“Oculus’ creation of an immersive virtual reality experience is an exciting development,” Franken wrote in an open letter to Oculus CEO Brendan Iribe, “but it remains important to understand the extent to which Oculus may be collecting personal information from Americans, including sensitive location data and sharing that information with third parties.”
The question is, what exactly is Oculus asking to collect – and how much worse is it compared to other online services’ EULAs?
A real House of cards
The short version is that Facebook can track what software you use through the Oculus Home hub, where you use your Oculus, and your headset’s positional tracking — and will likely share that data with other Facebook-owned companies.
“I believe Americans have a fundamental right to privacy, and that right includes an individual’s access to information about what data is collected about them, how the data is treated and with whom the data is shared,” Franken said in a statement. public statement.
However, Franken’s statement didn’t mention any other major online services, so this is a good opportunity to review whether Oculus is actually walking into any new, privacy breaches.
Let’s go through those cases one by one. For starters, “information about your interactions with our services” is a long-winded way of saying “we’re going to study anonymized data about general Oculus usage.” The same goes for any connected entertainment network you’ve used in the past five years, including Xbox Live, PlayStation Network, Hulu, Amazon Video, and Netflix. In fact, Netflix was shameless enough to admit it House of cards came as a result of studying the viewing habits of its customers.
Facebook also doesn’t say much interesting with its clause about tracking a user’s “location information.” For starters, your IP address is pretty revealing, as is any shipping information you provided with your Oculus pre-order (since that’s the only way people can currently buy the hardware). Furthermore, GPS tracking in privacy statements of online services isn’t really new, although that’s usually because the service or device in question provides useful services once we’ve given it permission to stalk us. That doesn’t mean that the Oculus Rift headset includes a GPS sensor, but that it’s the same statement of service that a Samsung GearVR user will see when using its Oculus-powered app.
We imagine Oculus’s smartphone-powered systems will soon see more GPS-powered apps (especially as mobile-friendly, GPS-tracked games like Qonqor or Enter ever take a VR leap), so Oculus has to admit it will at least have access to that data. And Facebook has already made it clear that it analyzes users’ GPS activity “to customize our services for you and others,” so this isn’t a huge step for a company in the same corporate umbrella.
The last part, which “collects information about your physical movements and dimensions when you use a virtual reality headset,” seems the most curious. Good news, anyway: those movements aren’t captured as photographic images, as the Oculus Rift “Constellation” sensor only tracks infrared light. This means that if you want to wave your bare butt at your headset, you’ll have to go to town (that is, as long as you don’t cover your cheeks with infrared sensors). That simply leaves positional tracking of the headset halfway through the game and the times when the headset is left unused on a desk.
While we can understand reasons for foregoing one of these data donation pools, we imagine VR users would like Oculus to have as much position data as possible, as this is the material researchers will mine as they work on the problems of VR nausea and discomfort. Anonymized data from thousands of retail headset carriers could answer questions that a smaller pool of dev kit owners simply couldn’t answer.
Conversely, the ability to collect data on, say, where we direct our VR “gaze” is a little disturbing. However, we imagine that Oculus’s app does not record such detailed data, because a lot of recording and processing, which would detract from PC performance. Oculus probably wants users to hit a rock solid 90fps visual refresh far more than they want to know how long you’re staring at the caterpillar in Lucky’s story. (But the amount of time you spend in each app, game, or visual experience? Every other streaming video and online gaming service records that information, too.)
Was only set in stone after preorders started
VR is a new frontier for user experience, but not for privacy policies around a gold rush for data collection. The only complaint we’d make specifically to Oculus is that the privacy and legal policy pages weren’t set in stone until February – a full month after the headset pre-order campaign got underway in earnest – so we certainly understand why some customers prefer it provided that information before making a purchasing decision.
Otherwise, we hope congressional leaders like Franken are aware that what Oculus is doing here is incredibly typical – and if he wants to take legal action over privacy policies and who a company shares its users’ data with, he’s got a bigger boat.