Oculus Faces ‘Existential Crisis’ In Handling Personal Data

by Ian Hamilton • May 21st, 2018

The new Oculus terms of service and privacy policy are now posted. Also, you can now access the information Oculus has stored about you by logging into your Oculus account and visiting My Privacy Center.

Facebook is overhauling the Oculus privacy policy and terms of service as the company prepares to launch its first standalone VR headset.

The change comes amid new European privacy regulations and an international movement calling into question Facebook’s platform and business model. Earlier this month, CEO Mark Zuckerberg appeared before Congress to answer questions about the company’s handling of personal data.

Also, in a few weeks at the F8 developer conference, Facebook is expected to provide launch details for the $200 all-in-one Oculus Go VR headset. The consumer-focused launch represents a big moment for Facebook as its first standalone consumer product. Go launches six years after Oculus was founded and more than four years after Mark Zuckerberg decided to acquire it. Oculus first launched with the Gear VR for Samsung phones and its high-end Rift headset sits atop Microsoft’s Windows. With Go’s launch, a VR headset will stand on its own for the first time as a self-contained consumer product at a pretty alluring price.

For the early VR developer community, there’s hope Go might open up a new active (and paying) user base. I’ve also heard from developers, though, who remain concerned about releasing their virtual worlds on Oculus platforms for reasons ranging from how Facebook collects and handles personal data to how it influences democracy going forward.

“It’s an existential crisis for us to make sure we get data handling right,” said Max Cohen, head of product for the Oculus Platform, during a phone interview.

What Information Does Oculus Store?

When Oculus launched the Rift in 2016 the company started storing snapshots online, once per minute, of the actual and “average” position of the Rift and Touch controllers. Until recently, this data was connected to individual Oculus accounts.

The data is still there, but Oculus representatives said it “can’t be used to identify individuals.” According to Oculus, this data “is used to generate aggregated playspace information that developers can access to help inform their game design.”

“We realized over time that we don’t need to associate movement information with your account to make our systems work, so we moved to a system where all movement data is now de-identified,” an Oculus spokesperson wrote in response to questions.

For those unfamiliar, the Oculus Rift headset and Touch controllers which come packaged together are precisely tracked using sensors that are little more than slightly modified webcams looking for dots of light on the surface of the gadgets.

“We don’t log frame-by-frame movement information,” an Oculus spokesperson wrote in an email. “Rather, we log movement data at 1-minute intervals, including both samples (specific moment-in-time measurements) and aggregated information (such as minimum, maximum, and average) for the position of the headset and Touch controllers. This information isn’t granular and it can’t be used to identify individuals.”

Facebook’s Spaces app — a social experience that connects people on Facebook Messenger, Rift, as well as headsets not made by Oculus — is separate from Oculus and covered instead by Facebook’s privacy policy. The company said it “doesn’t log any movement information from Spaces.”

“Movement data is analogous in my opinion to mouse or keyboard for VR,” said Cohen.

I asked Facebook what’s to stop a developer from taking movement data and associating it with your account. Jenny Hall, who leads privacy programs for the Oculus legal team, said there’s an app review process and “contractual protections” in place with developers, along with other tools, to deter misuse.

“Privacy is something that we need the entire community of think about, we can’t just fix it or think about it on our own,” said Hall.

Next month, the company plans to launch a new “My Privacy Center” section of its service with updated tools where users are said to be able to download the information Oculus has stored about them.

“If there is identifiable data being stored and linked to your account we’ll make that accessible so people are aware of that and can download that,” said Cohen.

Setting User Expectations

The new Oculus privacy policy and terms of service take effect May 20, with the service agreement incorporating the company’s code of conduct directly into the document.

The new terms state in one section “people can only have meaningful interactions if they feel safe” and in another requires users agree not to “disrupt, negatively affect or inhibit anyone from fully enjoying the Services, including, but not limited to, defamatory, harassing, threatening, bigoted, hateful, vulgar, obscene, pornographic, or otherwise offensive behavior.”

“If people don’t feel safe in VR they won’t use our services,” said Hall. “We want to make it super visible for people how we expect them to behave on our platform.”

Ad Targeting From Facebook

Just like Rift and Gear VR, Oculus Go doesn’t require a Facebook account to use, but it is optional to link up your Oculus and Facebook accounts. If you do, certain information like “the interests you’ve chosen to share on your Facebook profile” could be used to suggest VR content you might like from Oculus.

