  In recent years, social virtual reality (VR), sometimes described as the
"metaverse," has become widely available. With its potential comes risks,
including risks to privacy. To understand these risks, we study the
identifiability of participants' motion in VR in a dataset of 232 VR users with
eight weekly sessions of about thirty minutes each, totaling 764 hours of
social interaction. The sample is unique as we are able to study the effect of
user, session, and time independently. We find that the number of sessions
recorded greatly increases identifiability, and duration per session increases
identifiability as well, but to a lesser degree. We also find that greater
delay between training and testing sessions reduces identifiability.
Ultimately, understanding the identifiability of VR activities will help
designers, security professionals, and consumer advocates make VR safer.
