Vision: Usable Privacy for XR in the Era of the Metaverse

Extended Reality (XR) — an umbrella term for Augmented Reality (AR), Virtual Reality (VR) and Mixed Reality (MR) — has penetrated the consumer market and is prone to increasingly impact our lives in the near future. Various devices, e.g., MR glasses, AR smartphones apps, or VR headsets, are becoming more affordable, and leader tech companies are heavily investing for a more immersive, realistic, and connected future. Lately, this vision of an interconnected virtual space for people to work, learn, play and share experiences with others has been formulated as the so-called “Metaverse”. This expected paradigm shift will heavily rely on XR, and hence implies an unprecedented amount of sensible data being collected about the users. Indeed, XR devices collect large amounts of sensitive data, including biometric data (e.g., eye gaze and body movement data) that are primarily used as Natural User Interfaces (NUIs) or for the proper functioning of technologies and services. However, research has identified a number of privacy and security threats rooting from this pervasive data collection, as well as privacy threats regarding XR inputs, outputs, user interactions and devices themselves. Still, further efforts must be made to guarantee the privacy and safety of users in a usable fashion in the future, and XR must be considered as a whole rather than as the sum of its parts to match the vision of the Metaverse. In this context, we propose to analyse the gap between user privacy perceptions in XR as a whole, and their concrete behaviour. The goal of this research is to understand the differences and similarities between AR, MR and VR in terms of user privacy perceptions. This will help us to better understand the relationships between XR variants, which, we argue, is an important requirement to approach the future evolution of these technologies, and to consider usable privacy aspects that match the entire XR spectrum. Adopting this vision early on will be beneficial for future work, and will be the foundation for the implementation of a usable privacy-preserving solution in order to raise awareness and empower users by giving them more control over their privacy in the context of these new and future technologies.