Community Discussion: Privacy and Accessibility

Overview

This 90-minute community discussion, hosted by XR Access and the XR Association, explored the complex intersection of privacy and accessibility in XR technologies. The conversation featured two main speakers followed by an open community discussion about the tensions between leveraging beneficial technologies and protecting user privacy.

Featured Speakers

Alex Ambrose – Policy Analyst at the Information Technology and Innovation Foundation (ITIF)

• Focus: AR/VR policy, children’s online safety, and privacy
• Presentation topic: Virtual characters, avatars, and children’s experiences

Brendan David-John – Assistant Professor of Computer Science at Virginia Tech

• Focus: VR, eye tracking, and privacy-preserving technologies
• Presentation topic: Privacy challenges in eye tracking and XR systems

Key Themes and Issues

Children’s Vulnerability in Virtual Spaces

Alex outlined three primary reasons children are particularly at risk:

1. Cognitive Development: Children struggle to distinguish between real and imaginary experiences, making them more susceptible to manipulation by virtual characters
2. Brand Relationships: Children develop stronger parasocial relationships with virtual characters and maintain brand loyalty from childhood into adulthood
3. Privacy Understanding: Children’s comprehension of privacy evolves with age, and they’re more likely to share personally identifiable information

Eye Tracking Privacy Concerns

Brendan presented research showing that eye tracking data poses significant privacy risks:

• Biometric Identification: Raw eye images contain iris patterns that can be used for authentication, essentially revealing users’ “passwords”
• Behavioral Re-identification: Gaze patterns themselves are unique enough to identify individuals from datasets of 100-200+ people
• Manipulation Potential: Eye tracking data can be used to manipulate user perception and decision-making through targeted visual cues

Bystander Privacy Challenges

The discussion highlighted emerging concerns about recording others without consent:

• Smart Glasses Recording: Meta Ray-Ban glasses and similar devices can record continuously with minimal visual indicators
• Assistive Technology Needs: Blind and low-vision users may need these recording capabilities for navigation and assistance
• Social Consent: The challenge of obtaining meaningful consent from people being recorded in public or private spaces

Policy and Technical Solutions Discussed

Regulatory Approaches

• No Fakes Bill: Proposed federal legislation creating property rights over voice, appearance, and likeness
• COPPA Updates: Including voice recognition and biometric data in definitions of sensitive personal information
• State-Level Action: Four states now classify neural data as sensitive personal information

Technical Solutions

• Privacy-Preserving Eye Tracking: Applying blur filters to eye images to prevent iris identification while maintaining gaze tracking functionality
• Bystander Protection Systems: Automatically blurring faces in video streams unless explicit consent is given
• On-Device Processing: Keeping sensitive data processing local rather than sending to cloud servers
• Low-Resolution Cameras: Using purposefully degraded image quality for navigation assistance without compromising privacy

User Interface Approaches

• Visceral Notice: Making data collection visible through interfaces (like floating eyeballs showing where users look)
• Simplified Consent: Moving beyond complex privacy policies to more intuitive notification systems
• Usability-First Design: Building privacy protections that don’t hinder the user experience

Open Questions and Challenges

Trust and Verification

• How can users trust organizations claiming data won’t be stored?
• What role could third-party auditing systems play in verifying privacy claims?
• Should there be standardized privacy certification processes?

Consent in Public Spaces

• When is consent required for recording others with assistive technologies?
• How do we balance accessibility needs with bystander privacy?
• What constitutes meaningful consent in XR environments?

Age Verification and Safety

• Can biometric data (eye tracking, gait, height) be used to verify age without compromising privacy?
• How do we protect children while maintaining family device sharing?
• What are the implications of marking users as requiring accessibility features?

Spatial Data Privacy

• How should 3D environmental mapping data be classified and protected?
• What happens when spatial maps contain sensitive location information?
• How do we enable helpful navigation assistance without security risks?

