Virtual reality and data protection go hand in hand: VR headsets collect a range of data depending on the device, operating system, app, and activated features. These include motion and interaction data, but also information from cameras, microphones, and eye and hand tracking. For companies, therefore, the question is not only which headset is used: what data a specific application processes is crucial; whether it can be associated with a user; and where it is transmitted.
What data does a VR headset process?
The sensors enable spatial representation and control. The data generated and stored during this process vary according to the model and application. Typical examples are:
- Motion and interaction data: Position and orientation of the headset and controllers, hand movements, and interactions in the application.
- Eye and Face Tracking: Eye direction, eye movements, or facial expressions captured, provided the device and the app support and utilize these functions.
- Spatial and environmental data: It recognized areas, spatial boundaries, spatial anchors, and – with mixed reality functions – image information from the environment.
- Usage and account details: Device identifiers, registration data, app usage, diagnostic data, and, if applicable, voice or input data.
Not every headset collects all of this data. A sensor also does not automatically mean that the app receives the raw data: Some processing takes place directly on the device. That in itself does not, however, indicate which additional data are processed by the operating system, the app, or a connected cloud service.
Are tracking data automatically biometric data?
No. After GDPR Information is personal data when it relates to an identified or identifiable person. Data such as movement, gaze, or location can be considered personal data if it can be associated with a person or allows conclusions to be drawn about them.
Biometric data, in the specific sense of the GDPR, are not present in every measurement of eyes, hands, or movements. Articles 4, paragraph 14, and 9 link this special category in particular to the fact that such features are processed using special technical methods to uniquely identify a person. Whether this applies in the specific VR project therefore depends on the purpose and processing. If health information is derived from the data or used for other sensitive purposes, this must be evaluated separately.
What companies should clarify before using VR
For a corporate project, the data flow from the headset to the participating services should be traceable. This includes app providers, device management, analytics or voice services, and possible subcontractors. The designation „Enterprise“ or a kiosk mode does not automatically answer these questions.
- Determine purpose and scope: What data does the application really need? Functions that are not required for the application case should remain disabled.
- Documenting processing: What data are processed, stored, or transmitted locally? Who has access, how long do the data remain available, and in which countries are they processed?
- Check the legal basis and information: Those affected must be clearly informed about the purpose, scope, storage period, recipients and their rights. Consent is not necessarily the correct or only legal basis.
- Clarifying roles and contracts: Check who is the responsible party and who is the processor, whether a contract for processing the data is required, and whether third-party transfers take place.
- Implementing protective measures: This can include separate networks, restricted accounts, short storage periods, regulated deletion, and resetting between different users.
- Taking into account the context of employment: If employees are being trained or monitored, the deployment should be coordinated with the data protection officer and, if available, the works council. Performance or conduct control should not simply result from training data.
- Review of data protection impact assessment: If processing is likely to involve a high risk to the rights and freedoms of natural persons, it must first be determined whether a data protection impact assessment is required.
Headset manufacturers: concrete data flows instead of vague promises
The platforms differ in terms of features, accounts, management tools, and privacy options. Therefore, a general statement like „all motion data go to the manufacturer“ or „Enterprise is compliant with data protection regulations“ is too general. What matters are the respective current privacy policies, device settings, the specific app, and its privacy guidelines.
For example, Meta describes that certain raw images of hands and bodies are processed during active tracking on the device and immediately overwritten. However, this does not allow for a general statement about all system, account, or app data. Please check the details for the used functions and services directly in Meta Privacy Center.
Apple explains that Optic-ID data remains encrypted on the device and that direction of view is not passed on to Apple, apps, or websites during navigation. This is a statement about specific data and system functions, not a blanket permission for every app or use. Also, with Apple Vision Pro Companies should review the data processing for the specific application.
PICO offers management and deployment functions for business devices. These can simplify operation, but do not replace the verification of data processing by the operating system, app, and cloud services. The same applies to other providers. Therefore, a headset, MDM or kiosk system is not privacy-friendly or GDPR-compliant solely based on its product category.
Practical rules for workshops, trade shows and training sessions
With changing users, data minimization is particularly important. Use demo accounts without personal content whenever possible, avoid unnecessary records, and reset the device between sessions. In applications with room scan or passthrough, it should be clear whether ambient images are processed only during runtime or also stored. In public areas, people who are not wearing headsets but could be captured by cameras or recordings must also be taken into account.
At VR Trainings It should also be examined whether the results are actually needed for learning purposes and how long they are kept. The technical possibility to evaluate gaze direction, reaction time or movements is not a reason to automatically record this data.
Conclusion: Data protection begins with the application concept
VR headsets can touch personal and – depending on purpose and processing – particularly sensitive information. The risk cannot be assessed solely by the manufacturer or the device. Companies should examine the entire data flow of the specific application, process only necessary data, and establish clear rules for information, access, storage duration, and deletion. In the case of specific projects, the review with the data protection officer is part of the process. For more information on design and implementation, see our page on Virtual reality agency.
Status: September 2026. This article provides general guidance and does not replace a review of the specific processing procedure.
