Meta removes Facebook account mandate from Quest VR—but is that enough? (original) (raw)
Op-ed: I welcome the removal of FB-VR mandate, but ToS still has me concerned.
Let's just see who you really are under that mask of a positive-sounding Facebook policy reversal... Credit: Hanna Barbera / Aurich Lawson
Let's just see who you really are under that mask of a positive-sounding Facebook policy reversal... Credit: Hanna Barbera / Aurich Lawson
Credit where credit is due: The Meta Quest virtual reality platform, previously known as Oculus Quest, will soon remove its obnoxious Facebook account mandate. As announced on Thursday, starting in August, both new and existing Quest headset users will be able to use the system's default operating system and digital download store without tying their "real-name" social media accounts to the service.
This is a good course correction of a bad decision. In 2020, I wrote at length about the dangers of VR's "Facebookening," which arose when the Quest VR platform dumped its existing Oculus account system in favor of required Facebook accounts. This decision forced a cross-pollination between VR headsets and years of social media posts and messages, including the cookies and metadata from connected sites and services. It demanded a level of "real name" compliance that we've never seen from other major Western computing devices and operating systems.
Worse, the move tacitly threatened anyone wanting to sidestep the rules by creating a dummy Facebook account. Facebook famously disallows aliases and fake names, and while it doesn't check for ID at account creation, it can lock accounts at any time if it detects "suspicious" activity. To unlock an account, the company will usually request some form of "official" photo identification. If someone converted their Oculus account to a name like "Guy Incognito" and got stuck in a lockdown state, Facebook was well within its rights (granted by its terms of service) to keep the account and all its associated software purchases locked away.
Awaiting a better look at FB decoupling
As announced, the new "Meta Account" system will correct some of these most glaring issues. But will it be enough?
It's hard to definitively answer this question. First, the new account system hasn't gone live, so we can't test one crucial aspect of the change. According to Meta, anyone who switched from an Oculus account to a Facebook-tied identity will be able to decouple all Facebook identity information while creating a new Meta Account starting in August.
We want to see what this update looks like: how software-purchase transfers will work, what notices may appear on affected Facebook accounts after the transfer, and how aggressive the company will be about asking Quest users if they're really sure they want to sever Facebook from their headset experience. (Meta has already indicated that it will let users attach Facebook and Instagram credentials if they want.) Facebook representatives have not answered our questions about these concerns as of press time.
There's also the matter of exactly what traces of Facebook user data may remain. This week, we're still reeling from a well-placed allegation, attached to a lawsuit, about Facebook's official policy to "undelete" seemingly deleted account data when requested by law enforcement agencies. A Meta spokesperson said the claims were "without merit," but even if that's true, we already know that Facebook has made users' sensitive data available to bidders and openly manipulated social media experiences for the sake of experiments. Facebook is in the business of harvesting as much user data as possible and keeping all relevant user records available for as long as possible—so much so that we've yet to find clarification about Facebook data decoupling from Meta accounts in any of the company's new ToS disclosures unveiled this week.
Hypothetical, far-future demonstrations
The luckiest VR users might be the ones who haven't used a Quest 2 headset since that hardware began requiring Facebook account credentials—and thus might have older Oculus Rift software purchases wholly detached from Facebook logins. For them, the Meta Account may seem like a one-to-one match for the older Oculus account system. No big deal, then, right?
Answering that question requires guessing what shape Meta will take going forward, both as a virtual reality company and as a seller of future Meta-produced "augmented reality" systems. Meta CEO Mark Zuckerberg was upfront about his intentions when he announced a new name for the combined businesses formerly known as Facebook in October of last year. "Over time, I hope we are seen as a metaverse company," he said.
We've seen demonstrations from Zuckerberg and other Meta executives about a connected future in which some sort of headset can drive social and location-based interactions. Their hypothetical, far-future demonstrations have included seemingly real conversations, complete with video projection, between people who are physically separated by whole continents. Meta has also shown off dynamic tooltips that appear in the real world to deliver reviews and business information and even a system that augments audio between friends in the same room to filter out background noise.
An exploration of unwelcome terms
Facebook and Instagram might factor into those hypothetical use cases in the form of friend lists or location-based data. But what if Meta sees the writing on the wall in the next decade, announces login changes to existing services, and formally puts even more data under the umbrella of a Meta Account to essentially get us back to where we started?
