Tracked across the Metaverse: UCI Researchers Show VR Sensor Data Can Uniquely Identify You across Multiple Apps
Metaverse tracking image generated by Microsoft Copilot
Imagine putting on your VR headset to play Beat Saber, then switching to a flight simulator, and later joining friends in VRChat. You think you’re hopping between different worlds, with different avatars and usernames each time. But what if your body is the one true constant — and VR platforms can recognize you, even if you try to hide?
At UC Irvine, we built BehaVR, a system that shows how sensor data from your VR headset and controllers can uniquely identify you across multiple apps. We tested this on 20 real-world VR apps, covering everything from rhythm games to social hangouts to virtual flight simulation or Job simulator.
Here’s the unsettling part: even if you use a different account, switch devices, or change your avatar, your movement patterns, eye gaze, hand gestures, and facial expressions can give you away. Our machine learning models identified users with up to 100% accuracy in many apps and could track users across different apps — even apps they hadn’t used before.
We’re talking about the Metaverse’s version of cookies: your movement, your gaze, the way you hold controllers, or how you smile when you are having a conversation. These become a behavioral fingerprint that can follow you across the platform.
While VR promises freedom and immersion, it also brings a new privacy frontier. Sensor data, collected for improving gameplay and realism, can also become a surveillance tool if not handled responsibly.
I recently presented this work at PETS 2025, a leading privacy conference, to spark discussions on how we can design privacy protections in VR before it’s too late. More details can be found here.
This project was supported in part by ProperData, which funds research advancing privacy rights in emerging technologies. Our work underscores the urgent need for transparency and privacy safeguards in VR systems before tracking becomes the invisible norm.
If the Metaverse is going to be our new digital home, it’s time we demand transparency and control over what our sensors share — and who gets to watch.
Tracked across the Metaverse: UCI Researchers Show VR Sensor Data Can Uniquely Identify You across… was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.