How secure is data in virtual reality?

Data security in virtual reality (VR) covers two areas: the security of your project data and the personal user data that a VR headset collects. With a carefully chosen development partner, data minimization and the right choice between online and offline use, both can be well protected.

VR offers many benefits, whether for product presentations, training or simulations. But that raises a question: how secure is the data being processed?

1. Security of the VR app’s project data

The development team usually gets access to sensitive project data. That’s why you should choose your development partner carefully. After all, any company can potentially be hacked. But there are security measures you can take to protect sensitive data. Before the project starts, ask the development team to explain how they handle IT security and how they will protect your project data.

Large corporations routinely carry out due diligence, in which they examine their suppliers closely. We have been through many of these reviews. They are time-consuming and demanding, but given the growing cybersecurity risks, they are ultimately necessary and the right thing to do.

1.1. Keep data to a minimum

A VR application usually doesn’t need all the data that is available in the raw data. So the client should provide only the data that is actually needed. With CAD data, engineers should remove all sensitive information (such as patented components or trade secrets) before handing it over to the VR team, if those details are not relevant to the project. This reduces the risk of confidential details accidentally finding their way into the VR application.

1.2. Online or offline use

VR apps can run online or offline:

• Offline: All project files are stored on the device. This protects the data against outside attacks.
• Online with local project data: Multiplayer applications store the potentially sensitive project data locally on the device, and it is not transmitted over the internet during use. Users of such a VR application can hear and see each other, however, and interact with the app’s components (such as machine parts). But only voice, avatar movements and a few control signals are transmitted, not project data.
• Online with cloud data: Some applications load content on demand, which means project data is also transmitted over the internet. This could be user data or 3D models, for example. Apps of this kind must be developed with particular attention to encrypted connections and data protection.

2. Collection of personal user data by VR headsets

VR headsets do collect personal data such as eye and head movements or voice recordings. But as long as this data is not analyzed by an app, there is generally no potential for misuse. The development team can use this data in your app for certain purposes, such as controlling the simulation, but (unless agreed otherwise) the data is not stored or transmitted. The manufacturers do collect data themselves, however, and to different extents. According to its own information, Meta collects, among other things, the position of the headset and controllers, the dimensions of the room, and which apps are used and for how long, and it also uses such data to improve its own products. According to its privacy policy (in German), PICO collects sensor data on the face, hands, voice and movements to provide and improve its services, but rules out using it for marketing. According to Apple, the Vision Pro processes eye-tracking data and room scanning on the device only. We are not aware of manufacturers passing such data on to third parties without consent. As long as the apps on the VR device do not specifically process the data, it remains largely unused and secure.

Conclusion

There are two main areas of data security in virtual reality: protecting sensitive project data and protecting personal user data. Project data is secured through encryption and general cybersecurity measures. Personal data such as movement and voice data is processed by the app and, depending on the device, also by the manufacturer. What the app does with it is under the control of us as developers, and therefore under yours as the client. What the manufacturer collects depends on the device settings and the choice of model. Still, keep in mind that VR headsets are technical devices too, and like PCs, smartphones and tablets, they can and should be protected. We are happy to advise you and go into the details with your IT department.