Last updated: 2026-11-12

U
Undergraduate level

Privacy in VR: When the Body Becomes the Data

A VR headset can't work without measuring the person wearing it. To draw each frame it needs to know where the user's head is and which way it's facing; to show their hands it tracks them; many headsets follow the eyes so they can render sharply only where the user is looking. All of that is collected to run the experience. What happens to it afterwards is the privacy question.rendering only what's seen saves GPU cycles

This page sets out what a headset collects, how little of that data it takes to identify a person, how UK and EU law classify it, where the law has gaps, and what a developer can do about it.

What a Headset Collects FoundationalKnowledge that endures for decades — core principles

StreamWhy the device needs itWhat else it can reveal
Head and hand motionPositioning the camera and the user's virtual hands, many times a secondHeight, arm length, handedness, gait and movement habits; identity
Eye trackingFoveated rendering, gaze-based menus, avatar eye contactWhat the user looks at, for how long, and how their pupils respond
VoiceChat, voice commandsVoiceprint, accent, emotional state, other people in the room
Room cameras and depth mapsInside-out tracking, pass-through, guardian boundariesThe layout and contents of the user's home, and anyone else in it
Physiological sensors (on some devices)Fitness features, research, adaptive experiencesHeart rate and arousal, from which stress, fear or interest can be inferred

The right-hand column is where VR departs from a phone or a laptop. Slater and colleagues describe the combination of motor actions and eye movements as a "kinematic fingerprint", and warn of misuse of deeply personal information such as a person's phobias, learned from how they react inside an experience1.

Motion Data Identifies People Applied / MethodologicalKnowledge with a 5–10 year half-life — stable practice

Head and hand positions look like anonymous telemetry. Two studies show that they aren't.

StudyUsersData usedIdentification accuracy
Miller et al. (2020)2511Head and hand position while watching 360° video; under 5 minutes of training data per personAbove 95%
Nair et al. (2023)3More than 50,000Head and hand motion from a VR rhythm game; 5 minutes of training data per person94.33% from 100 seconds of motion; 73.20% from 10 seconds

Nair and colleagues' pool was about a hundred times larger than earlier studies, so identification holds up at a scale comparable to a large platform's user base. In practice that means a stream of "anonymised" motion data, kept by a developer or passed to an analytics provider, can usually be linked back to the person who produced it by anyone who holds a few minutes of labelled data for that person.

Note well. Removing names and account IDs from VR telemetry doesn't anonymise it. The movement itself identifies the user.

Under the UK GDPR and the EU GDPR, any of these streams is personal data once it can be linked to an individual, which the studies above suggest it usually can. The harder question is whether it's biometric data, which brings stricter rules.

Article 4(14) defines biometric data as personal data "resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person". Article 9 then makes biometric data a special category, generally prohibited unless a specific condition applies, when it is processed "for the purpose of uniquely identifying a natural person"4. The Information Commissioner's Office (ICO) guidance on biometric recognition follows that line: using biometric data to recognise someone needs both a lawful basis and a special-category condition, explicit consent is likely to be the most appropriate condition, and a data protection impact assessment (DPIA) must be completed first5.

That gives the same motion stream different legal standing depending on what it's used for:

graph LR S["Head, hand and eye
tracking stream"] --> R["Render the next frame,
then discard"] S --> K["Logged and stored"] K --> A["Analytics and
product improvement"] K --> I["Recognise or
re-identify the user"] K --> P["Infer interests, emotions
or health"] R --> R1["Minimal privacy impact"] A --> A1["Personal data:
lawful basis needed"] I --> I1["Special category biometric data:
Article 9 condition needed"] P --> P1["Personal data; special category
if it reveals health"] style I1 fill:#FFC857

The risk to the user depends on what the data can do; the legal category depends on what the controller says it is for. A company that stores motion data for "analytics" holds data from which the user could be identified, without having taken on the duties that apply to identification. Our reading is that this gap between capability and declared purpose is the central weakness in applying current data-protection categories to VR.purpose vs capability is a recurring legal gap

US law has a similar shape. Illinois's Biometric Information Privacy Act (BIPA) requires informed written consent before a company collects "biometric identifiers", a defined list that includes retina or iris scans and scans of hand or face geometry, and it lets individuals sue for $1,000 per negligent violation or $5,000 per intentional or reckless one6. Whether head-and-hand motion falls within that list is unsettled, and most US states have no equivalent law.