According to a draft Oculus blog post explaining the updates: “We don’t share data with Facebook that would allow third parties to target advertisements based on your use of the Oculus Platform.” In an email, Oculus representatives clarified “it’s not our roadmap currently” to allow third-parties to target ads to Oculus users who have linked up their account.

Tagged with:

What's your reaction?
  • gothicvillas

    I want VR headset but I dont want Facebook. And this is the main issue for Oculus.

    • OkinKun

      If you’re worried about facebook, doesn’t Steam essentially collect the same kind of data about it’s users?

      • All companies gather data, but as someone stated regarding Apple: Steam doesn’t live because of personal data of users, it lives selling games. Facebook, instead, lives selling ads. Without personal data, Facebook business wouldn’t be sustainable. That’s why they take everything they can about us.

        • Oculus sells games too

        • OkinKun

          Well then by that logic, Oculus does exist to sell games and hardware.. And for the most part, they’re not really recording much data about their users.. Basic anonymous system specs, or oculus store browsing/purchasing data, but that’s it, and it will probably be all they do, for a few hardware generations.

      • johngrimoldy

        No. Not in the slightest. You have a Steam app on your iPhone?

    • You don’t need facebook for Oculus.

  • David D. Taylor

    Personally, data collection, the type that Facebook has done, anyway, is not that big of a deal to me. The ads geared towards what I like and want, is a much better deal than ads for things I don’t care about. Just a personal opinion. I’m not worried about it. Oculus is the best VR solution at the moment, and the pros far outweigh the cons I’ve heard brought up.

    • Hone McBone

      I’d rather purchase a VR headset from a company that didn’t have their CEO testify before the US congress about their disregard for users privacy rights, or is currently requested by the European Parliament to testify for the same issues.

      • OkinKun

        The 2 issues aren’t really related.. Oculus operates relatively independently of FB, to the annoyance of some fb shareholders. lol
        With this latest Privacy Center update, they’ve basically address these privacy concerns.
        Besides.. At least for the foreseeable future, it’s actually extremely hard/impossible for them to violate you VR privacy or track people in the ways that people are paranoid about.. What would they even do with the data? They’d have to be able to see your computer screen, to know what you’re seeing in a VR game.. And that would take TONS of bandwidth, and people would notice real fast.

        • Hone McBone

          Facebook has a huge amount of money invested in Oculus, who aren’t exactly making a ton of money for them at the moment. It seems pretty naive, especially with the dubious Facebook’s privacy track record, that they would let Oculus do whatever they want without looking to make money off of the users somehow.

          I’m not saying all the other companies aren’t looking to make a profit, I’ll just avoid one owned by Facebook.

          • OkinKun

            What are you worried about specifically? What do you think they could do to violate your privacy or track you?
            Frankly, if you’re worried about Oculus, you should also be worried about Steam. Both are probably recording roughly the same use-data about their users. And without eye tracking or hogging our bandwidth to watch what we’re seeing, there’s not much to worry about. Right now, it’s just anonymous statistical data like room-scale size or how long we play, to help determine how users are using VR, so the companies know how to improve it.

            Facebook’s interest in Oculus is less about getting personal data from gamers, and more about getting an early hold on the virtual reality social network concept. If they can become the main framework for a social VR metaverse-thing, then they’d own several potential future sources of revenue, unrelated to tracking user data.

            I just don’t think it’s worth worrying about, or depriving yourself of a good VR experience over.. for now.

          • Hone McBone

            If Newell had to testify to congress about selling user privacy information & I wouldn’t want to support Valve either.

          • David D. Taylor

            So because Steam gets away with it and Facebook got caught, it’s okay to still use Steam but not Facebook. I’ve learned that ignorance is fine from your post.

            Also note that Congress asked questions… most of them ridiculous and foolish… and didn’t try him. He wasn’t charged with anything. Must not have been that big of a deal….

          • Hone McBone

            Of course Steam is collecting information, but from what I know they’re not selling it on further to other companies.

            The activity feed in Steam looks a lot different from an ad riddled Facebook feed that you love so much.

