Virtual Reality Privacy: Biometric Data Risks and UK Rules

Putting on a VR headset means handing over more personal data than almost any other consumer device you own. Eye movements, hand gestures, room layout and even heart rate can be recorded from the moment a session begins. Virtual reality privacy is no longer a niche concern for early adopters; it is a mainstream data protection question with clear answers under UK law, even where headset manufacturers have been slow to explain them.

This article covers what your headset actually collects, how UK GDPR and the ICO treat that data, what changes when VR is used at work, how the two leading headsets compare on privacy settings, and what is coming next for virtual reality privacy regulation. It ends with a practical checklist you can run through before your next session.

The Three Pillars of VR Data Collection

Every VR session generates far more data than a phone or laptop does, because the headset has to track your body and surroundings just to work. That data falls into three categories: biometric, spatial and behavioural, and understanding the difference is the first step towards taking virtual reality privacy seriously.

Biometric Data: Eyes, Hands and Heart Rate

Biometric data is information generated directly by your body. Modern headsets use inward-facing cameras to track eye movement, hand-tracking sensors to read finger position, and, in some models, a heart rate sensor built into the headstrap. Under UK GDPR, this counts as special category data once it is used to identify or uniquely recognise a person, which means it needs a stronger legal basis than ordinary personal data before a company can process it lawfully.

Meta’s own eye-tracking privacy notice explains that the headset analyses raw images of your eyes captured by the device to create what it calls “abstracted gaze data”. That abstracted data, rather than the raw images themselves, can then be shared with apps you grant permission to and used to animate your avatar’s expressions or improve rendering quality in the area where you are looking. Apple has taken a different approach with the Vision Pro, processing eye-tracking data locally and declining to share raw eye images with third-party developers, a design choice examined in detail by the technology publication IEEE Spectrum.

Neither approach removes the underlying privacy question: eye movement data, once aggregated over time, can reveal far more than where someone is looking. Pupil dilation and gaze patterns have both been studied as indicators of attention, emotional response and even certain health conditions, which is why biometric data from a headset deserves the same caution as biometric data anywhere else, and why it sits at the centre of most virtual reality privacy discussions.

Spatial Data: Mapping Your Home

To let you walk around safely without bumping into furniture, a headset scans your room and builds a three-dimensional map of your walls, floor space and larger objects, often referred to as a point cloud. This spatial data can reveal considerably more than most users expect: the approximate size of a home, the presence of children’s toys or medical equipment, and even an inferred sense of household income based on furnishings and room layout.

Unlike a smartphone camera, which is deliberately pointed at a single subject, a headset’s cameras remain active for the duration of the session, continuously recording the space around the user rather than capturing a single frame. That is one reason UK privacy guides increasingly treat digital footprint awareness as directly relevant to VR users and not just to people managing their presence on social media. A living room mapped once by a headset can, depending on how that data is stored and reused, tell a company a great deal about the person living in it.

Behavioural Data: What Your Reactions Reveal

Behavioural data covers how a person responds inside a virtual environment: where their attention lingers, how quickly they react to a prompt, and what makes them flinch, hesitate or look away. Because this data is generated continuously and without any deliberate input from the user, it sits closer to inference than to disclosure.

A person choosing to type a sentence into a search box is making an active decision about what to share; a person whose gaze lingers on a particular object for two extra seconds has revealed something about themselves without ever intending to. This is precisely why UK regulators have started paying closer attention to behavioural inference in immersive technology, treating it as a distinct category alongside biometric and spatial data rather than folding it into general usage analytics.

Virtual Reality Privacy and UK Law

VR headsets are sold and marketed globally, but UK users are protected by a specific legal framework that most headset privacy policies were not originally written with in mind. Two areas of UK law matter most for virtual reality privacy: the rules around biometric recognition and the Children’s Code.

UK GDPR and Biometric Recognition

The ICO’s biometric data guidance confirms that biometric recognition, defined as using biometric data to uniquely identify someone, counts as processing special category data under UK GDPR. The ICO illustrates this with the example of an employer offering staff an on-device face or fingerprint login as an alternative to a password: even though the recognition happens entirely on the device and nothing is sent to a server, it still requires a lawful basis, a clear explanation to the person involved, and appropriate safeguards around storage and deletion. The same principle applies directly to VR headsets that use eye or hand data to log a user in, verify their identity in a multiplayer space, or personalise their avatar’s expressions.

Following the Data (Use and Access) Act 2025, which received Royal Assent in June 2025, these obligations remain fully in force under UK law, and the ICO has continued to expand its scrutiny of biometric and AI systems through 2026 as part of its ongoing AI and biometrics strategy. Anyone building or buying VR software for use in the UK, whether for entertainment or for business, needs to treat headset biometric data with the same rigour as fingerprint or facial recognition data collected by any other device. Readers wanting the fuller picture of how UK GDPR applies beyond VR specifically can see our guide to UK GDPR requirements.

The Children’s Code and VR

The ICO’s Age Appropriate Design Code, commonly known as the Children’s Code, requires online services likely to be accessed by children to apply high privacy settings by default and to switch off geolocation tracking unless there is a clear and specific reason not to. The code applies to any UK-facing service that many children are likely to use, a definition that covers many VR platforms and social VR apps, regardless of whether children were the intended audience.

Meta has previously confirmed it is working with the ICO to align its VR products with the Children’s Code, after a campaign group found evidence of harassment involving under-18 users in a popular third-party VR chat app. The code’s core standards are worth knowing regardless of which headset a family uses: data collection should be kept to the minimum necessary, nudge techniques should not be used to persuade children to weaken their own privacy settings, and location tracking should default to off.

