Here's Why Privacy in the Metaverse Should Be a Consideration Right Now

You might be giving up much more information about yourself than you realize when you put on a virtual reality (VR) headset.  

A new paper shows that privacy may only be possible in VR by finding new ways to protect users. The study found that you can be quickly identified using the motions you make in VR. Experts say it's a sign of a growing VR privacy problem. 

"On top of the standard privacy issues that we've been battling internet companies for decades, the metaverse is going to create new platforms in which they can gather data about you and from you that you're not even aware of," John Tsangaris, a metaverse expert with Optiv Security told Lifewire in an email interview. "And because it's such a new technology and privacy is often a matter settled by the courts, they have not yet defined the boundaries of the new types of data that can be captured about you."

Easy to Find?

The study, led by graduate researcher Vivek Nair at the University of California Berkeley, looked at data collected from the VR application Beat Saber. The investigators found that individual users could be uniquely identified with more than 94% accuracy using only 100 seconds of motion data.

"While it has long been known that people reveal information about themselves via their motion, the extent to which this makes an individual globally identifiable within virtual reality has not yet been widely understood," the researchers wrote in their paper. "In this study, we show that a large number of real VR users… can be uniquely and reliably identified across multiple sessions using just their head and hand motion relative to virtual objects."

Your voice is another significant privacy concern in VR. Tsangaris said that voice is the primary mode of communication within the metaverse. Companies can examine your voice patterns and then use those voice patterns to track you as a digital signature across the metaverse and the personalities you create. 

"As well, new data is being generated by your movements within the metaverse, such as where you look, your mannerisms, how you interact with people," Tsangaris added. "all of this generates data that was not previously available to companies. And as we've seen time and time again, most companies that provide a free product to you, thereby turning you into their product, have not put a trustworthy first step forward." 

The new study isn't the first time privacy issues have been raised around VR. A report last year by the Common Sense Privacy Program found that users of the most popular VR headsets are constantly tracked. Headsets reportedly collect much more data than mobile apps and websites.

VR devices track your body posture, eye gaze, pupil dilation, gestures, facial expressions, and even minute variations in skin color, according to the report. A user's body movements in VR are tracked more than 100 times per second, so spending 30 minutes or more in a VR simulation can collect over 2 million unique data points.

Staying Anonymous

Keeping your privacy in the metaverse is challenging and will get more complicated as technologies advance. As a first step, Tsangaris said you should ask the companies what data they capture and how they use it. 

"This in and of itself is not going to necessarily expose any glaring errors; these companies are good at public relations and framing situations to make themselves look honest while simultaneously violating your privacy expectations," he added. "But it will start the conversation and the thought process for individuals to think about how their data is being used and to be more present in that conversation as it unfolds." 

Geoff Renaud, the CMO of Invisible North, said that decentralization could be one way to help keep yourself anonymous in the metaverse. 

"Blockchain technology puts the power into the hands of the users by giving them more control over their data and interaction," he added. 

But  Tsangaris said that passing legislation to protect VR privacy might be the best way to combat the creeping infringement on your data. 

"The good news is that since we, as a society, are no longer spring chickens in how the Internet works and how companies gather information about us, we're in a much better position to ensure our privacy needs are being met," he added. "That's not to say the courts won't hear new arguments about why this data is different and companies aren't violating privacy laws, but the arguments about why privacy in the metaverse should be respected have already been written."