Augmented reality, mixed reality and VR technologies are advancing at an incredible pace.
In the upcoming Steven Spielberg movie Ready Player One, based on the book by Ernest Cline, virtual reality is no longer a cutting-edge technology. Instead, this dystopian story shows a world where everything has moved into a VR world, including jobs, social interactions and … well, you can use your imagination.
We’re not there yet, but augmented reality, mixed reality and VR technologies are advancing at an incredible pace. These technologies are poised to revolutionize many aspects of life and create a new class of megarich investors and entrepreneurs.
Broadly speaking, virtual reality immerses the user in a different world. Its sibling, augmented reality, superimposes digital information over a user's existing environment — think Pokémon Go, where users can catch Pokémon in the real world by finding them using their phones’ cameras. Mixed reality combines the two by placing virtual objects in the real world and letting users interact with them. (Imagine picking up a virtual block and placing it on a real table.)
I’m hugely bullish on the prospects of augmented reality, in particular. But the fact that companies will be able to collect data on individuals’ movements, eye focus and subconscious thoughts and actions with all of these technologies raises unprecedented legal questions. The ability to track every aspect of a user's experience — including facial expressions, location and movement, what they look at and interact with and for how long, even heart rate and emotion — brings up important privacy concerns that must be addressed for consumers and society to fully realize VR's amazing potential.
What will it mean when even our subconscious thoughts are recorded as personally identifiable information? Will we treat that data — created at our behest and for our benefit to improve our experiences — as data that requires vigorous protection? What if data recorded from my subconscious is inconsistent with my conscious attitudes or beliefs? What should companies be able to glean from our subconscious responses to new stimuli? How will companies — or the government — be able to use these new data sets, if at all? And what will happen if they get it wrong?
Luckily, these are young technologies and there is time to address these privacy concerns.
Applications for these technologies are almost endless: design and modeling, education, entertainment, even medical uses including surgery. In the near future, a Wikipedia of virtual experiences will help us understand data about the people who pass us on the street and put us a click away from seeing what it's like to walk on the moon, live life as an ant, travel to the pyramids or swim through our own circulatory systems.
This massive potential is why giants like Intel, Facebook, Google, Apple, Amazon, Microsoft, Sony and Samsung are competing to dominate the field. Facebook alone has over 400 people working on VR, and an estimated 230 other companies are developing hardware and software. (Magic Leap has rightly been the belle of the ball given some of its early promise.)
Already, 75% of the Forbes World's Most Valuable Brands are starting to use either VR or AR for customers or employees, or are developing the technologies themselves, according to YouVisit, a company that helps brands engage consumers through interactive 360-degree experiences.
Research shows a 34% productivity increase for companies that adopt VR in the workplace. And profits are exploding, with mobile AR poised for a compound annual growth rate of 96% over the next five years.
To work well, it’s imperative that VR collect more information about users than any previous technology. Eventually, VR systems will be able to capture all of our movements, storing that information as a so-called "kinematic fingerprint" that could identify people both inside and outside VR.
This raises concerns in terms of what data is collected, how it's stored and protected, and who owns and controls it. And not just for users. Since many AR systems are expected to be mobile and always on — so people can constantly get extra information about their surroundings — bystanders and people in a crowd can also have their anonymity compromised.
"It’s fundamentally different from today with your camera on your phone, where you choose when to turn it on," says Franziska Roesner, assistant professor of computer science and engineering at the University of Washington.
This potential to eliminate anonymity in public can have a chilling effect on free speech, including political dissent and potentially controversial opinions. If we're always being monitored, will we feel free to express our true selves?
"The government can easily collect data from third parties even if it would need a warrant to get that same data from you," says Mark Lemley, professor of law at Stanford Law School and director of the Stanford Program in Law, Science & Technology. "So sharing your data with private companies may also end up meaning you make it accessible to the government."
And since the Fourth Amendment is based upon a reasonable expectation of privacy, the way we use VR can have a real legal effect on our constitutional rights. The more we voluntarily share intimate details, the less legal protection we may have. And the more that these technologies are adopted, the less reasonable our expectation of anonymity in public spaces will become. To protect that important aspect of privacy, and encourage future exercise of our rights to assemble, protest and speak even about unpopular topics, we will need to reground our privacy rights in something more protective than the ever-diminishing reasonable-expectation doctrine.
Complicating matters further, VR interactions may not happen in any one physical jurisdiction, making them harder to regulate.
All this data will become attractive to hackers and government spy and law enforcement agencies. And the very nature of the business increases the risks. Thanks to the network effect, the more common these technologies become, the more valuable the data will be for prying eyes. The reality of these threats should inspire cybersecurity experts to build robust safeguards now — before these hugely valuable technologies are widely adopted.
There are steps users can take to advance this privacy discussion as well. Consumers should ask: How can we have our virtual cake and eat it too? Consumers should demand that privacy technologies be built in tandem with VR technologies so that we get the maximum individual and societal benefit and minimize the burdens to businesses.
The industry should also take steps, like threat modeling and making platforms easily updatable to adapt to newfound challenges. This shouldn’t be a controversial move since manufacturers will want to build trust among consumers as they roll out these new technologies.
"These technologies will be adopted because they have cool features," Roesner says. "I would urge developers to think about privacy concerns before they arise."
VR is an amazing technology and the changes it brings could be bigger than the industrial revolution. With proper safeguards, it can thrive. But it remains to be seen if protections will be implemented to anticipate the coming reality. We need to prepare for the future today.