Community Insights

Participants raised several practical concerns:

• Parental Understanding Gap: Many parents don’t understand the virtual environments and economies their children participate in (Roblox, VRChat)
• AI Companions: Children are forming relationships with AI chatbots based on fictional characters
• Dark Patterns: Gaming platforms use manipulative design to encourage spending, particularly affecting children
• Accessibility Barriers: Some privacy-preserving technologies may inadvertently exclude users with disabilities

Next Steps and Resources

The discussion highlighted several areas for continued work:

1. Standards Development: Active participation in groups like the Metaverse Standards Forum’s accessibility and privacy working groups
2. Policy Advocacy: Engaging with policymakers to ensure privacy regulations account for accessibility needs
3. Research Collaboration: Continuing research on privacy-preserving technologies that maintain functionality
4. Community Education: Helping parents and users understand the privacy implications of XR technologies

Key Takeaways

The conversation reinforced that privacy and accessibility don’t have to be mutually exclusive, but achieving both requires:

• Proactive Design: Building privacy protections from the ground up rather than as afterthoughts
• Community Input: Including diverse voices, especially from disability communities, in technology development
• Policy Innovation: Creating new regulatory frameworks that address both privacy and accessibility needs
• Technical Innovation: Developing privacy-preserving technologies that maintain essential functionality
• User Education: Helping people understand both the benefits and risks of these powerful technologies

The discussion emphasized that while there are more questions than answers currently, having these conversations is crucial for developing responsible XR technologies that serve everyone safely and equitably.

Chat History

00:10:22 Christy Stehouwer: Academic Advisor at MSU for the Experience Architecture (XA) program under Casey McArdle. Hieee!
00:11:23 Dylan Fox: Reacted to “Academic Advisor at …” with 👋
00:11:52 Fireflies.ai Notetaker Farzad: Talk to Fireflies: (Web-search enabled) • Say: Hey Fireflies how can you help? • Type: /ff help to get started. View Realtime notes here: https://app.fireflies.ai/live/01K5BAQWWMJS4V2Z2QY9TR0AQ6?ref=live_chat
00:13:31 Thomas Logan: Hi Thomas from NYC looking forward to the conversation, no q’s yet just curiosity
00:13:34 James Spann: Hi all! I’m James Spann, PhD Candidate at the University of Rochester! I think this will be a great opportunity to learn about the expectations of privacy but also how we can assert these efforts in “in the wild” envionmnets
00:13:43 Gérard Chollet: I’m a member of https://mpai.community/
00:15:04 John Murray: Hi all, I’m calling from UCF (about to drive, so wont be on video). Working on the VERA project and want to be sure we include all the best practices.
00:21:02 Christy Stehouwer: sorry for that unmuted cough. :/
00:21:52 Molly X. Gee von Holdt: Reacted to “sorry for that unmut…” with 🤗
00:22:22 Thomas Logan: Reacted to “sorry for that unmut…” with 🫁
00:30:48 Ali Haskins Lisle: I finally did a deep dive on what my 11 year old daughter is doing on Roblox and what these Robucks cards are going towards….omg….
00:31:34 Dylan Fox: Replying to “I finally did a deep…”

Oh yeah, Roblox is a jungle. And the creator economy is terrifically predatory
00:32:28 Brendan David-John: Replying to “I finally did a deep…”

Very interesting, would be interested to hear more as it comes to dark/deceptive patterns from content creators!
00:34:01 Thomas Logan: I think the wheelchair user’s avatar scenario could definitely be unlawful discrimination under current disability rights law if it was the only method for engaging via a publicly posted government site used to access services
00:34:02 Dylan Fox: Policy questions from Alex:
How do we address digital influencers/kidfluencers?
What level of user authentication and identity verification are necessary for AR/VR?
How might the law treat users’ alteration of other users’ avatars, or creation of their own avatars that borrow someone else’s name and likeness?
If a wheelchair user’s avatar is unable to access a virtual building, would that constitute unlawful discrimination under disability rights law?
Are inferred data points about a user a good thing? And what does that mean for children (especially with their cognitive development, what happens to the sense of self?)
00:35:17 James Spann: Go tigers!
00:43:44 Thomas Logan: Massive Attack just did this at their concert https://www.gadgetreview.com/massive-attack-turns-concert-into-facial-recognition-surveillance-experiment
00:49:37 Brendan David-John: Reacted to “Go tigers!” with 🐯
00:50:32 Brendan David-John: list-serv for those interested, if you want to join feel free to email me at bmdj@vt.edu or follow the instructions here: https://bmdj-vt.github.io/listserv
00:52:45 Susan Hirsch: Reacted to “Massive Attack just …” with 😲
00:56:38 S Montgomery: Great to see you Thomas!
00:58:00 Dylan Fox: For Humanity:
https://forhumanity.center/
00:58:28 Asif Uz Zaman Asif: Hi, I am Asif from CSU. My question is there anything that can be done to improve the policies for XR?
00:59:02 Brendan David-John: An interesting case study on Amazon smart speakers: https://alexaechos.com/

A formal audit system would be very interesting at algo level within a company!
01:00:13 Dylan Fox: Replying to “Hi, I am Asif from C…”

