Oculus Rift terms of service raise privacy concerns

The long-awaited Oculus Rift — the virtual reality headset from the company now owned by Facebook — is now shipping to customers.

• Oculus Rift is here: What the critics are saying

But privacy advocates say the technology could open a big can of worms when it comes to your personal data. CBC Radio technology columnist Dan Misener looked into why.

What kind of issues have come up with the Oculus Rift user agreement?

Now that these virtual reality headsets have started arriving on the market, people have taken a close look at the terms of service and the privacy policy — those long, legal documents that many of us agree to without actually reading.

And within those documents, customers and critics have found language they find troubling. They're pointing out issues from a privacy perspective, in terms of the kinds of data this VR headset collects about users, and also from a content creation perspective.

Some VR designers and developers are uncomfortable with the rights Oculus wants in exchange for using their technology.

So there are some things you should be thinking about before you strap on a virtual reality headset — which is something more and more of us are likely going to do over the next year or so.

What are the privacy concerns?

If you read the Oculus privacy policy, it outlines the kinds of information the company can collect about you.

There's some pretty typical stuff in there — your name, email address, and date of birth for example. Also, they collect information about how you use Oculus services — which games and apps you use. All pretty obvious.

But then you get to a section that says Oculus will collect "Information about your physical movements and dimensions when you use a virtual reality headset."

So we're talking about tracking the movement of your body, and then sending that information to Oculus, which is owned by Facebook.

And later on in the privacy policy, Oculus explains what it can actually do with this information. Among other things, it explicitly talks about marketing, and using the Oculus Rift "to measure how users respond to our marketing efforts."

Users have discovered that the software you need to run the Oculus rift is configured to run all the time, in the background, reporting back to Facebook.

So to recap — we're talking about a system that's always monitoring, tracking your physical movements, sending that info to Facebook, and using it to tailor marketing messages to you.

What do privacy advocates say about this?

Avner Levin, the Director of the Privacy and Cyber Crime Institute at Ryerson University, says it's still really early days for VR, and there will be uses for this technology we simply haven't imagined yet.

But he says we need to be aware of what we're doing when we agree to these privacy policies.

"We think we understand right now what they mean, but their language is very flexible," he said.

"There's a whole other set of categories here that all of a sudden could seem to us to be very intrusive of perhaps some of our most private moments as users of this kind of technology. So this is the kind of thing that people need to worry about."

For instance, some people may be OK with Facebook tracking their body movements during a video game. But they may be less comfortable being tracked if they're watching, say, adult content.

And as Avner points out, pornography is one of the biggest consumer-facing industries using VR right now.

What other concerns do people have with the Oculus terms of service?

Some content creators — virtual reality developers and designers — have voiced concerns.

If you create something for the Oculus Rift, Oculus says "we do not claim any ownership rights in or to your User Content," according to its terms of service.

But those terms also state that "By submitting User Content through the Services, you grant Oculus a worldwide, irrevocable, perpetual (i.e. lasting forever), non-exclusive, transferable, royalty-free and fully sublicensable (i.e. we can grant this right to others) right to use, copy, display, store, adapt, publicly perform and distribute such User Content in connection with the Services."

So all kinds of ways Oculus can use the content you create for the device. All without paying you.

Of course, not everyone's comfortable with that.

Stephan Tanguay is a Canadian VR designer and developer. He said he's seen this kind of language from other VR and gaming companies, too.

"It's usually on the incredibly aggressive scale — if you read it, it's very scary," he said.

"But I think at the end of the day, people want to do what they do for a living. I think people who are making content to be sold understand that [the terms of service are] part of making content to be sold."

Point being, if you make VR content for Oculus — and there's a community of people doing this in Canada — these terms may not be ideal, but they're part of doing business.

What's the bigger issue here?

It illustrates the fact that a lot of us agree to terms of service without really reading them.

And according to Avner Levin, the myth that we all read and understand the terms of service before we click "agree" works well for companies, but not so well for individuals. Legally, he says, it's an agreement.

"But it's not really our agreement in any meaningful way," he said. "It's simply taking the ability from us to complain down the line, in legal terms, about these potential uses."

So beyond the specifics of the Oculus Rift terms of service, the message here is that we should pay closer attention to the things we agree to online — especially if it involves always-on body-tracking that's hooked up to an ad network.

• Virtual reality: The difference between a $20 and $1,100 VR headset
• TED 2016: Virtual and augmented reality steal the show