Developer Update - 22 November 2023

Official Dev Updates
25

This is an insane privacy violation, so you’re basically saying that VRChat can make recordings of your private conversations at will? Even if you’re in a private world, and even if not a single person in the instance consents to being recorded?

I’m not sure if that’s even legal in the EU, but whenever it is or not, that’s still completely unacceptable IMO. VRChat doesn’t just consist of some people playing games in public lobbies, a massive amount of people play in private instances and have conversations about serious/private topics. Recording that without prior consent is a massive privacy violation

I’d much rather have a system where you can attach a video to a report that’s recorded during the reporting process, not having a video recorder constantly running that’s sending your private data to who knows where.

Also I know that platforms like steam and meta take a cut, but creators only getting 50% of money people spend in their worlds is really bad. I can’t see that many creators using it if it means literally splitting their income in half (which is already quite slim for many except a few world creators at the top)

I know that’s a bit harder to fix because of the platform cut, but what isn’t is the minimum withdraw amount, which is 30000 credits. In my opinion, that’s an insanely high bar for small creators, and is a massive discouragement to actually start using the CE system. If players spend a whopping $200 on your world, your paycheck is literally gonna be $0. Again, platforms like patreon don’t have a minimum withdraw amount (or if it does it’s so low I never noticed)

Many people are obviously worried about the “robloxification” of VRChat, where many worlds will turn into a micro transaction hell, destroying the current relatively open monetization scheme of most worlds, allowing almost full access to the entire world and only having small cosmetics or 1 extra room locked behind a paywall. is VRChat taking any measures to prevent super aggressive pay to win/pay to access micro transactions? Many people were already worried about this when the creator economy had been announced to be in closed alpha, including me, to which I got the response

" For a bit of context, the reason we have taken so long to do this is because we are painfully aware of what people do and don’t like about existing creator economies. We’ve played those games and apps too, and we have… opinions. :sweat_smile:"

Is there any plans on ensuring the quality and fairness of monetized worlds? Because as it looks like now, from our perspective, many of those things people don’t like about existing creator economies is getting integrated in this one as well.

Honestly this update has me pretty worried about the future of VRChat as a platform and as a community, with having a business model that’s similarly predatory as roblox with its minimum withdraw amount and aggressive cuts resulting in only big creators getting paid actual money

8 Likes
26

That is not enough, and goes agaisnt EU laws, the game might beunavaible because it is getting extremely intrusive for monetary purpose without any consent or supervision/knowledge from the users.

You can’t really get online until they do respond and fix their “hors la loi” behavior.
People should get responded instantly and get their rights covered, this is basic stuffs.

Heres a few parts of such laws:

"EU data protection rules, also known as the EU General Data Protection Regulation (or GDPR), describe different situations where a company or an organisation is allowed to collect or reuse your personal information:

they have a contract with you – for example, a contract to supply goods or services (i.e. when you buy something online), or an employee contract
they are complying with a legal obligation – for example, when processing your data is a legal requirement, for example when your employer gives information on your monthly salary to the social security authority, so that you have social security cover
when data processing is in your vital interests – for example, when this might protect your life
to complete a public task – mostly relating to the tasks of public administrations such as schools, hospitals, and municipalities
when there are legitimate interests – for example, if your bank uses your personal data to check whether you'd be eligible for a savings account with a higher interest rate

In all other situations, the company or organisation must ask for your agreement (known as “consent”) before they can collect or reuse your personal data.·

" When a company or organisation asks for your consent, you have to make a clear action agreeing to this, for example by signing a consent form or selecting yes from a clear yes/no option on a webpage.

It is not enough to simply opt out, for example by checking a box saying you don’t want to receive marketing emails. You have to opt in and agree to your personal data being stored and/or re-used for this purpose.

You should also be given the following information before you decide to opt in:

  • information about the company/ organisation that will process your data, including their contact details, and the contact details of the Data Protection Officer (DPO) if there is one
  • the reason why the company /organisation will use your personal data
  • how long they intend to keep your personal data
  • details of any other company or organisation that will receive your personal data
  • information on your data protection rights (access, correction, deletion, complaint, withdrawal of consent)

All this information should be presented in a clear and understandable way."

And I forgot, the worse, There is kids playing this game… Kids are being completely spied and their rights getting destroyed the same, it makes everything even worse.

" f your children want to use online services, such as social media, downloading music or games, they will often need approval from you, as their parent or legal guardian, as these services use the child’s personal data. Your child will no longer need parental consent"

You literally need parents consent.

7 Likes
27

I think it’s very telling that you’re not responding to any of these concerns people are raising here about how their privacy is being violated, or my own concerns about the ethicality of paywalling existing IPs.

2 Likes
28

you cannot play vrchat without accepting the privacy policy which has all this information, and a checkbox confirming that you have read and accept the privacy policy which is you accepting how that you know how vrchat can and will collect your data

29

No, it does not have all this information. Only comply half of it. they need to do everything BEFORE having our consent, not after and wait for weeks for rights to be respected, and laws too.

No, it doesnt have the rights to do so, because there is no payment/contract of such activities.

They literally spy on you 100 percent of time, for them to sell even your convos.

This is literally third world right violation.

Sorry wrong quote

30

the information it needs is

  • What personal information you collect
    which is told to you in section 1. Personal Information We Process and section 1 A, B, C and D
  • How you collect it
    also under section 1 and section 2. Cookies and Similar Technologies
  • What its used for
    found in section 3. How We Use the Personal Information We Collect
  • How its kept secure
    in section 9. Data Security
  • Whether you share it with third parties
    section 4. When We Disclose Information
    and
  • Any controls users have over any of this
    section 5. Your Rights and Choices

im fairly sure this covers everything though i may be wrong

1 Like
31

I am all for the Creator subscriptions as it makes things easier for the world creators and the users who already pay for events :sparkling_heart:.

