Expert: Meta’s Quest 2 puts children’s privacy at risk

Downloads of Oculus, a virtual reality app by Meta (formerly Facebook), grew by 480% on Christmas week (according to Sensor Tower data). Many believe that this rise could be linked to sales of the Quest 2 headset, which is compatible with the app and is considered to be one of the most presented items to children around the world.
A range of studies conducted over the years questions the impact VR gaming can have on children’s physical and psychological development. However, privacy concerns should be added to that list.
“As with every new technology, manufacturers want to jump on the train as soon as possible. This can result in major security oversights for some products (in this case, games and VR headsets). Hackers can easily take advantage of these vulnerabilities. And since children usually poorly understand the possible risks, they are the perfect targets for cybercriminals,” says Daniel Markuson, cybersecurity expert at NordVPN.
Threats that parents should know about
The most important virtual reality privacy issue is the highly personal nature of the collected data, which includes biometric data such as eye scans, fingerprints, face geometry, and voiceprints. It is nearly impossible to stay anonymous while using VR as the behavioral and biometric information collected by most headsets can be used to identify users with very high accuracy.
Identity theft
According to a survey by NordVPN, 28% of all Americans report to have been victims of identity theft in 2021 alone, showing how serious this problem is. Studies estimate that by 2030, nearly two-thirds of identity-fraud cases affecting today’s children will have resulted from oversharing on social media by kids and their parents.
Poorly protected virtual reality games can grant crooks easy access to player’s accounts, where they can get all the information they need for identity theft. Everything from their date of birth and place of residence to their bank account and credit card information.
On the other hand, even if the account isn’t connected to any social media, the user’s data still is collected by Meta. Given Facebook’s poor track record with user data leaks (data of 533 million users leaked last year), this already puts kids’ privacy in danger.
Combined with the biometric and behavioral data gained after hacking a VR device, this can be used to make charges on the hacked accounts, buying medical services in the account owner’s name, committing credit card fraud, and more.
Social engineering
If a hacker can access the motion-tracking data from a VR headset, they could potentially use it to create a digital replica (better known as deepfakes). They could then pretend to be someone else in a VR game and carry out a social engineering attack.
Children could be highly vulnerable to such an attack because they tend to be naive and may provide sensitive information quite readily, especially if they believe that the person that they are talking to in their virtual world is someone they know.
Real-world harm
Hacking virtual reality apps or headsets is more than just a cybersecurity concern – it can lead to real-life, physical threats. The information collected can tell the attackers about the gamer’s daily habits, their exact location, and even their home interior. Armed with this information, attackers can plan a robbery and cause physical harm.
“If your virtual reality device gets hacked, you can sometimes notice the change immediately. After all, the attacker has complete access to what you see and hear,” Daniel Markuson says. “ They can modify this virtual world however they want.”
What can be done to keep children more private?
Review privacy policies: Privacy policies are lengthy, and we rarely ever read them. However, before giving a VR headset to your child, read the policy thoroughly to understand how the platforms they join store and use their data.
Teach kids to value privacy: Staying private is a very important skill for every child to learn. Recommend that they create an anonymous nickname if they play multiplayer games. Tell them not to share your address or other personal information.
Get a VPN service: To improve your privacy and cybersecurity, use a VPN while playing VR games Installing a VPN on your home router ensures that all of the devices connected to that network are protected by a secure encrypted tunnel. This would prevent malicious actors from intercepting it.