VR ProfiLens: User Profiling Risks in Consumer Virtual Reality Apps

2026-01-18

AI Summary

This study addresses the underexplored privacy risks in consumer virtual reality (VR) applications, where abstracted sensor data may inadvertently leak sensitive user attributes without explicit consent. To systematically investigate this issue, the authors propose VR ProfiLens, a novel framework that establishes the first risk classification system for user attributes grounded in the California Consumer Privacy Act (CCPA). Leveraging sensor data from four modalities collected across ten popular VR applications and corresponding user survey responses, the work employs machine learning inference, feature correlation analysis, and privacy risk assessment to evaluate the feasibility of inferring sensitive attributes from abstracted data. Experimental results demonstrate that certain sensitive attributes can be accurately reconstructed—with F1 scores reaching up to 90%—highlighting significant privacy leakage risks in VR environments. The study further quantifies how application categories and sensor combinations influence leakage severity, offering actionable recommendations for enhancing transparency and regulatory oversight.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Bias, Fairness & Privacy
• Philosophy and Ethics of AI: Privacy & Security

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Virtual reality (VR) platforms and apps collect user sensor data, including motion, facial, eye, and hand data, in abstracted form. These data may expose users to unique privacy risks without their knowledge or meaningful awareness, yet the extent of these risks remains understudied. To address this gap, we propose VR ProfiLens, a framework to study user profiling based on VR sensor data and the resulting privacy risks across consumer VR apps. To systematically study this problem, we first develop a taxonomy rooted in the CCPA definition of personal information and expand it by sensor, app, and threat contexts to identify user attributes at risk. Then, we conduct a user study in which we collect VR sensor data from four sensor groups from real users interacting with 10 popular consumer VR apps, followed by a survey. We design and apply an analysis pipeline to demonstrate the feasibility of inferring user attributes using these data. Our results show that sensitive personal information can be inferred with moderately high to high risk (up to 90% F1 score) from abstracted sensor data. Through feature analysis, we further identify correlations among app groups and sensor groups in inferring user attributes. Our findings highlight risks to users, including privacy loss, tracking, targeted advertising, and safety threats. Finally, we discuss design implications and regulatory recommendations to enhance transparency and better protect users'privacy in VR.

Problem

• virtual reality
• user profiling
• privacy risks
• sensor data
• personal information

Innovation

• user profiling
• VR sensor data
• privacy risk
• personal information inference
• virtual reality privacy