[ad_1]
Meanwhile, Meta’s current privacy policy for VR devices leaves plenty of room for the collection of personal biological data that goes beyond the user’s face. As Katitza Rodriguez, policy director for global privacy at the Electronic Frontier Foundation, noted, the language is “broad enough to include a wide range of potential data flows – which, even if not collected today, could start tomorrow without having to notify the user, securing their consent supplement, or modify the policy.
By necessity, virtual reality hardware collects fundamentally different data about users than social media platforms. VR headsets can be taught to recognize the user’s voice, veins, or the shade of the iris, or take metrics like heart rate, breathing rate, and what causes pupils to dilate. Facebook has filed patents on many of these types of data collection, including ones that would use your face, voice, or even your DNA to lock and unlock your device. Others will consider a user’s “weight, force, pressure, heart rate, pressure level, or EEG data” to create a VR avatar. Patents are often aspirational – covering potential use cases that never materialize – but they can sometimes provide insight into a company’s future plans.
VR Meta’s current privacy policy does not specify all types of data collected about users. The Oculus Privacy Settings, the Oculus Privacy Policy, and the Additional Oculus Data Policy, which govern the current Meta virtual reality offering, provide some information about the broad categories of data that Oculus devices collect. But they all specify that data fields (like “headset position, controller speed and your orientation change as you move your head”) sample in that category, rather than a complete enumeration of its contents.
The examples given also do not represent the breadth of categories they are intended to represent. For example, the Oculus Privacy Policy states that Meta collects “information about your environment, physical movement, and dimensions when you use your XR device.” It then gives two examples of such collections: information about the VR play area and “technical information like your hand size and hand movements.”
But “information about the environment, physical movement, and dimensions” can describe data points that go beyond the size of the hand and the boundaries of the estimated game – it can include metrics of involuntary reactions, like a flinch, or a uniquely identifying gesture, like a smile.
The second meta declined to detail the types of data the device currently collects and the types of data it will collect in the future. It also declined to say whether it collects, or plans to collect, biometric information such as heart rate, respiration rate, pupil dilation, iris recognition, voice recognition, vein recognition, facial movement, or facial recognition. However, it refers to the policy linked above, adding that “Oculus VR headsets do not currently process biometric data as defined by applicable law.” A company spokesman declined to specify what laws Meta believed to apply. However, about 24 hours after publishing this story, the company said it does not “currently” collect the type of data described above, nor does it “currently” use facial recognition on its VR devices.
Meta, however, offers additional information on how to use personal data in advertising. The Oculus Additional Terms of Service say that Meta can use information about “actions [users] has acquired Oculus” products to serve ads and sponsored content. Depending on how Oculus defines “action,” this language could allow it to target ads based on what makes us jump in fear, or make our heart flutter, or our hands sweat.
[ad_2]
Source link