Considering that the legal definitions of "PII" exclude quite a lot of actual PII, I don't have any faith that a legal definition of "anonymous data" would be any more accurate.

Probably goes without saying, but Quest users are obliged to have a Facebook account. So that can't even be qualified with "if they have a Facebook account", the vast majority of users do.

As far as I know, the original workaround of using a developer registered account now requires an invite and it's hard to see that not quietly being dropped at some point and all users requiring a "real" account.

It's a shame looking in from the outside at how good the pricepoint is for the hardware, but can't bring myself to get involved with Meta. Just about the only aspect of a user (they aren't even 'just a user' if they've spent hundreds on Quest and apps, they're a fully blown customer) they aren't collecting data on is their DNA.

Recital 26 of the GDPR has a quite good definition

>To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Which of course relies on threat modelling as technology doesn’t stand still. However it’s quite clear that if you can link the data in any way to an individual, it’s not anonymous.

I work in privacy and I’d even argue that collecting anonymous data is likely not possible unless using something like differential privacy. It’s more likely they are collecting personal data (because even your IP would link this data to you) and then anonymise it afterwards (i.e. store it without your IP address).

its nuts how much these devices will be able to learn about us. User privacy will have to change if they can spatially map out your bedroom, your body and your movements.

If its like the iPhone situation, not much is collected

Apparently people using old Oculus accounts are exempt. The strange thing here is the apparent lack of ability to opt out. It's pretty standard practice among data collection devices to at least have an option to turn it off, and since most people don't do so, it doesn't seem to have a large impact on analytics, but omitting an opt out except if using an account type that can no longer be created seems like a great way to alienate power users.

I commented here just recently that I found the privacy options on the Quest to be fine as they were implemented, and here they go and immediately change the terms just at the moment when Apple came in and made the Quest look like a great value for people who want to get into XR but don't want to pay $4k.

I'm not certain that Ars is right here about there being no opt-out, and even they don't seem to be sure, but I hope they're mistaken.

Yeah, but "It's Not A Facebook Account! :)"

Everyone basically went with that line and called it "good" when I still thought it "a disaster" and the only response that typically comes after that is "well then just don't use it!" when there's no real good other alternatives on the market.

It is a toss up what is more shocking between this and one of those "Giant pet alligator kills owner" type stories.