Key Challenges Identified:

• Biometric Data Collection:
  XR systems often rely on capturing biometric data such as head, hand, and eye movements, facial expressions, voice patterns, and body posture. These “kinematic fingerprints” can uniquely identify users even without traditional identifiers, raising significant privacy and security concerns.
• Non-Consensual Data Capture:
  Mixed Reality (MR) and Augmented Reality (AR) technologies frequently collect environmental data that may include bystanders, leading to potential breaches of data protection regulations due to non-consensual data processing. Bystanders may be unaware of or unable to exercise data subject rights under laws like the GDPR.
• Informed Consent & Data Obfuscation:
  As highlighted in D2.1, users often face obfuscated privacy policies and unclear consent mechanisms. The immersive nature of XR complicates the ability to give or withdraw informed consent in real-time. Furthermore, power imbalances in workplaces or educational contexts challenge the voluntariness of consent.
• Profiling & Emotional Manipulation:
  The combination of real-time behavioural tracking and AI-enhanced analytics enables advanced profiling of users. This poses ethical concerns about cognitive privacy and the risk of emotional manipulation, particularly in marketing, education, or workplace environments.
• Surveillance & Datafication:
  XR technologies risk intensifying the trend toward datafication, where everyday activities are turned into quantifiable data for commercial or managerial purposes. This is particularly concerning in workplace applications, where XR can enable intrusive monitoring of employee performance and behaviours.

Sector-Specific Data Risks (as mapped in D3.1):

• Education & Employment:
  Use of XR for learning and training involves data collection on student or employee engagement, behaviours, and responses, raising concerns about surveillance, agency, and fairness in evaluation.
• Healthcare:
  XR used in medical training or therapy involves sensitive health data. Ensuring confidentiality, secure storage, and ethical usage is critical, especially when combined with biometric inputs.
• Marketing & Trade:
  XR applications allow advertisers to track gaze, attention, and emotional responses, enabling unprecedented levels of behavioural profiling and targeted persuasion.
• Security & Policing:
  Integration of XR into surveillance infrastructures (e.g. smart policing) raises concerns about warrantless monitoring, bias in data interpretation, and chilling effects on public life.

Gaps and Unresolved Issues:

• Existing data protection laws like the GDPR provide a baseline but are not fully equipped to address the real-time, multisensory, and ambient data collection inherent in XR.
• There is insufficient regulatory clarity on the responsibilities of various actors in the XR data ecosystem—particularly in shared or publicly accessible environments.
• Cross-border XR platforms pose jurisdictional challenges in terms of enforcement of data rights and legal recourse.