          • airball

            You make some good points, but I have one correction. Your claim that it would take high amounts of resources (bandwidth) to ‘watch what we’re seeing’ is not true. There are several analytics products that do exactly that. How? They have their own copy of the asset (a rendered scene or an mp4 file), which means they only need to track timestamps, camera position within the scene, and camera rotation within the scene. Those 7 values (timestamp + x/y/z camera position + x/y/z rotation) are enough to know where your location and where your head is pointed within a scene. Analysts can then use tools that render the scene or video and rotate their virtual camera in accordance to the values that are collected from users. Importantly, it does not rely on capturing frames or any other high-bandwidth techniques.

          • johngrimoldy

            No, Steam does not collect the type of data that FB does. Steam is not used as a sign in for countless other sites, and you simply don’t reveal the same things about yourself thru Steam. MANY don’t make connections thru Steam, and it never tries to pass itself off as a news source. Steam does not track your surfing habits. Steam is usually NOT on a smartphone. I won’t try to get you to be concerned, but your point is vastly ignorant.

          • Same w/ Oculus…

          • gavan33

            Comparing Facebook to Steam is ridiculous. I get that you’re not worried… to each his own. But trying to convince logical thinkers that Facebook won’t use Oculus to collect as much user data as possible is a hopeless cause. I think you may be downplaying the potential for abuse so that you can feel better about how much you’ve already given to the Book.

        • johngrimoldy

          No, it would not take TONS (your emphasis) of bandwidth to know what you’re seeing. The head and hand positional data is minor. Fully rendered versions of what players are seeing are not needed. All that’s needed is positional data. Why do you think anyone would need to see your screen?

          • OkinKun

            Well.. Ok, so maybe they could do it that way.. But what are they trying to see, for now??? There’s no data to collect right now, nothing in any VR game, that they’d want to know if we’re seeing..
            Frankly, I can’t imagine what gamer data FB would even want from vr user, that isn’t already possible to collect about gamers, or that they could possibly collect from the games I play, it’d be utterly useless information.

            What games, for the foreseeable future, even have real ads or stealth ads in them? I mean, publishing companies tried to force game developers to do this, but it didn’t really catch on.. Other than maybe for companies like EA (who most of us hate anyway).. But the VAST majority of games developers, they’re not making an effort to stick things into their games, that they’d want to know if we’re looking at. So far, there aren’t any VR games doing that either, AFAIK..
            So at most, this would apply to some future theoretical Facebook social VR app, that maybe had something in it that they’d want to record about people… But that’s not what’s happening right now, and wont for a while..
            If they cross the line into recording conversations or extreme data collection, then I’ll complain too. lol

          • johngrimoldy

            What data are they collecting right now? How about:

            What games you buy
            What games you play
            When do you play
            How frequently
            For how long
            Who do you play with (in social apps).
            How well do you play

            If you think FB is not collecting that data right now, you’re kidding yourself. How do you know what is/isn’t happening right now?

            You imply that you have some knowledge of what the VAST (again your emphasis) majority of developers are doing? How do you know that? Are you in the industry? How do you know what developers are/are not making efforts to put into games.

            Why are yo so wiling to give Zuckerdouchenozzle a pass?

            Look, I’m enjoying my VR rig too. I’m just saying that Zuck and others are collecting data.

          • OkinKun

            I’m fully aware they collect that data.. So does Steam for it’s own purposes. I think you misunderstood the type of data I was referring too, that’s pretty harmless compared to data that is more personal/privacy violating..

            I don’t see how them knowing those things is a bad thing.. Amazon knows that kind of data about you, when you shop on their site/app.. It helps their suggestion algorithms give you better suggestions. So if Oculus is collecting data to make their store better, or improve their VR platform/experience, that’s ok.

      • Ilia Sedelkin

        Actually, IMO having to testify and receive all that attention will make the company take the matter much more seriously, improving on the way they handle data. Case in point – this article

        • D.L

          The privacy issues stem from their business model, which is to sell their user’s personal information to third parties. There isn’t any way to fix this without completely changing how the company fundamentally operates, messing with the EULA is just distraction and ultimately meaningless as, like most EULAs, they reserve the right to modify the terms at any point.

      • MowTin

        I just buy the best headset. I’m not paranoid about my personal data. My life is pretty boring. I’m sorry most of us are just not important enough to spy on.

  • I think that in the end, Facebook will use Oculus data. Facebook lives thanks to data and when XR will become the popular computing platform, they’ll have to gather data from it.