Parents supervising a child’s headset use should apply at least the same scrutiny they would to any other connected device, checking account settings before handing over a headset rather than afterwards. Our guide to safeguarding children’s privacy covers the specific settings worth checking first, many of which apply just as directly to VR accounts as to social media profiles.

Virtual Reality Privacy in the Workplace

VR is increasingly used for staff training, from health and safety simulations in manufacturing and logistics to remote meetings for distributed teams, and this raises a distinct set of employment-specific virtual reality privacy questions that consumer-focused coverage tends to overlook.

Employer-Provided Headsets and Employee Rights

When an employer issues a VR headset, the biometric and spatial data it collects becomes part of the employment relationship rather than a purely consumer privacy matter, and that changes the balance of power around consent. The ICO’s biometric recognition guidance sets out that even a low-friction, on-device biometric check introduced by an employer still requires a valid lawful basis, clear communication to staff about what is collected and why, and a genuinely proportionate approach, since employees rarely have a real choice to opt out of a tool their employer has already adopted for training or meetings.

A 2025 report from the International Labour Organization, summarised by the British Safety Council, found that immersive training technologies can improve engagement and knowledge retention, but flagged that wearable and monitoring tools used alongside them can increase workplace stress when staff feel they are being watched rather than trained, and that some employees suppress their genuine reactions specifically to preserve their own privacy during monitored sessions.

Employees asked to use VR at work are entitled to know what data the headset collects, who inside and outside the organisation can access it, and how long it is retained, in exactly the same way they would expect for any other workplace monitoring tool; this is simply virtual reality privacy applied to an employment context rather than a separate set of rules. Employers introducing VR training should document this clearly before rollout rather than leaving staff to find out through informal channels. Our overview of core cybersecurity principles sets out the wider governance questions worth asking before any new monitoring or tracking technology is introduced into a workplace.

Headset Privacy Compared: Meta Quest vs Apple Vision Pro

The two dominant headsets in the consumer market take noticeably different approaches to biometric data, and these differences are central to virtual reality privacy in practice, mattering more than most buyers realise when comparing specifications rather than privacy design.

Feature	Meta Quest	Apple Vision Pro
Eye tracking processing	Processed on-device; abstracted gaze data may then be shared with permitted apps	Processed locally; raw eye-tracking data is not shared with third-party app developers
Camera count (approximate)	Four external cameras on Quest 3	Twelve cameras, plus a TrueDepth 3D sensor and a Lidar scanner
Account requirement	Meta account required	Apple ID required
Use of eye data for advertising	Abstracted data can inform personalisation across Meta’s services	Apple states eye-tracking data is not used to serve advertising
Crash log retention	Crash logs may briefly include recent abstracted gaze data	Not publicly detailed to the same level in Apple’s consumer privacy materials

These figures come from Meta’s published privacy notices and from IEEE Spectrum’s reporting, which examined both companies’ approaches to camera data in detail. Other manufacturers, including HTC, publish their own privacy policies with different defaults and disclosures, so it is worth reading the specific notice for a headset rather than assuming every device behaves the same way simply because it looks similar on a shop shelf.

Ofcom’s own research into immersive technology found that 42 per cent of UK gamers aged 13 to 64 have played VR games using a headset, which means these differences in privacy design affect a considerable share of the UK public, not a small niche of technology enthusiasts. As headsets move further into everyday use for shopping, fitness and remote work, the privacy defaults set by manufacturers today will shape how much data is collected from millions of ordinary users for years to come.

The Future of VR Privacy

Two trends are likely to shape virtual reality privacy over the next few years. First, on-device processing is becoming the industry’s preferred answer to biometric concerns, since it lets manufacturers claim sensitive data never leaves the headset, even where abstracted or derived data still can. Second, UK regulators are treating AI and biometric technology as a single, connected policy area rather than as separate issues, meaning future ICO guidance on AI is likely to have direct implications for how VR headsets handle eye tracking, hand tracking, and emotional inference.

Anyone building VR products for the UK market should expect biometric recognition rules to tighten rather than loosen, and should treat current ICO guidance as a floor rather than a ceiling for future compliance.

How to Protect Your Virtual Reality Privacy

A handful of practical changes make a real difference to how much data a headset collects and shares, without limiting what you can actually do inside VR, and most of them take only a few minutes to work through once you know where to look for virtual reality privacy settings.

Run through this checklist before your next session:

• Turn off eye and hand tracking for individual apps that do not need them to function properly.
• Check room-boundary and camera permissions on a per-app basis rather than granting blanket access once for everything.
• Review your headset account settings for any option to limit data sharing with advertisers or third-party partners.
• Keep headset firmware and app software up to date, since privacy controls are refined with almost every release.
• Set up a separate, age-appropriate account for children rather than sharing an adult login or profile.
• Read the specific privacy notice for any feature that uses cameras, microphones or sensors, since these are often published separately from the headset’s main privacy policy.
• If you use VR for work, ask your employer directly what data your headset collects and how long it is stored.

For a wider view of how these individual settings fit into your overall online presence, our guide to managing digital privacy covers the same underlying principles across other connected devices, and our roundup of internet safety rules is a useful starting point if you are setting up a headset for the whole household.

Virtual reality privacy is not a fringe concern reserved for technology enthusiasts. It is a mainstream data protection question that UK GDPR and the ICO already address in reasonable detail, even where headset manufacturers have been slow to communicate the practical implications to everyday users.

Understanding what your headset actually collects, working through the checklist above, and treating a VR account with the same caution you would apply to any other connected device will do more to protect you than waiting for the industry to catch up on its own.

Frequently Asked Questions