VR ProfiLens: User Profiling Risks in Consumer Virtual Reality Apps

TL;DR

This paper introduces VR ProfiLens, a framework that demonstrates how VR sensor data can infer sensitive user attributes, revealing significant privacy risks and informing better privacy protections in consumer VR applications.

Contribution

The paper presents a systematic framework and empirical analysis showing high accuracy in inferring personal attributes from VR sensor data, highlighting privacy risks in consumer VR apps.

Findings

Sensitive personal info can be inferred with up to 90% accuracy.

Correlations exist between app groups, sensor data, and user attributes.

VR sensor data poses significant privacy and safety risks.

Abstract

Virtual reality (VR) platforms and apps collect user sensor data, including motion, facial, eye, and hand data, in abstracted form. These data may expose users to unique privacy risks without their knowledge or meaningful awareness, yet the extent of these risks remains understudied. To address this gap, we propose VR ProfiLens, a framework to study user profiling based on VR sensor data and the resulting privacy risks across consumer VR apps. To systematically study this problem, we first develop a taxonomy rooted in the CCPA definition of personal information and expand it by sensor, app, and threat contexts to identify user attributes at risk. Then, we conduct a user study in which we collect VR sensor data from four sensor groups from real users interacting with 10 popular consumer VR apps, followed by a survey. We design and apply an analysis pipeline to demonstrate the feasibility of inferring user attributes using these data. Our results show that sensitive personal information can be inferred with moderately high to high risk (up to 90% F1 score) from abstracted sensor data. Through feature analysis, we further identify correlations among app groups and sensor groups in inferring user attributes. Our findings highlight risks to users, including privacy loss, tracking, targeted advertising, and safety threats. Finally, we discuss design implications and regulatory recommendations to enhance transparency and better protect users' privacy in VR.