U.S. Privacy Laws Overlook Issues Raised by AR/VR Technologies, ITIF Report Finds

WASHINGTON—Augmented and virtual reality devices raise new risks for user privacy due to the scope, scale, and sensitivity of the information they collect. But America’s patchwork of data protection laws fails to address some of these privacy risks while unnecessarily over-regulating in response to others, according to a new report released today by the Information Technology and Innovation Foundation (ITIF), the leading think tank for science and technology policy.

ITIF warns against regulating AR/VR itself, arguing policymakers should instead take a technology-neutral approach of considering the types of information AR/VR devices collect and safeguarding users against actual harms arising from that data collection. The goal should be to encourage companies building AR/VR devices to continue innovating while protecting consumers. To that end, ITIF calls for clarifying, updating, and harmonizing existing rules and enacting comprehensive national data protection legislation.

“The unique challenges that AR/VR technologies present come from the risks of aggregating a high-volume of sensitive information and the difficulty of trying to adapt mitigation measures designed for other consumer technologies,” said ITIF policy analyst Ellysse Dick, who authored the report. “It’s precisely the immersive nature of AR/VR that makes it difficult to directly transfer existing privacy policies and practices from other digital platforms.”

The report explains that AR/VR raises new user privacy issues because it involves a number of different information-gathering technologies, each presenting unique privacy risks and mitigation approaches. Much of the information that AR/VR devices collect is sensitive data not used in other consumer technology devices—yet it is critical to the core functions of AR/VR. This requires innovative new approaches to transparency, choice, and security, for which ITIF offers a series of specific recommendations:

• Regulators should provide guidance and clarification on the ways existing laws apply to AR/VR devices and applications, such as the Health Information Portability and Accountability Act (HIPAA) and the Children’s Online Privacy Protection Act (COPPA).
• Congress should reform privacy laws, such as COPPA and HIPAA, in cases where they would unnecessarily limit the use of AR/VR technologies in certain sectors or by certain users.
• Congress and relevant rulemaking bodies should create rules to safeguard against the potential for harm that arises from new forms of data collection, such as biometric identification and personal information inferred from biometric data, through transparency and choice requirements.
• Lawmakers should enact federal privacy legislation to harmonize compliance requirements at the national level rather than rely on state-by-state and sector-specific regulations.
• Government agencies and industry should develop voluntary guidelines for AR/VR developers to secure users’ privacy through transparency and disclosure practices, user privacy controls (including opt-out mechanics), information security standards, and considerations for the unique risks presented by biometric identifying and biometrically derived data.

“AR/VR devices and applications offer a glimpse into a future that is more connected, adaptive, and rich in immersive experiences, but they also introduce a level of user data collection and privacy concerns that other consumer technologies have not,” adds Dick. “The complexities involved require equally nuanced approaches to mitigating the threats. Stringent reactionary measures could have the unintended consequence of stalling not just further innovation in AR/VR devices and applications, but also beneficial new approaches to user privacy in immersive environments.”

Read the report.