On Tuesday, Facebook found another way to complicate millions of users – although this time the outrage came from its virtual reality department. The company announced that it would soon mandate the use of Facebook accounts in its Oculus ecosystem to "unlock social features." In the ideal world of Facebook, you are your Facebook self on the Facebook VR system … instead of using an existing, separate "Oculus ID".
What's the big deal, you might be wondering? This is not the first time a large tech company has tried to combine different services under one roof with a "single account". But while Google, Microsoft, Amazon, and others have spent years building empires like this, none pulled the bait like Facebook yesterday. And it's not about tech business as usual. Facebook's latest decision right now deserves careful scrutiny before it explodes like a virus outside of the virtual reality niche.
Facebook ening isn't new – just more extreme
For older, existing Oculus VR products, the mandatory switch from Oculus ID to Facebook accounts will begin on January 1, 2023 – and older devices will continue to work "offline" (and support tweaks such as side-loading non-Oculus apps). Buyers of "new" Oculus hardware – including slimmer, more powerful VR headsets – don't have these old Oculus IDs as an option. If you're shopping for the company's next fancy pants headset, your purchase alone is not enough. You'll also need to sign in with a valid Facebook account before the new headset will work.
Let's break down these two possible scenarios, starting with existing headset owners.
By this week, you may have purchased an Oculus headset and its software licenses with the expectation that they would be in their own silo. Oculus was acquired by Facebook in 2014, so there has always been some understanding that everything you do in Oculus falls under Facebook's purview. If you're an angry FB reviewer, some of the best things to do is avoid giving Zuckerberg and friends your money, device usage data, and VR app purchase history. Even with their own "Oculus Account" outside of Facebook, it's fair to assume that Zuck and his crew will see all of this. That makes sense.
However, this transition to a Facebook account request is unprecedented in consumer electronics. On the gaming side, no console or associated gaming service has ever required the users' social network (or even the wholly owned email products) to work. (That means you can use Xbox Live without one of Microsoft's Outlook.com addresses.) The exception is the Google Stadia Games service, which requires a Google Account (which is inherent to a Gmail address), although this was started as a requirement as opposed to a requirement later in the product life cycle.
This is how an Oculus ID works. Without spending a dime or verifying your real name, you can create a username, create a friends list, and purchase free software licenses. If you want to buy software or add-ons, you can either add a credit card or request a prepaid voucher code. And if you breach a ToS, either within an official Oculus app or in a third-party ecosystem, penalties can be taken for both your username and the unique ID of your VR headset. You don't need your name or your life story for this.
"Pretending to be someone is not allowed."
However, Facebook's real name policy is very different from the Oculus ID system:
Facebook is a community where everyone uses the name they have in everyday life. So you always know who you are connecting with.
The name on your profile should be the name your friends call you on a daily basis. This name should also appear on an ID or a document from our ID list.
Pretending to be anything or anyone is not allowed.
We have already seen how this policy can create headaches and safety concerns. Victims of harassment and abuse are just a community that has a vested interest in establishing alternative online identities. The same applies to members of the LGBTQ community. Oddly enough, the 2014 protests against the real name policy included pledges from Facebook to expand and refine the real name rules for inclusion and user protection, but the language beyond 2020 doesn't in the least reflect such moves.
Less vulnerable users may not want their VR activities (games, apps, social spaces) to be attached to a "real name" Facebook account for several reasons. Or they vote with software by using the account system of a third party app – especially one that works in other VR ecosystems. Users may have identified an identity while playing Rec Room online on an Oculus headset to play games and connect with people on PlayStation VR, HTC Vive, or other headsets. Additionally, if you enforce a Facebook request, waves will be sent through established VR communities.
And what if Facebook's history of user manipulation shifts to VR? Emotional manipulation within VR works more extreme than on a flat screen, if the horror gaming genre is any indication. So what kind of "A / B testing" could Oculus Facebook-connected users expect? And what if your actions in VR are tied to your real identity for Facebook's "shadow profile"?
Facebook repeatedly reassures users that they can expect a safe and secure VR experience, legal name, and everything. Regulators around the world have pushed back on how such a policy goes against safeguards like GDPR, but Facebook has defended and maintained its real name policy for years. You should present the service as your real self, argues Facebook, and its public language revolves around "reporting bad behavior, holding people accountable and creating a more welcoming environment on our platforms". "
Surprisingly brazen fashion
Oculus IDs can potentially enable all of these things, especially if unique hardware IDs go into the image. Deleting and forging hardware serial numbers is much more difficult than doing the same with Facebook accounts and web browsers (which abusive and illegitimate users continue to exploit on Facebook and its web-specific services). From a technological point of view, Facebook benefits less from secure login options than from the data collection options that result from Facebook feeds. This includes all accounts associated with them, regardless of whether they are 100% owned by Facebook (Instagram, WhatsApp) or created by a third party but have deep, disruptive connections to your Facebook identity (especially dating Apps).
Facebook's announcement on Tuesday about Oculus basically says exactly that, and in a surprisingly brazen way:
When you sign in to Oculus with your Facebook account, Facebook uses information about your use of VR and other Facebook products to provide and improve your experience. This information is also used to show you personalized content, including advertisements. For example, we'll show you recommendations for Oculus events you might like, ads related to Facebook apps and technologies, or ads from developers for their VR apps.
("For example" as a qualifier is usually indicative of data sharing efforts that scale much, much higher, as opposed to an indication that Facebook has a cap in mind.)
All of this can convince you to create a "phantom" Facebook account to keep using existing Oculus devices that has been set up with a backup email address and anointed with something other than your legal name. You would then ideally move existing digital purchases to this new Facebook identity and search for online friends as needed to create a Facebook-specific VR "friends list". (Crucially, some of the biggest online VR games out there use their own social matchmaking systems specifically designed for a cross-platform hardware world like the HTC Vive, Valve Index, PlayStation VR, and Windows Mixed Reality. )
However, Facebook's Terms of Service are perfectly clear: this is against their rules. That phantom account – and any related purchases, including those transferred from a previous Oculus ID – could get started.
There is little precedent for this type of switch to digital shopping. The next thing I can think of is the shutdown of the movie company UltraViolet in 2019. This was built into an identically functioning service that didn't require users to join a new service with specific connections to their real identity. If Facebook notifies Oculus ID owners that they must comply with new rules, what can users legally request in terms of refunds, software licenses, or other compensation if they reject Facebook's new terms? And can these users go to court and cite Oculus founder Palmer Luckey's claim that Oculus headset owners would never need a Facebook login to emphatically disapprove of these terms? That is currently unclear.