By necessity, virtual reality hardware collects fundamentally different data about its users than social media platforms. VR headsets can be taught to recognize a user’s voice, their blood vessels or the shade of their iris, or capture metrics such as heart rate, breathing rate and what causes their pupils to dilate. Facebook has filed patents for many forms of this data collection, including using things like your face, voice or your DNA to lock and unlock devices. Another considers the user’s “weight, force, stress, heart rate, strain rate, or EEG data” to create a VR avatar. Patents are often aspirational — involving potential use cases that may never arise — but they can sometimes offer insight into a company’s future plans.
But “information about your environment, physical movements and dimensions” can describe data points beyond the boundaries of estimated hand size and play — including involuntary response metrics like uniquely identifying movements like a flinch or a smile.
Meta has twice declined to describe the types of data its devices collect today and the types of data it plans to collect in the future. It declined to say whether it currently collects or plans to collect biometric information such as heart rate, breathing rate, pupil dilation, iris recognition, voice recognition, vein recognition, facial movements or facial recognition. Instead, it pointed to the policies linked above, “Oculus VR headsets do not process biometric data as currently defined under applicable law.” A company spokeswoman declined to specify which laws Meta applies. However, about 24 hours after this story was published, the company told us that it “currently” does not collect the types of data described above, nor does it “currently” use facial recognition on its VR devices.
However, Meta provided additional information about how personal data is used in advertising. A supplemental Oculus Terms of Service states that Meta “may use information about actions.” [users] We took Oculus products to serve them ads and sponsored content. Depending on how Oculus defines “action,” this language allows us to target ads based on what makes us jump in fear, or make our heart flutter, or our hands sweat.