Prominent VR headset company Oculus is slowly releasing its first product to consumers. Now that the Facebook-owned company is becoming more widely known outside of the developer world, consumers are voicing their concerns over potential privacy issues outlined in the terms of services and privacy policy.
Multiple media outlets have sounded the alarm about Oculus Rifts’ data-acquiring practices, notably an executable file that is reportedly “always on” and has the capacity to continually send data.
This file was first unearthed by Upload VR, who contend that, though “OVRServer_x64.exe” may be used to boot up the Oculus Home main menu, its capabilities are worrisome in the face of the company’s official privacy policy. This policy states that everything from your location, to your gameplay, to your physical movements are fair game for data collection. This data is used to improve the user experience as well as market to said user, according to Oculus Rifts’ privacy policy.
Oculus responded to Upload VR with a lengthy message that stresses that both users and developers own what they’re putting into the device but that the information collected will nonetheless be used by the company. A representative said:
The Oculus privacy policy was drafted so we could be very clear with the people who use our services about the ways we receive or collect information, and how we may use it. For example, one thing we may do is use information to improve our services and to make sure everything is working properly — such as checking device stability and addressing technical issues to improve the overall experience.
The company concludes that it has yet to send that data directly to Facebook, primarily because advertising has yet to be developed for the Oculus Rift. That is expected to change, however.
As much as the company touts its explicit terms of services and privacy policy, the information presented has continued to bring about questions from consumers and lawmakers, including Sen. Al Franken of Minnesota, who penned an open letter to Oculus on April 7 and is seeking answers by May 13.
Among Franken’s six points of contention in his letter, one sentence used two times verbatim stands out in particular: “Are there any other purposes for which Oculus collects this information?” The point that the senator appears to be driving at is that of an opaque policy that Oculus Rift has admitted will most likely change following an uptick in users and content.
Franken is similarly concerned about data security, questioning how long the company retains such information as well as whether it’s willing to sell it to third parties: “What precautions does Oculus currently have in place to ensure the security of consumers’ data?”
Ryson University’s Privacy and Cyber Crime Institute director tends to agree with Franken. In an interview with the CBC regarding the Oculus Rift’s troubling privacy policy, Dir. Avner Levin admitted that the company’s language was “very flexible.” Levin continued:
There’s a whole other set of categories here that all of a sudden could seem to us to be very intrusive of perhaps some of our most private moments as users of this kind of technology. So this is the kind of thing that people need to worry about.
Oculus has yet to respond to Franken’s questions. For now, the company appears to be facing difficulties in actually getting VR headsets to consumers at an expedient pace.
We apologize for the delay getting Rifts to your doorstep. We’re addressing the component shortage and shipping Rifts as fast as we can.
— Meta Quest (@MetaQuestVR) April 12, 2016
It bears noting that the current limitations of the technology, such as a lack of GPS and an infrared light-only movement tracking system, similarly limits what information Oculus Rift can glean from headset use. This may buy the company a little more time as it seeks to both address user concerns over its policies and frustrations due to delivery difficulties.