With Facebook recently launching the Oculus Quest and Rift S—both of which rely on always-on cameras during use—we reached out to the company to learn more about what data is captured by the cameras and how it’s used.

There’s never a bad time to be skeptical about how your private information is being used by products and companies which gather information about you, but an especially good time is when using products that rely on always-on cameras during use. That’s the case with both the Oculus Quest and Rift S, both of which use an array of cameras for tracking the movement of your head and hands, and to offer a pass-through view of your surroundings.

While the cameras used with the original Rift present similar privacy concerns, it uses simple point-matching for tracking and does not map and store information about your physical playspace like Quest and Rift S.

By our reading, neither Oculus’ Privacy Policy nor Terms of Service specifically address how data captured or derived from the headsets’ cameras is used, stored, or transmitted, so we reached out to Facebook to get more insight. An Oculus spokesperson offered the following:

The sensors on Quest and Rift S are primarily used to create a 3D map of your environment, which helps locate your headset and controllers in a known space so Quest/Rift S can work and keep you safe. This data is processed on the headsets.

The only information we keep on our servers today consists of performance metrics that don’t contain any recognizable detail about your environment. These metrics help us improve [the inside-out tracking system]. We don’t collect and store images or 3D maps of your environment on our servers today—raw images are not stored anywhere, and 3D maps are stored locally on the headset for Quest, and on your local PC (where you have access to delete it) for Rift S. This makes it possible for Quest/ Rift S to remember the playspaces you’ve already set up in multiple rooms.

We’ll notify users if collecting this information on our servers is required for future VR experiences we provide on Quest and Rift S, for example, co-located multiplayer experiences. (That said, it’s worth noting there are a few scenarios when users can opt-in to providing this information today: For example, when livestreaming, a user can choose to stream passthrough footage and thus that footage may be stored off platform/on their streaming surface—similarly, when submitting a bug report to Oculus a user can elect to include passthrough footage if it’s relevant to the report).

Update (August 6th, 2019): Oculus offered some additional information on Quest and Rift S camera privacy:

  • Like the white LED on Quest, the blue LED on Rift S indicates when the headset’s cameras are active; this is a hardware function which can’t be circumvented with software.
  • If a hacker gains root access to Quest or the Rift S host system, it would be possible to access the cameras on the headsets (similar to a camera on a compromised smartphone or PC).
  • Third-party developers cannot access the headsets’ cameras in any way.

The spokesperson also noted that Oculus hosts a ‘My Privacy Center‘ where users can find more information about their privacy settings, including what information is currently stored about them [both links here require you to be logged into your Oculus account].

The key takeaways from Oculus’ statement is that the data captured by the cameras is being processed locally for tracking, and that 3D maps of your environment are not being transmitted or stored on a server. They explicitly say that raw images (camera footage) is not stored anywhere (even on the local headset or host machine).

Oculus has also told us previously that cameras on Quest cannot be active without the white LED at the top of the headset being illuminated, so at a minimum it would be easy to see at a glance if the cameras were activating surreptitiously.

SEE ALSO
Privacy in VR Is Complicated and It'll Take the Entire VR Community to Figure It Out

While it’s good to have these confirmations from Facebook on the record, the use of the word “today,” makes it clear that the company is not ruling out anything in the future. Indeed, Facebook’s privacy strategy for Oculus generally seems to be to commit to as little as possible in order to not limit what might be done in the future, and to be as broad as possible to maximize legal wiggle room. That means that that VR community needs to be diligent about analyzing privacy policy updates in order to ensure that privacy is not eroded over time.

This article may contain affiliate links. If you click an affiliate link and buy a product we may receive a small commission which helps support the publication. See here for more information.


  • namekuseijin

    people should be used to the fact that there’s no privacy anymore. There’s eyes and ears everywhere, in the streets, in the buses, in your hands – there’s always a camera around that may be inadvertdly capturing yours or others’ slice of lives. just get used to it, or go live in a cave… but my gut feeling is that we’re all naked and exposed and the ones in power are lying and that’s just how it is.

    but at the very least, most are just too irrelevant to be worth any spying so it’s no big deal really… what possible profitable information can they gather from me playing VR in underwear? nothing really, even if it were Trump himself… I think cameras in phones are far more a privacy threat than ones in VR headsets…

    • I hear what you’re saying, but depending on where you use your headset, there’s a wealth of information to be gained: What products you own, how many family members you might have, where you live, etc. What’s even worse is that if that data is sold to third parties, it could end up in the hands of criminals. There’s so many different uses for this data, and such value to be gained from its sale that it’s shockingly hard to predict just how vulnerable it makes you. That’s why it’s so important to take data collection seriously, and (where possible) to support companies that make strong commitments to avoiding it altogether.

      Unfortunately, while I like Oculus on its own, Facebook has lied so many times about how its used (and lost) our data that it can’t be trusted anymore.