I had that question in mind while poring over Meta's new "Supplemental Meta Platforms Technologies Privacy Policy." I'll paste a few of its clauses below and add my thoughts after each.
- You must provide us with accurate and up to date information (including registration information), which may include providing personal data.
Translation: This allows Meta to institute a "real-name policy" for Meta Accounts at any time. So far, I haven't gotten answers from Meta's press team about whether Meta Accounts will require payment credentials and/or first and last names. Meta services include a number of free-to-play games, along with pre-paid card systems for making payments without saving any payment credentials, so it stands to reason that a zero-credential VR software account could be feasible, just like on the original Oculus platform. I'm hopeful that in the short term, at least, a path outside real-name use remains available.
- If you choose to connect your Meta account with other Meta Company Products accounts (such as your Facebook or Instagram accounts), you also give us permission to display your profile information and information about actions you have taken in MPT Products across Meta Company Products.
This is a concerning line because it refers to platforms that Meta might create or acquire in the future, especially any that might automatically include existing data from Facebook, Instagram, or WhatsApp. It would get us right back to the original Facebookening complaint, leaving us with a piece of hardware and associated OS that demands a backdoor into your existing social activity in order to function. Either you cough up the relevant data and credentials or you're left with a headset-shaped paperweight.
This is why journalists keep an eye on the passive voice
- Meta, its affiliates, and other users of Horizon Worlds may interact with, supplement, manipulate, and modify (in whole or in part) any content you have rights in, upload to, or create in Horizon Worlds.
- When you use Meta VR Products or Horizon Worlds, your device will record (through a rolling buffer processed locally on-device) your and other users’ most recent audio, video, and other interactions in these products. This audio data from this rolling buffer is not stored on our servers unless a report is submitted.
I've combined these two blurbs because they involve Horizon, which was previously a Facebook-branded social VR experience. The first part sounds a lot like clauses you might expect to see on Facebook, with its operators having total control over what you post on its wholly owned social media platform. The second is a reminder of what we've always known: Facebook has systems in place to capture anything you're doing in VR, whether it's the data you transmit directly to other users (speech, rude gestures) or the stuff that you might assume is private (how the Quest 2 headset scans your local environment to support "inside-out" tracking).
The openness of a phrase like "other interactions" leaves Meta able to consider anything you do while its headsets are powered on fair game. Plus, notice the passive voice in the phrase "unless a report is submitted." That's not the same as "unless a user submits a report." Could reports be automatically triggered—especially for a headset that routinely remains powered on in a sleep state when not in use? Meta doesn't say "no."
For now, Horizon Worlds is a discrete app that users must manually select and boot. In August, it will not be a mandated part of any Meta Account device use. But it's a "Meta" product now, not a Facebook one, and that means the data it juggles could very well become part of the default Meta Account login at some point. We've anticipated such a social-app mandate for the Quest platform for years, ever since the free-to-play, social-VR likes of Rec Room and VRChat began racking up tons of users across various VR and non-VR platforms.
“Facebookening” gives way to “Metastasis”
As of now, Meta's various ToS documents give the company leeway to run rampant with user data. Meta has been selling its Quest 2 headsets at a remarkably low price for years, reportedly at a loss, and this has been a historically common practice for gaming and software platforms.
But in Meta's case, user acquisition isn't just about making money off of years of software licensing; It's also about creating a closed, wholly controlled platform that can squeeze cash out of "non-identifiable" personal user data, either through direct advertising or indirect use of users' aggregated data. Plus, Meta isn't shy about how much data it's harvesting from Quest headset use. In particular, the company makes clear that it keeps track of all "fitness-related experiences" on the platform, possibly including those provided by third-party app makers. This data includes, but is not limited to, estimated calorie burns and "fitness goals and achievements." You may have seen recent headlines about legislators wanting to buttress health care and fitness data protections.
The retirement of a Facebook account mandate in Meta's VR products is certainly welcome. It allows users to remove their social media use from what they may perceive as a wholly distinct platform. But the "Metastasis" of accounts and user data for the Quest and other future products doesn't inspire confidence.
Listing image: Hanna Barbera / Aurich Lawson
