Virtual Frontiers

• Twitter
• Email
• Show more sharing options

Share Close extra sharing options

• Twitter
• Email
• Copy Link URLCopied!
• Print

Will Virtual-Reality ‘Metaversities’ Risk Students’ Data Privacy? We Asked for Contracts to Find Out. By Taylor Swaak June 17, 2022 Getty Images

This fall, hundreds of students across 10 colleges will join a small but growing cohort nationwide that is attending class in another dimension — the digital one.

What does that mean, exactly, for their data privacy?

To find out, The Chronicle analyzed university-vendor contracts, obtained under the Freedom of Information Act, from five of the institutions that plan to pilot “metaversities”: digital, immersive replicas of their campuses that dozens of their students will visit and even attend classes in, using virtual-reality headsets.

We’re sorry. Something went wrong.

We are unable to fully display the content of this page.

The most likely cause of this is a content blocker on your computer or network. Please make sure your computer, VPN, or network allows javascript and allows content to be delivered from c950.chronicle.com and chronicle.blueconic.net.

Once javascript and access to those URLs are allowed, please refresh this page. You may then be asked to log in or create an account if you don't already have one.

If you continue to experience issues, contact us at 202-466-1032 or [email protected]

This fall, hundreds of students across 10 colleges will join a small but growing cohort nationwide that is attending class in another dimension — the digital one.

What does that mean, exactly, for their data privacy?

To find out, The Chronicle analyzed university-vendor contracts, obtained under the Freedom of Information Act, from five of the institutions that plan to pilot “metaversities”: digital, immersive replicas of their campuses that dozens of their students will visit and even attend classes in, using virtual-reality headsets.

Our analysis unearthed inconsistencies in the provisions the contracts outlined for data privacy and security. It also found no mention of two third-party companies — one of which is Meta, Facebook’s parent company and a tech conglomerate not historically known for best practices in this realm — that will be collecting various pieces of student data during the two-year pilot.

The Oculus Quest 2 virtual-reality headsets that Meta is providing free, for example, require Facebook accounts, and are capable of collecting data such as location, information about a students’ physical features and movements, and, in some cases, recordings of their voices.

Legal experts and data-privacy advocates told The Chronicle they weren’t necessarily surprised by these findings. These are nascent partnerships that may be refined after the pilot, they said. The main contractor, VictoryXR, has also confirmed that it isn’t privy to students’ educational records.

Those experts do, however, worry that variances in the contracts indicate an increasingly common occurrence in higher ed: Colleges embarking on new ed-tech ventures with an incomplete understanding of what the technology can ultimately glean about their students, especially when numerous private entities are involved.

It’s not that institutions are “totally asleep at the switch,” said Jacob H. Rooksby, dean of the Gonzaga University School of Law. But it is possible that, in a case like this, “institutions aren’t thinking about these things … and that’s a problem.”

Privacy experts told The Chronicle that such an awareness is essential, both for students’ protection and to safeguard institutions’ reputations, before more widespread adoption of new ed tech like these metaversities. They said colleges also have a moral obligation; the onus should not fall solely on students to be their own data advocates.

Further Reading

• A Vulnerability in Proctoring Software Should Worry Colleges, Experts Say

Privacy “needs to be at the forefront of considerations as schools are embarking on new, exciting technology to educate their students,” said Cody Venzke, senior counsel for the Equity in Civic Technology Project at the Center for Democracy and Technology, which works to promote democratic values in tech policy. “Not something that is an afterthought, or that waits until after there’s a controversy.”

As public outcry against tools like online proctoring and Covid tracking has revealed, there’s a lot to gain from transparency and being proactive, advocates added.

ADVERTISEMENT

“It might not be a fire right now,” said Jason Kelley, associate director of digital strategy at the Electronic Frontier Foundation, a nonprofit championing user privacy. “But there’s some embers smoldering.”

A Contract With VictoryXR

The Chronicle filed public-records requests for all contracts and data-privacy agreements pertaining to the metaversity pilot, which includes 10 colleges. Five of the colleges responded by the deadline, each providing a single document: A contract with VictoryXR, a VR educational-product company that is designing each institution’s digital replica with more than $500,000 in funding from Meta.