      • Rudl Za Vedno

        Yes, it could end up in the hands of criminals called NSA, CIA, FBI, MI5… All have been known to have special contracts with Amazon, Google and FB… I don’t trust them a bit especially when reading report of “European Commission’s attorney Bernhard Schima who told the Court of Justice of the European Union (CJEU) that the US-EU Safe Harbor framework does not work.
        The framework process supposedly protects personal data. In 2013, however, it was discovered the NSA and its British counterpart — the GCHQ, short for Government Communications Headquarters — had siphoned off data transfers by tapping directly into under sea cable networks.
        In fact, according to a lawyer representing the Austrian government before the CJEU, Safe Harbor is better suited for pirates than the protection of data of EU citizens. In other words, the system was designed to be hijacked by the NSA and GCHQ.
        “You might consider closing your Facebook account if you have one,” Schima told attorney-general Yves Bot at the European Court of Justice in Luxembourg.”

        • asshat

          well they also have some good reasons to want to monitor international data, and some good results from doing so. spying on under sea cables is on the opposite side of the spectrum as local in home spying that would happen with a devices.

          the fact that the quote goes from under sea tapping to FB is just ridiculous and unrelated. For one, theyre not looking at fb data that way and two you guys are forgetting with social media and fb, you have to upload it yourself in the first place. You literally put it in the ocean of the internet, thats on you.

          • Rudl Za Vedno

            I don’t use social media and when I do, I use VPNs and Thor.

      • Rogue Transfer

        It’s worth noting that Oculus is no long an individual entity or even a company since last year after the CEO left, when Facebook dissolved it and put it under Facebook’s Portal chief of the Facebook AR/VR division in Facebook Technologies LLC.

      • Peyton Lind

        The FBI, CIA, NSA and other government agencies are spying on everyone. I for one am more concerned about the government spying on me than some tech company. A tech company maybe sells my info so they make money off me. A government can decide to ruin my life if they deem I am not getting in line like they want.

        • asshat

          so who and why would someone from the government ruin you or any random person? compared to a company who wants to get at you for advertisement or your money.

        • James H.

          So … what makes you think facebook wouldn’t sell your information to a government?

      • namekuseijin

        I’m sorry, but didn’t you guys volunteer to explicitely tell facebook how many family members and related folk you do have and what your favorite hobbies, music and books are? face it: you gave them this information long ago and it’s publicly available to anyone with a facebook account – no need to try to sort out data from video feeds, you yourself did it!

        any dangerous criminals have already stole your house and murdered your family?

        sorry, but this whole reasoning is paranoia

        • Jistuce

          Actually, I don’t have a facebook account. In part because the company is basically “creepy stalker as a business model”.

          • James H.

            Excellent way to put it! Let’s not forget that Facebook literally started as a “Hot or Not?” style site, and that Zuckerberg called its users “dumb f_cks,” for trusting him!

          • Jistuce

            Well, in fairness… he’s not wrong. I’d call facebook’s users dumb effs for trusting Zuckerberg too.

        • Trenix

          What about the information shared via private messages. You think that isn’t being used?

    • Suitch

      Imagine taxes laying out and having your social and all the information required to steal your identity. The Rift S and Quest are used in homes, and homes can expose very high levels of private information. Also, I am sure that at least a few want to know if it will save first-person lewd pictures to their servers.

      • JohnnyBravoo

        Damn, I always do my taxes and take pictures of my social security right next to my Rift.

        • Suitch

          How cute that you can’t interpret simple statements related to the topic at hand. To assist you, the pictures are not taken by the person, merely by using a headset in, perhaps, a household.

        • namekuseijin

          better run for your life, man. Best place to hide is in prison. go steal some toothpaste at the convenience store to secure your future…

      • dk

        meh absolutely no difference from a phone

    • sebrk

      One of the more stupid statements I’ve read here so far.

      • namekuseijin

        no hard feelings, caveman

    • crim3

      It’s not as much a privacy concern. The problem lies in that user data has become the 21st century oil bussines. If a company is going to take something from me to make money with it, at the very least, they should ask for my explicit permission. And secondly, I shouldn’t be forced to agree to share my data to use some product just because that product in some way allows the gathering of data. It should always be an option, not a requirement.

      • namekuseijin

        oh, you want your share of ad money, how cute. When you (used to) go into a store and a perceptive seller takes heed of what you’re looking after and makes you recommendations upon your taste, you want a share of the man’s job too?

    • WyrdestGeek

      We can acknowledge that, that’s how it is, but that doesn’t mean we should give up on demanding that it be better.

  • Grey Lock

    To be honest, the statement from Facebook/Oculus seems straight forward and makes sense.
    That said, I still think the law should require policies like this just in case someone at Facebook decides to change their minds and start storing our images and 3D maps of our homes.

    • Chuck Griggs

      Your avatar looks like an ED commander. 07

  • doug

    Good journalism!

  • “TODAY” is the key of all the statement

    • fdad

      The devil is in the details.

