Facebook Privacy Concerns Mark Shift for Oculus VR

Changes Oculus announced last month to its privacy policy and terms of service agreement go into effect on Sunday, to match with changes the European Union is making to its General Data Protection Regulation on the same day. These changes come on the heels of a major controversy where political consulting firm Cambridge Analytical gained the personal information of millions of users of Facebook, which owns Oculus.

In a blog post, along with a more detailed and straightforward description of what data it collects and shares, Oculus announced a new “My Privacy Center” in April to which users will have access in order to have more control over their data while using the company’s VR headset. In the privacy center, previewed with a snapshot on the blog post, users will be able to download whatever data Oculus has collected on them, similar to existing features on Facebook and Google. It’ll be available when the new privacy policy takes effect on May 20.

The changes to GDPR include a requirement that privacy policies be more easily readable, without long stretches of legalese. The changes also include stiffer penalties and greater territorial coverage.

The privacy scandal involving Facebook and Cambridge Analytica has reignited concern surrounding the social media company’s implementation of virtual reality and augmented reality.

On April 2, a former VR ambassador for Valve – a competitor to Facebook and Oculus in the VR space, raised some grave concerns on Twitter over Facebook’s and Oculus’ approach to collecting users’ personal data, particularly in regards to how advertisers might use that data to target users in the future.

In addition to the information a social network or online store usually collects from users like profile information, purchases, what games users play, or IP address information, Oculus also collects information about users’ movements and “physical dimensions.” According to the blog post this could mean user height, gestures, or what direction a user is facing. The company says it needs this data to keep things running.

In previous comments to press and in the new privacy policy, Oculus stresses that it doesn’t share information with Facebook for third party companies to use for advertisements. However, the policy still states that one of the reasons it collects information is marketing. “We use the information we collect to send you promotional messages and content and otherwise market to you on and off our Services. We also use this information to measure how users respond to our marketing efforts.”

[pullquote]All this suggests that while Oculus isn’t handing user data over to advertisers yet, it very well could in the future.[/pullquote]

Oculus also states it still shares data with companies related to Facebook. Third party games or apps might also have their own policies regarding information they collect and what they do with it. Then there’s the possibility that somebody else might own Oculus in the future, at which point the privacy policy admits that company would own the information Oculus collects.

All this suggests that while Oculus isn’t handing user data over to advertisers yet, it very well could in the future.

The current privacy controversy concerns how companies like Facebook or Google build profiles on users based on their online behavior, which advertisers they use. Virtual reality companies could add to that information about where users are actually looking based on eye movements. In a 2016 article for The Intercept, Janus Kopfstein writes that other VR companies are or will be able to know exactly where a user is looking, the movement of facial muscles, and a user’s emotional state. Facebook last year patented an eye-tracking device shortly after purchasing an eye tracking company. Augmented reality companies could add information on what users see in the physical world.

Former Valve VR ambassador Chet Faliszek’s concerns on Twitter are mainly about how that information might be combined with some of the darker practices associated with Facebook advertisers, particularly if AR becomes more ubiquitous. “They have been caught offering ads towards depressed teens,” he tweeted, referring to a report in 2017 alleging Facebook offered the ability for advertisers to target customers based on their emotional state. “Not seeing enough smiles in your world? Let’s taunt you, if only you had these new items, then people would smile when they saw you.”  Facebook later disputed the report.

Faliszek further speculated advertisers could potentially use AR in the future to advertise based on what kinds of businesses they visit, where they drive past, or what kinds of people they see. Some of this speculation is based on previous advertising controversies involving Facebook, like when ads appeared on it targeting users with anti-Semitic views, or when some of its ads were found to exclude racial groups.

Right now AR advertising has just manifested in the form of overlays, often interactive ones, on top of smartphone camera displays, like this one from Coka-Cola and WWF bringing awareness to the endangerment of polar bears. Earlier this month Facebook unveiled functionality that allows its AR platform to track and interact with certain real-world objects like movie posters. The full extent of how marketers could use AR remains to be seen however.

[pullquote]People have been concerned about Facebook’s use of VR for data collection and advertising just about ever since the company acquired Oculus in 2014.[/pullquote]

Andrew Bosworth, Facebook’s former VP of ads and business platform, is the company’s current VP of VR and AR. Faliszek speculates this indicates a possible shift towards advertising for Facebook’s VR and AR platforms.

People have been concerned about Facebook’s use of VR for data collection and advertising just about ever since the company acquired Oculus in 2014.

In 2016, former United States senator Al Franken wrote an open letter to Oculus expressing concern about its data collection, asking if it was necessary to maintain Oculus services and if Oculus was sharing that data with advertisers. PC Gamer reported Oculus’ response. “We want to create the absolute best VR experience for people, and to do that, we need to understand how our products are being used and we’re thinking about privacy every step of the way,” part of the statement read.

As far as they have come, VR and AR technology are still evolving. The way they collect and use information is still evolving too. Oculus is being more transparent in response to public and potential legal pressure right now, but there’s no telling how much the situation could change in the future.