By akfire1

Leave a Reply

Your email address will not be published.