  • Adderstone VR

    Companies should start being truthful and open about what you are opting in to.
    Instead of a popup saying
    “In order to offer you a better experience – this app need permission to access your camera”
    Make the popup read
    “We want permission to access your camera so that we can analyze your facial expressions and sell that information to a third party in order to advertise to you more effectively”

  • Jistuce

    “We don’t collect and store images or 3D maps of your environment on our servers today- but now that you mention it, that’s a good idea and we’re putting the software team on it.”

  • Skippy76

    Another reason not to buy the Rift Shit or the Quest.
    Its ovious that any day now they’ll throw a switch on that will record all your conversations and start populating your facebook page with tons of adds related to your surroundings and conversations

  • WyrdestGeek

    We already know not to trust anything Facebook says regarding privacy.

    Four years from now, Facebook will “discover” that while their cameras were *technically* not recording anything, their headset was “accidentally” sending detailed biometric data to any advertiser that’s ever done business with them.

  • Trenix

    You know what’s weird? Facebook, a social media company, buys out Oculus, throws out the founders, and attaches cameras to the headset. This is the same company that was just fined $5 billion for privacy violations. You think they truly care about your privacy? You must be an idiot if you think so.

    • MeowMix

      Only Palmer was thrown out.
      Iribe quit and Mitchell is still there.

      • Trenix

        You spoke too soon, Mitchell is also departing. Now you should be worried.

  • JesuSaveSouls

    They use the cameras to familiarize the ai lifelike androids that will replace all humanoids that won’t conform.

  • Rudl Za Vedno

    “We don’t collect and store images or 3D maps of your environment on our servers today

    What about tomorrow, the day after ect. This legally not biding statement, keeping doors open to potential changes of privacy policy in the future. FB is data mining company, selling your personal data to the highest bidder. I wouldn’t trust them with anything. Same goes for Google, Amazon etc.

  • Jeffrey Sachse

    Does anyone here really feel self important enough that they believe any of their “data” would be of any real value aside from some gaming metrics? No one, not even Facebook, really cares if you play Beat Saber in your boxers and neither does anyone else really. You are on more cameras when you go anywhere these days than you could possibly imagine, and you know what, I don’t care and it won’t affect me.

    • asshat

      I remember when i was as ignorant as you, good time.

      https://www.youtube.com/watch?v=cy-9iciNF1A

      Its not about gaming metrics, its about any data they can get and using it any way they can.

      • Jeffrey Sachse

        So if you had access to my data, and saw me playing Beat Saber in my boxers, how exactly are they going to manipulate that data into something nefarious. I’d like to hear your opinions.

        • asshat

          lol easy, id listen to every conversation you have in your house until you say something that gives away financial information. thats an easy one.

          Also all the other statistics they pull can be endless from things like your height, body type, how long you can play, when you play, etc. this all seems like random useless data, and mostly is, but smart people can rearrange it and sell it, and others can then use it to advertise select things to you or people like you or in your area and change your perspective on something.

          This has the potential to be dangerous. and if a simple facebook survey can cause this much political damage, who knows what these kinds of devices can do.

          • Pablo C

            You are correct they can use this info in multiple ways, but mostly, to influence your political and economical view (like targeted publicity does). Both of those influences though, can be counteracted by simply thinking: Is this what I really want?
            So I agree they are spying on us, but as the guy above said, it´s limited, and it might work mostly on the less cultured, which are anyway, also the ones that don’t care at all about anything, politically or economically. The real problem happens in the US, where companies have too much power and where there are too many uncultured people that still have a lot of money. Those two factors together, happen pretty much only in the US. May be in the UK as well. In most countries, if you are not cultured, you won’t have enough money to get a VR system, you’d barely know what VR is.

          • asshat

            the issue is greater than VR. you’re mostly right aside from it being US only, This same team is working behind Brexit right now and have come forward about other countries political events theyve messed with. And you say these can be thwarted by simply thinking but others arent like you and I and they dont use common sense.

            Watch the Great Hack on netflix, its a great documentary that covers this and explains very well why this is a LOT larger than america. Its the worlds democracy(or any system of government) being undermined by target propaganda tactics and mass population idea manipulation.

            good chat though! everyone needs to know what we both know

          • Pablo C

            Thanks, I´ll check out that in netflix. You are right that this covers more than the US. It´s just that in the US (and the UK) it seems to have the most serious and permanent impacts. Because i.e. Brazil might also have been victim of this, and they chose Bolsonaro as president. And that’s a big deal. However, knowing how poor countries work, Bolsonaro will mess it up, and Brazil will elect a completely different leader after him. On the other hand, the US and the UK, seem to keep going right, non stop.

  • brandon9271

    Front-facing cameras so Zuckerberg can watch you masturbate.

    • Rudl Za Vedno

      Yep, Zuck’s dreams finally materializing :)

      • Jerald Doerr

        Wondered why his eyes are so big!

  • The Bard

    How about yesterday or tomorrow?

  • WyrdestGeek

    “Move fast and break things.” — like customer trust.

  • ShiftyInc

    If you are so worried about a company having this kind of access. then you should not be anywhere near any electricle device. Like your phone for example or you TV that has build in cameras as well.