It came to light recently, and seemingly as a shock to some, that the Facebook-owned Oculus Rift VR headset is collecting data about its users for purposes of an unspecified nature. As spotted (on April 1, of all days) by UploadVR, the Oculus privacy policy allows it to automatically collect data ranging from the games and content you access through the Rift to “information about your physical movements and dimensions when you use a virtual reality headset.”
The data is seemingly collected by a process called OVRServer_x64.exe—kind of uncomfortably close to "Overseer," isn't it?—which is always on, has full system permissions, and sends regular updates back to Facebook. The information collected is used to provide services, improve the product, and of course, for marketing purposes: “We use the information we collect to send you promotional messages and content and otherwise market to you on and off our Services," the policy states. "We also use this information to measure how users respond to our marketing efforts.”
In some ways it has the appearance of a non-issue—the sky is blue, the grass is green, and Facebook is watching you—but Avner Levin, the Director of the Privacy and Cyber Crime Institute at Toronto's Ryerson University, told the CBC that users should be paying attention to this kind of stuff.
“We think we understand right now what [privacy policies] mean, but their language is very flexible," he said. "There's a whole other set of categories here that all of a sudden could seem to us to be very intrusive of perhaps some of our most private moments as users of this kind of technology.” As an example, he said people might not mind Facebook tracking their movements while they're playing a game, but could feel differently about it happening while they're watching virtual porn. (Hypothetically. *cough*)
In a statement sent to UploadVR, Oculus clarified its policy somewhat, although it gave no indication that it might be dialed back. “We want to create the absolute best VR experience for people, and to do that, we need to understand how our products are being used and we’re thinking about privacy every step of the way. The Oculus privacy policy was drafted so we could be very clear with the people who use our services about the ways we receive or collect information, and how we may use it," it said. "For example, one thing we may do is use information to improve our services and to make sure everything is working properly—such as checking device stability and addressing technical issues to improve the overall experience.”
Oculus also noted that, while Facebook owns it and runs some of its services, they are not currently sharing the collected data. “We don't have advertising yet and Facebook is not using Oculus data for advertising—though these are things we may consider in the future." Which, if nothing else, is the funniest use of "may" you're likely to see on this site today.
