Why the Facebookening of Oculus VR is bad for users, devs, competition

On Tuesday, Facebook found another way to aggravate millions of users—though this time, the outrage came from its virtual reality department. The company announced that it would soon mandate the use of Facebook accounts within its Oculus ecosystem, all in order to "unlock social features." In Facebook's ideal world, you'll be your Facebook self on the Facebook VR system... instead of using an existing, separate "Oculus ID."

What's the big deal, you may ask? This isn't the first time a major tech company has tried to combine various services under a "unified account" umbrella. But while Google, Microsoft, Amazon, and others have spent years building such empires, none has pulled quite the bait-and-switch as Facebook did yesterday. And it's not a matter of tech business as usual. Facebook's latest decision deserves fierce scrutiny, right now, before it explodes like a virus outside of the niche that is virtual reality.

The Facebookening isn’t new—just more extreme

For older, existing Oculus VR products, this mandated switch from Oculus ID to Facebook accounts will begin January 1, 2023—and older devices will still function in an "offline" capacity (and will support tweaks like side-loaded, non-Oculus apps). What's more, buyers of "new" Oculus hardware—including sleeker, higher-performing VR headsets—won't have those old Oculus IDs as an option. Should you buy the company's next fancy-pants headset, your purchase alone will not suffice; you must also log in with a valid Facebook account before that new headset will function.

Let's break down both of these possible scenarios, starting with existing headset owners.

Up until this week, you may have purchased an Oculus headset and accompanying software licenses with the expectation that these would exist in their own silo. Oculus was acquired by Facebook in 2014, so there's always been some understanding that whatever you're doing in Oculus is under Facebook's purview. If you're a raging FB critic, you'd have been wise to avoid giving Zuckerberg and friends your money, your device-use data, and your VR-app purchasing history, among other things. Even with a distinct "Oculus account" outside of Facebook, it's fair to assume Zuck and his crew see all that stuff. That makes sense.

But this transition to a Facebook account requirement is unprecedented in consumer electronics. On the gaming side, no console or connected gaming service has ever required its users' social network (or even its wholly owned email products) to function. (That means you can use Xbox Live without one of Microsoft's outlook.com addresses.) The exception is the Google Stadia gaming service, which requires a Google account (inherent in a Gmail address), though it launched with this as a requirement, as opposed to making it a requirement later in the product life cycle.

Also, a Google account is a vastly different beast than Facebook's version. (Had Google Plus succeeded, I might be singing a different tune. Alas.) I can create big-googly-moogly-98761234 as a Google account, or just about any service out there, then attach whatever personally identifying information I want, like a credit card. From there, I can proceed accordingly in terms of saving credentials, racking up a purchase history, and acting responsibly with that account. Meaning: just because I made a wacky account name and bought stuff with it doesn't mean I can't be punted from its service for violating the Terms of Service (ToS).

This is how an Oculus ID works. Without spending a penny or confirming your real-life name, you can make a username, build a friends list, and acquire free-to-play software licenses. If you want to buy software or add-ons, you can either add a credit card or claim a prepaid voucher code. And if you violate any ToS, either within an official Oculus app or in a third-party ecosystem, punitive actions can be taken on both your username and your VR headset's unique ID. They don't need your name or life history to do that.

“Pretending to be anyone isn’t allowed”

But Facebook's real-name policy differs largely from the Oculus ID system:

Facebook is a community where everyone uses the name they go by in everyday life. This makes it so that you always know who you're connecting with.

The name on your profile should be the name that your friends call you in everyday life. This name should also appear on an ID or document from our ID list.

Pretending to be anything or anyone isn't allowed.

We've already seen how this policy can result in everything from headaches to security concerns. Victims of harassment and abuse are but one community with a vested interest in establishing alternate online identities. The same goes for members of the LGBTQ community. Weirdly enough, 2014 protests over the real-name policy included pledges from Facebook to expand and clarify its real-name rules for the sake of inclusion and user protection, but the above 2020 language doesn't reflect such strides in the slightest.

Less-vulnerable users may simply not want their VR activities (gaming, apps, social spaces) attached to a "real-name" Facebook account for a number of reasons. Or they may vote with software by electing to use a third-party app's account system—especially one that works across other VR ecosystems. Users may have established an identity in the online game Rec Room on an Oculus headset in order to play games and socialize with people on PlayStation VR, HTC Vive, or other headsets. Enforcing a Facebook requirement on top of that will send ripples through established VR communities.

And what happens if Facebook's history of user manipulation comes to VR? Emotional manipulation within VR operates on greater extremes than on a flat screen, if the horror-gaming genre is any indication, so what kind of "A/B testing" might Facebook-connected Oculus users expect? And what if your actions within VR become attached to your real-life identity for Facebook's "shadow profile" purposes?

Facebook repeatedly assures users that they can expect a safe and protected VR experience, legal name and all. Regulators around the world have pushed back on how such a policy runs counter to protections like GDPR, but Facebook has since spent years defending—and maintaining—its real-name policy. You should present on the service as your true self, Facebook argues, and its public-facing language has revolved around "report[ing] bad behavior, hold[ing] people accountable, and creat[ing] a more welcoming environment across our platforms."

Surprisingly brazen fashion

Oculus IDs can arguably enable all of those things, especially when unique hardware IDs enter the picture. Deleting and faking hardware serial numbers is much more difficult than doing the same with Facebook accounts and Web browsers (which abusive and illegitimate users continue to exploit on Facebook and its Web-specific services). From a technological standpoint, Facebook stands to benefit less from secure login possibilities and far more from the data-collection opportunities that come from Facebook feeds. And that includes any accounts connected to those, whether they're wholly owned by Facebook (Instagram, WhatsApp) or are made by third parties but have deep, disturbing ties to your Facebook identity (particularly dating apps).

Facebook's Tuesday announcement about Oculus basically says as much, and it does so in a surprisingly brazen fashion:

When you log into Oculus using your Facebook account, Facebook will use information related to your use of VR and other Facebook products to provide and improve your experience. This information is also used to show you personalized content, including ads. For example, we might show you recommendations for Oculus Events you might like, ads about Facebook apps and technologies, or ads from developers for their VR apps.

("For example" as a qualifier is typically an indication of data-sharing aspirations that scale much, much higher, as opposed to an indication that Facebook has any ceiling in mind.)

Facebook's terms of service are abundantly clear: Doing this breaks their rules.

All of this may convince you to create a "phantom" Facebook account to continue using existing Oculus devices, set up with a spare email address and anointed with something other than your legal name. You'd then ideally transfer existing digital purchases to that new Facebook identity and seek out any online friends as needed to build a Facebook-specific VR "friends list." (Crucially, some of the biggest online VR games on the market use their own social matchmaking systems, which were built specifically to work in a cross-platform world of hardware like the HTC Vive, Valve Index, PlayStation VR, and Windows Mixed Reality.)

But Facebook's terms of service are abundantly clear: Doing this breaks their rules. That phantom account—and all of its attached purchases, including those transferred from a prior Oculus ID—could get the boot.

There's little precedent for this kind of digital-purchase changeover. The closest I can think of is the 2019 shutdown of movie provider UltraViolet. That was rolled into an identically functioning service, which didn't require that users join a new service with specific ties to your real-life identity. With Facebook telling Oculus ID owners that they'll have to play by sweeping new rules, what can users legally demand in terms of refunds, software licenses, or other compensation, should they refuse Facebook's new terms? And can those users go to court and quote Oculus founder Palmer Luckey's assertion that Oculus headset owners would never need a Facebook login to reject those terms emphatically? That's currently unclear.