Privacy & Security

VR Devices Collect ‘Intimate’ Data, Lack Privacy Protections. Should Schools Invest?

By Alyson Klein — November 18, 2022 4 min read
Blue line man with red VR headset looks at the top left angle where there is the blue light.
  • Save to favorites
  • Print

Virtual reality can take students on a tour through far-off cosmos or even the human digestive system. But during the journey, VR devices may also collect over a million pieces of specific personal data, from how a user’s pupils are dilating to what makes them blush.

Virtual reality has been hyped as a potential game changer for K-12 education. But already pricey VR headsets come with an added cost to student data privacy, according to an analysis by Common Sense Media, a research and advocacy organization that studies the role of technology in kids’ lives.

The most popular devices on the market all have serious privacy problems, Common Sense found, leaving school districts that want to invest in VR with no viable option.

“We can’t recommend any device right now for schools and districts that wouldn’t potentially be violating state or federal privacy laws,” said Girard Kelly, Common Sense’s director of privacy, who conducted the analysis. “School districts probably should hold off a little bit if they are interested in VR purchasing for an Esports program or computer lab.”

Common Sense examined seven of the most popular VR devices, made by some of the biggest players in the tech world, including Meta, which also owns Facebook and Instagram; Microsoft; and Sony, which produces PlayStation. These devices make up close to 100 percent of the marketplace for VR, Kelly said.

VR headsets can gather so-called biometric data, including “really sensitive, really intimate data about your body posture, your eye gaze, what you're looking at, your pupil dilation, what you're not looking at, your gestures, what you're touching, what you're interacting with, what you're saying, even as specific as minute variations in skin color or blushing."

VR has a lot of potential as a teaching, learning, and engagement tool, Kelly said. With the technology, students could soon experience learning in hands-on ways unimaginable to previous generations. They could take a field trip to Ancient Greece, shrink to a microscopic size and explore the inside of a cell, or find themselves in the middle of a production of a Shakespearean play, all without leaving the classroom.

But, at least for now, that can’t be done without potentially opening up valuable data to tech companies, Kelly said.

All of the devices Common Sense examined in a report, released Nov. 15, display third-party advertising. Privacy policies were often murky, or indicated that user data could go to advertising or tracking purposes.

What’s more, the headsets lack specific legal protections mandated for students under the age of 13, who are subject to more stringent federal privacy standards. And more than half of the devices had no parental controls, and some had no safety settings at all.

While privacy is a consideration when districts purchase any piece of technology, the data collected through VR devices is especially sensitive, because it can go far beyond just your name, age, and location, Kelly said.

VR headsets can gather so-called biometric data, including “really sensitive, really intimate data about your body posture, your eye gaze, what you’re looking at, your pupil dilation, what you’re not looking at, your gestures, what you’re touching, what you’re interacting with, what you’re saying, even as specific as minute variations in skin color or blushing,” Kelly said.

That kind of information gives away clues as to what makes users nervous, excited, or bored, what resonates with them and what doesn’t. And the amount of data that could be collected isn’t trivial: After spending 30 minutes or more in the virtual world, users generate millions of data points, Kelly said.

“What [we] do in these rich, immersive environments betrays our innermost thoughts and feelings,” Kelly said. That means, down the line, “what you do in VR could potentially be used to make you think positively about a brand, or to purchase other products on other platforms.”

What’s more, some virtual reality apps—especially games—allow users to interact with strangers. “That opens a lot of possibilities for inappropriate contact and exchanges” that can be harmful to kids, Kelly said.

‘It definitely has me pausing’

The message in the report, Kelly said, is ultimately for the VR industry: “Industry needs to do better, if we want these devices to have beneficial uses.”

School district officials should “contact the [VR] vendors, contact the manufacturers,” and advocate for stronger data-privacy protections, Kelly said.

That resonates with Kyra Walker, the instructional technology coordinator for Washington-Liberty High School in Arlington, Va. Her district is interested in creating a VR lab at some point. For now, it has a limited number of headsets that are loaned out to teachers who have gotten special permission to use specific programs, she said.

She’s still enthusiastic about the learning potential for VR. But she’s still concerned that companies think of data privacy as a secondary consideration.

Companies usually say “’we have this great product and they push it out,’” Walker said. “And it’s not until the consumers say, ‘wait a minute, what are you doing with my data? How are you collecting this or are you selling this to someone?’”

After reading key points from the Common Sense report, Mary Teren, a high school science teacher in Cobb County, Ga., is having second thoughts about VR. She had hoped to get a grant to purchase headsets.

“It definitely has me pausing,” she said. “I don’t know if I want that data going out there. Our primary job as educators is not just to educate but to protect our children. The fact that [VR] collects millions of data points in half an hour blew my mind. Is the risk of student data being collected, sold, and used worth the reward of the experience?”


School Climate & Safety K-12 Essentials Forum Strengthen Students’ Connections to School
Join this free event to learn how schools are creating the space for students to form strong bonds with each other and trusted adults.
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
IT Infrastructure & Management Webinar
Future-Proofing Your School's Tech Ecosystem: Strategies for Asset Tracking, Sustainability, and Budget Optimization
Gain actionable insights into effective asset management, budget optimization, and sustainable IT practices.
Content provided by Follett Learning
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Budget & Finance Webinar
Innovative Funding Models: A Deep Dive into Public-Private Partnerships
Discover how innovative funding models drive educational projects forward. Join us for insights into effective PPP implementation.
Content provided by Follett Learning

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Privacy & Security Quiz
Quiz Yourself: How Much Do You Know About Cybersecurity For Schools And Districts?
Answer 6 questions about actionable cybersecurity solutions.
Content provided by FlexPoint Education Cloud
Privacy & Security A New Federal Taskforce Targets Cybersecurity in Schools
The “government coordinating council" aims to provide training, policies, and best practices.
3 min read
Illustration of computer and lock.
iStock / Getty Images Plus
Privacy & Security Q&A Why One Tech Leader Prioritizes Explaining Student Data Privacy to Teachers
Jun Kim, the director of technology for an Oklahoma school district, helped build a statewide database of vetted learning platforms.
3 min read
Jun Kim, Director of Technology for Moore Public Schools, poses for a portrait outside the Center for Technology on Dec. 13, 2023 in Moore, Okla.
Jun Kim, is the director of technology for the Moore school district in Moore, Okla., He has made securing student data a priority for the district and the state.
Brett Deering for Education Week
Privacy & Security A Massive Data Leak Exposed School Lockdown Plans. What Districts Need to Know
More than 4 million records held by school safety software company Raptor Technologies were left inadvertently exposed online.
5 min read
Concept image of security breach, system hacked alert with red broken padlock icon showing vulnerable access.
Nicolas Herrbach/iStock/Getty