Security in VR and the Metaverse

July 25, 2024

When you put on a new pair of virtual reality goggles, you may expose yourself and others to new privacy and cybersecurity risks.

A rising body of research suggests that the sensors used by VR goggles and augmented reality glasses may collect more data than your smartphone. This includes specific location data and how the user’s body moves. In fact, a typical VR device measures points of interest on the user’s body 60-144 times per second.

These risks contrast with the way many users envision using the metaverse: a world where they can explore anonymously through avatars and online personas. However, the data collected there can be used to identify users’ real-life identities.

“AR and VR devices collect a lot of information during operation,” said IEEE Member Ralf Ma. The data collected by the sensors can be divided into environmental and biological data. Both types of data are very sensitive and are closely related to personal privacy. Any leakage of data can lead to a breach of personal privacy and even threaten personal safety. The biggest privacy risk associated with the collection of sensor data is, therefore, data leakage.”

Hidden Privacy Pitfalls

Here’s a list of the potential privacy and security concerns raised by the use of AR and VR.

Bystander Privacy: When someone uses augmented reality devices in public, they may collect data about bystanders. These people may not know they are being recorded or may not have been granted permission.

Pervasive Data Collection: AR and VR sensors may collect the sound of your voice through the microphone, access lists of your contacts, the AR and VR services you use, what you do when you visit those services, and even what your eyes focus on when you use an AR and VR device. This sort of data collection is so robust that there’s concern people might be able to recognize real-life friends and acquaintances based on the way they move in the virtual one.

Advertising and Marketing Risks: Advertisers could collect data on your habits and use that information to convince you to buy products. That’s a natural extension of the advertising we see on our smartphones. Two things extend the risk. First, advertisements could also follow you from the virtual world to the real world and vice versa, leading to privacy concerns. Second, next-generation AR and VR devices may collect biometric data such as what your eyes are looking at, pupil dilation and heart rate. That information could be used to make inferences about your emotional state, sharpening the ability of advertisers to target you.

Governance and Regulatory Challenges: Metaverse companies may gather and store massive amounts of data. They’ll have to figure out what to do with it, how to protect it from theft and how to follow data privacy laws globally.

Perceptual Human Rights?

One emerging aspect of privacy and security concerns in AR and VR is the idea of perceptual human rights. It’s the idea that pervasive use of AR and VR may alter a user’s sense of reality, and the degree to which content creators and developers in the space have a responsibility to the user.

“In some virtual worlds, digital expression is not under the complete control of each of its digital citizens,” said IEEE Senior Member Aiyappan Pillai. “The following rights appear fundamental: privacy, security, choosing one’s avatar and also the preferred virtual environment. So, you should be able to choose not to be seen, to restrict access by people you don’t want to have access to you, to build your online persona however you see fit given the rules of that virtual world and be able to choose which virtual worlds you participate in.”

Learn more: To dig deeper into the world of perceptual human rights, check out this article from the IEEE Computer Society.

Go Deeper: Do you want a better understanding of how AR and VR will be used at home, in business and around the world? The IEEE Learning Network has you covered. Check out “Practical Applications of Virtual and Augmented Reality in Business and Society,” a five-course program that covers applications in gaming, agriculture, manufacturing, urban planning and advanced communications systems.