  Motion tracking "telemetry" data lies at the core of nearly all modern
virtual reality (VR) and metaverse experiences. While generally presumed
innocuous, recent studies have demonstrated that motion data actually has the
potential to uniquely identify VR users. In this study, we go a step further,
showing that a variety of private user information can be inferred just by
analyzing motion data recorded from VR devices. We conducted a large-scale
survey of VR users (N=1,006) with dozens of questions ranging from background
and demographics to behavioral patterns and health information. We then
obtained VR motion samples of each user playing the game "Beat Saber," and
attempted to infer their survey responses using just their head and hand motion
patterns. Using simple machine learning models, over 40 personal attributes
could be accurately and consistently inferred from VR motion data alone.
Despite this significant observed leakage, there remains limited awareness of
the privacy implications of VR motion data, highlighting the pressing need for
privacy-preserving mechanisms in multi-user VR applications.