Hi Asif. Can you be more specific?
01:05:01 Asif Uz Zaman Asif: Replying to “Hi, I am Asif from C…”
I think privacy policies are the starting point for users to know what types of data will be collected and how it will be used, maybe present privacy policies in a different way which is not complicated/convoluted and help to raise users awareness. So just wanted to know if there is room for improvement when writing the policies?
01:06:02 Ali Haskins Lisle: The problem is my 11 year old is taller than me 🙁
01:06:07 Brendan David-John: Reacted to “The problem is my 11…” with 🤣
01:06:14 Thomas Logan: Reacted to “The problem is my 11…” with 😂
01:08:48 Brendan David-John: We’ve explored some alternative ‘consent’ approaches and ways to make users aware of what data from a sensor (in this case eye tracking) can do w/ the some success, but link to policy as a clear recommendation, or a practical alternative that would be accepted by industry, is not yet there: https://bmdj-vt.github.io/project_pages/privacy_notice
01:09:32 Ali Haskins Lisle: I think one of the challenges with protecting kids is many parents are not even speaking the same language. They have no idea why their kid is upset that the avatar they bought on gum road got ripped in VRC
01:10:37 Alex Ambrose: Reacted to “I think one of the c…” with ‼️
01:11:05 Ali Haskins Lisle: I think one of the challenges with protecting kids is many parents are not even speaking the same language. They have no idea why their kid is upset that the avatar they bought on gum road got ripped in VRC
(Or why their kid probably shouldnt be running around public instances in VRC)
01:12:14 Alex Ambrose: Replying to “I think one of the c…”

Totally! Was just listening in to Common Sense Media yesterday and they found 4 out of 5 teens use AI but only 37% of parents knew about it.
01:13:41 Ali Haskins Lisle: Replying to “I think one of the c…”

My daughter had an AI boyfriend based on a cartoon character she was “texting with”…like this stuff is insane and it’s hard to keep up with it and lock it down
01:14:02 Ali Haskins Lisle: Replying to “I think one of the c…”

From cookie run kingdom. Shadow Milk Cookie. No, I don’t understand
01:17:19 Alex Ambrose: Replying to “I think one of the c…”

Yeah AI companions are going to be a huge issue–I’ve got some pieces on our website if you’re interested in the policy side! https://itif.org/publications/2024/11/18/policymakers-should-further-study-the-benefits-risks-of-ai-companions/
01:17:41 Susan Hirsch: Reacted to “Yeah AI companions a…” with 👍
01:17:48 Thomas Logan: Reacted to “Yeah AI companions a…” with 👍
01:17:51 Ali Haskins Lisle: Reacted to “Yeah AI companions a…” with ❤️
01:18:40 Molly X. Gee von Holdt: Reacted to “Yeah AI companions a…” with ❤️
01:20:26 Thomas Logan: We did an article about that case https://equalentry.com/accessibility-oklahoma-mobile-id-app-court-case/
01:20:36 Ali Haskins Lisle: Reacted to “We did an article ab…” with 🎉
01:20:40 Brendan David-John: Somewhat related work on how standard assumptions for VR eye tracking can even fail for certain vision conditions, so making some of these platforms accessible is still an issue as well: https://dl.acm.org/doi/abs/10.1145/3736413
01:21:18 Ali Haskins Lisle: Reacted to “Somewhat related wor…” with 🎉
01:21:20 Alex Ambrose: Reacted to “We did an article ab…” with 👍
01:21:34 Thomas Logan: Reacted to “Somewhat related wor…” with 🎉
01:21:38 Molly X. Gee von Holdt: Reacted to “Somewhat related wor…” with 🎉
01:23:14 Thomas Logan: Get them to sign your 200 page legal disclaimer 😄
01:35:17 Brendan David-John: https://www.lynx-r.com/pages/privacy-by-design
01:36:16 melanie royster: Thank you, everyone!
01:36:45 Dylan Fox: Metaverse Standards Forum: Accessibility Working Group
01:38:02 Dylan Fox: https://xraccess.org/slack
01:38:13 Joseph Doan: Maybe there should be some organic movement to implement a requirement for developers to incorporate a mechanism in which devices like the Meta glasses would disable video data gathering/recording if a universally adopted mark is detected.
01:38:50 Joseph Doan: Similar to how some facilities have posted signs indicating recording devices may not be used in the space.
01:38:52 Alexandra Mattos: thanks all!
01:38:56 Molly X. Gee von Holdt: Thank you!
01:38:58 John Murray: thanks all!