One provision Venzke was happy to see: All of the contracts “made very clear that the schools retain ultimate ownership” of any data generated from the partnership.

The contracts diverged from there. While legal experts agreed that the University of Maryland Global Campus and California State University-Dominguez Hills had fairly robust contracts — one technology lawyer noted that the CSU campus’s 16-page contract is, perhaps, even a bit over the top — the three others The Chronicle reviewed were comparatively vague.

For example, Southwestern Oregon Community College and West Virginia University’s contracts don’t explicitly mention any cybersecurity measures or instructions for reporting a data breach. The education sector was a top target for cyberattackers in 2021, with the average number of weekly attacks spiking 75 percent from 2020, according to research by Check Point Software Technologies.

The two also make no mention of applicable federal, state, or local privacy laws, such as the Family Educational Rights and Privacy Act. These laws apply regardless of whether they’re mentioned in a contract, lawyers noted; still, they said it’s good practice to mention them, as a way to set expectations and hold vendors accountable.

South Dakota State University, in its contract, also granted VictoryXR the unrestricted right to use any information produced as a result of VictoryXR’s services “in the normal course” of its business “for any lawful purpose” — language that lawyers said is common, but nonetheless “squishy” and open to interpretation.

The Chronicle asked Southwestern Oregon Community College, and South Dakota State and West Virginia Universities, for comment. South Dakota State wrote that “it complies with all laws and all policies on Ferpa, and other IT security policies apply.” West Virginia University similarly stated that it “follows federal, state and local laws"; the institution is also reportedly one of more than 150 colleges that uses the Higher Education Community Vendor Assessment Toolkit to measure vendor risk. Southern Oregon reiterated that students’ education records are not accessible to third-party providers in this case.

The differences across the contracts could be attributable to a host of factors, experts said: A college’s own data-governance policies, and relevant state laws (see the California Consumer Privacy Act of 2018). Resources, and the number of general-counsel staff on hand to review contracts. The presumed lower stakes of a pilot project, and a price tag that, in the contracts The Chronicle reviewed, falls between $12,000 and $40,000.

Broadly speaking, especially if a new, exciting venture is generating community buzz, colleges’ main priorities are likely to be “to get to ‘Yes,’” said Jeff Knight, an education lawyer at Bricker & Eckler LLP. “They’re trying not to be a blocking agent.”

Indeed, virtual reality and metaversities have begun piquing institutions’ interest as dynamic, immersive options for remote and hybrid learning; the website Cointelegraph reported just this week that Arizona State University had submitted trademark filings that suggest intentions to offer virtual classes in the metaverse. Students in the metaverse can do things like explore historical settings or perform a mock dissection, miles from their college’s campus.

ADVERTISEMENT

The broader educational value of virtual reality is still an open question, though officials at Morehouse College in Atlanta — which started its first metaversity iteration in 2021 — say they’ve seen promising results: Students in a spring-2021 VR world-history course, for example, had final grades 10 percentage points higher, on average, than peers taking the course face to face.

Steve Grubbs, founder and chief executive of VictoryXR, told The Chronicle that the privacy of students’ information is important to his company and its ethos. For this particular project, he said, VictoryXR has access to students’ email addresses, along with their names if they choose to provide them.

While that could change after the pilot, VictoryXR’s business model “does not make money from selling data,” Grubbs wrote in an email. “The collection of data only increases our liability risk trying to house it. There’s no value for us to take on that risk.”

So does that mean a simple contract that doesn’t emphasize data privacy is actually OK? From a purely legal standpoint, perhaps. But advocates say “legally sufficient” shouldn’t be the goal if a university wants to build community trust and enthusiasm for a new enterprise.

!function(){"use strict";window.addEventListener("message",(function(e){if(void 0!==e.data["datawrapper-height"]){var t=document.querySelectorAll("iframe");for(var a in e.data["datawrapper-height"])for(var r=0;r