Beyond Identity: Biometric Psychography Applied / MethodologicalKnowledge with a 5–10 year half-life — stable practice

Heller argues that the bigger risk from immersive technology is inference rather than identification. She coins the term "biometric psychography" for the use of biometric data, such as gaze and physiological response, to work out what a person likes, wants and is interested in, and she identifies gaps in privacy law that regulators and consumers wrongly assume will cover immersive technology. Biometric law in particular is built around confirming who someone is, not around what their body's responses reveal about them7.law lags behind tech

Gaze is the clearest case. Where someone looks, how long they look, and how their pupils respond are largely involuntary, so a user can't easily choose what to reveal. An advertising-funded platform that records gaze can learn which products, people or ideas hold a user's attention without the user ever clicking anything. The phrase "cognitive privacy" is sometimes used for the interest at stake: being able to keep one's reactions, as well as one's words, to oneself. The ethics page in this set follows the question of what a platform may do with such inferences.

People Who Never Put on the Headset Applied / MethodologicalKnowledge with a 5–10 year half-life — stable practice

Room-scanning cameras and always-on microphones capture people who haven't agreed to anything: a flatmate walking through the play area, a child in the background of a voice chat, a member of the public in front of a pair of camera glasses. None of them has an account, saw a privacy notice, or can exercise their rights easily. Building for Immersive Platforms covers the shadow profiles that can result.

What This Means When You're Building It Applied / MethodologicalKnowledge with a 5–10 year half-life — stable practice

Three GDPR principles do most of the work: data minimisation (Article 5(1)(c)), data protection by design and by default (Article 25), and the DPIA for high-risk processing (Article 35)4. In VR terms:

  • Use tracking data in the frame and then drop it. Most mechanics need the current pose, not a history of poses.
  • Log derived events, not raw streams. "Player completed the puzzle in 94 seconds" serves most analytics; a full motion capture of the attempt doesn't need to leave the device.
  • Treat eye tracking as opt-in. If a feature doesn't need gaze, don't request it because the SDK makes it easy.
  • Assume telemetry is identifiable. Apply the same access controls, retention limits and transfer safeguards as for any other personal data.
  • Do a DPIA early if your project stores biometric, physiological or gaze data, or involves children.
  • Write a privacy notice that names the streams. "We record head and hand movement during play and keep it for 30 days" can be understood; "we collect usage data" can't.
This is the approved approach. Decide, for each sensor stream, whether it leaves the device at all. Most projects can answer "no" for nearly all of them.

References

  1. Slater, M., Gonzalez-Liencres, C., Haggard, P., Vinkers, C., Gregory-Clarke, R., Jelley, S., Watson, Z., Breen, G., Schwarz, R., Steptoe, W., Szostak, D., Halan, S., Fox, D., & Silver, J. (2020). The ethics of realism in virtual and augmented reality. Frontiers in Virtual Reality, 1, 1. https://doi.org/10.3389/frvir.2020.00001 ↩

  2. Miller, M. R., Herrera, F., Jun, H., Landay, J. A., & Bailenson, J. N. (2020). Personal identifiability of user tracking data during observation of 360-degree VR video. Scientific Reports, 10, 17404. https://doi.org/10.1038/s41598-020-74486-y ↩

  3. Nair, V., Guo, W., Mattern, J., Wang, R., O'Brien, J. F., Rosenberg, L., & Song, D. (2023). Unique identification of 50,000+ virtual reality users from head & hand motion data. In Proceedings of the 32nd USENIX Security Symposium (pp. 895–910). USENIX Association. https://www.usenix.org/conference/usenixsecurity23/presentation/nair-identification ↩

  4. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4(14), 5, 9, 25 and 35; retained in UK law as the UK GDPR. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩↩

  5. Information Commissioner's Office. (2024). Biometric data guidance: Biometric recognition. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/about-this-guidance/ ↩

  6. Biometric Information Privacy Act, 740 ILCS 14 (Illinois, 2008). https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 ↩

  7. Heller, B. (2020). Watching androids dream of electric sheep: Immersive technology, biometric psychography, and the law. Vanderbilt Journal of Entertainment and Technology Law, 23(1), 1. https://scholarship.law.vanderbilt.edu/jetlaw/vol23/iss1/1/ ↩

Graduate Attributes

Modelled on this page

  • Critical Thinker: The distinction between data capability and declared purpose is highlighted as a central weakness in current legal frameworks.
  • Digitally Fluent: Technical mechanisms of VR tracking are explained alongside their implications for data privacy and user rights.
  • Sustainability-Minded: The impact on bystanders who have not consented to data collection is considered as part of the system's design.

University of Reading Graduate Attributes framework.