Vetting Privacy Policies in VR: A Data Minimization Principle Perspective

Virtual Reality is thought to be the prototype of the next-generation Internet, consisting of more I/O devices and interactive methods than traditional mobile systems. Hence VR developers need to inform users what data is collected and shared, which is generally conveyed by privacy policies. Existing research has examined the consistency between the VR app's privacy policy and its corresponding actual behaviors. However, few studies paid attention to the data minimization principle, i.e., whether a privacy policy claims to collect no more data than it practically needs to implement the app's functionalities. In this poster, we targeted a mainstream VR platform and analyzed the data minimization principle compliance of privacy policies for all 1,726 VR apps in this platform. Experiment results show that 48.1 % VR apps potentially violate the data minimization principle. Moreover, the comparative experiments reveal significant differences in the distribution of data collection between VR and non-VR apps.