Meta’s new Quest Pro headset offers face-tracking, which allows your face to be read and makes VR more expressive. However, some experts say the new technology could share your most personal data.  “What makes this form of tracking more concerning from a privacy perspective is that it discloses not just physical information, but potentially emotions and thoughts,” Bud Broomhead, CEO of the cybersecurity firm Viakoo told Lifewire in an email interview. “Whether the movie “Minority Report” or Orwell’s “1984”, having this data gathered over time moves us closer to when thoughts can be criminal.”

A Better Headset

At $1500, the new Meta Quest Pro headset is far more expensive than previous models. To justify the cost increase, the Pro offers better displays and a faster processor. It also has technology for tracking your facial expressions.  As an example of how facial tracking works, Meta suggests a scenario in which you face a colleague during a presentation in a VR world. “As you turn to each other, you feel the spark of that idea as you lock eyes and smile in agreement,” the company writes on its website. “In Meta Horizon Workrooms on Meta Quest Pro, you can exchange meaningful eye contact, even if the two of you are working in far-flung company offices.” Meta said that the facial tracking features are built with privacy in mind. You can choose to turn on eye tracking and the ability to mimic natural facial expressions.  “Images your Meta Quest Pro captures of your eyes and face never leave your device and are deleted after processing,” the company writes. “This means that neither Meta nor third-party apps will have access to these images.”

The Price of Data

Not everyone is convinced that the Pro’s facial tracking will be benign. Broomhead said that “facial tracking data will be weaponized and used in cyber and cyber-physical attacks. The rush to commercialize and profit from this technology will be far ahead of efforts to make it safe and secure for users.” Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals, noted in an email interview with Lifewire that attention-tracking is not a new idea. He said it is common on the internet today to have your attention tracked and inferred when you’re interacting with websites and apps. Depending on how it’s deployed, session tracking technology can watch your mouse, see what you type in fields, and observe how you navigate a site. “What’s different about eye tracking is that our eye movements are even more automatic than how we move a mouse,” Zweifel-Keegan added. “Even if I don’t want to look at something, I often first have to look at it to know I want to avoid it. This is one step closer to measuring my thoughts.” Eye tracking is a key feature to best experience VR, Zweifel-Keegan said. Knowing where you are looking and how your attention is responding to the stimuli of the environment will help the experience of being in a virtual world seem more realistic.  “This also represents a holy grail for advertisers,” he added. “Knowing whether audience attention was captured by advertisements, and in what way, is information that could radically change the field.” But Zweifel-Keegan said that while the facial tracking technology in the Quest Pro is likely to become more ubiquitous, it won’t necessarily lead to privacy violations.   “Just like how session tracking on web browsers is generally used only for purposes of improving UI or aggregating usage information, eye-tracking data could be confined to specific usages that limit potential privacy invasions,” he said.  The key question for companies like Meta is how they will build their VR systems that contain eye-tracking data, Zweifel-Keegan said. The privacy of users might depend on whether third-party app developers get access to raw eye-tracking input.  “Will they know exactly how long the user looked at something throughout their use of the system?” he said. “Or will they have more binary information: the user looked here, or they didn’t? Or, will they simply have access to the inferences that are drawn about users’ behavior, in much the way that advertisers currently must rely on other companies to infer what users are interested in?