:mag: I can see the monitor activity being a concern for many users so heads up on that. :grimacing: I personally know Meta already uses eye tracking and tracking info but VRC is not as big as Meta and it might feel a bit more personal and intrusive.

:face_in_clouds: Many users do not seem happy with the 50/50 subscription pay out and I agree it does seem a bit steep. But I can only assume this will be temporary until things fully roll out and we all get a better feel for how this is going to work out in the long run.

:bulb:As before I would like to suggest “Pay at the door” A one time payment for things you want in VRC but do not wish to subscribe to. Maybe you guys already have plans for that and im just not aware, But I feel like it would be something users might want.

But I and many others are thankful for the team transparency. Keep up the good work and stay out of my shed. :stuck_out_tongue_winking_eye:

32

Information about the company/ organisation that will process your data, including their contact details, and the contact details of the Data Protection Officer (DPO) if there is one
Kinda done, yep.

  • the reason why the company /organisation will use your personal data
    Yep.

  • how long they intend to keep your personal data
    It doesn’t do that.

  • details of any other company or organisation that will receive your personal data
    It doesnt, at all.

** information on your data protection rights (access, correction, deletion, complaint, withdrawal of consent)*
It does, partially. Because:
You should also be given the following information before you decide to opt in:
ou should not have to ask for it, wait weeks or months for it, it should be avaible on *start.

Also, again:
" f your children want to use online services, such as social media, downloading music or games, they will often need approval from you, as their parent or legal guardian, as these services use the child’s personal data. Your child will no longer need parental consent"

and there is more left, but i think we can start with that.

33

1.) section 3. How We Use the Personal Information We Collect "We collect, use, and disclose Personal Information for the following purposes: "

2.) section 10. Retention “We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when your Personal Information is no longer necessary for the purposes for which we process it unless we are required by law to keep your Personal Information for a longer period”

3.) 4. When We Disclose Information and 7. Third-Party Services

in vrchats tos it says, " General Guidelines: If you are between the ages of 13 and 17, you must get permission from your parent or guardian before using VRChat"

34

it didnt responded the points exposed, again.

-Time of data usage, when and where.
-Who are the “third parties” and buyers of our information.
-it doesnt givce us the rights on time, they say they can provide, but doesnt.

No, an approval is not a guideline. You need actual parents accepting for real.

I am sorry, but this is third world rights violation. they can monitorize EVERYTHING for them to sell, every single thing, if this eula (which is ilegal by laws) is appliged. If you think about it its kinda crazy.

1 Like
35

You make a valid point. I think they said this will not be available to everyone. So perhaps background check would be made but I do not know for sure.

36

Thank you for the post :slight_smile:

37

Is a world full of paywalls fun? Is it worth spending time in? From what I understand VRChat has been “working” on this for over a year. I’ll freely admit that I’ve barely played mobile games, but one advantage of being late to the monitization party is that all of the participants have had an opportunity to see how the dance routine works.

I guess with “enshitification” popular worlds might get infected with monitization, but that makes room for other worlds and creators to get attention.

38

this is getting to be a long thread.

1 and 2.) section 4. When We Disclose Information talks about when and where data might be given to 3rd partys
3.) not sure what you mean by this but you can request your data which will likely include any timestamps recorded

in the tos “If you are at least 13 but are under the age of 18, you may only use the Platform with your parent’s or guardian’s consent and your parent or guardian must provide consent after having read this TOS.”

something odd however is that vrchat did seem to remove this from the privacy policy in the old privacy policy section 7 was: 7. Children’s Privacy which said we do not knowingly collect Personal Information from children. If you become aware that your child or any child under your care has provided us with Personal Information without your consent, please contact us

however this seems to be gone, it may be a mistake

39

No, it does not say when and where, and especially WHO. We need complete list of their third parties so we can agree to eula or not, this is basic procedures.

You can ask, it says even optihnjg out (but with buts apparantly… it might not work) but it isnt provided, and it has to be before agreeing. it has to be BEFORE agreeing too, not years or months later.

No, they deleted it in purpose.

There is really 0 excuses, it is, at least right now, very shady and intrusive, everything has to be done before agreeing to EULA:

40

When publicly available avatars are featured on the Developer Update banners, could they be credited just like how the worlds currently are being credited?

4 Likes
41

The issue i also see is they’re trying to preemtively cast a wide net for systems they may or may not create. they don’t currently have constant video recording nonsense yet, but they are trying to get everyone to agree to it before they implement stuff, which is like saying “you accepted to our broad terms, this intrusive system we made after however we felt, you already agreed to!”

I don’t know if the intent is nefarious or if it’s a really bad case of Hanlon’s Razor and not having a competent layer doing the paperwork here, but as it stands it’s egregious and unacceptable. I have no desire to accept such terms, even cancelled my vrc+ because of it (which i just started).

Plus this shouldn’t be about “how much can VRChat get away with?”; VRChat should have our interest at heart, for it’s own benefit.

2 Likes
42

FWIW, I’m light on replies today because:

  1. It’s a holiday in the US (Thanksgiving!) and VRChat is takin some time off for a long weekend
  2. I’m sick :mask:

That being said, I’m still taking the time to read all your responses and feedback! The only thing I’ll add right now is that we’ve been very careful to ensure we’re within regulations for all locales we operate in, including (but not limited to) the EU, California, etc.

All of our changes have been vetted and verified with subject matter experts, as they always are with legal changes like this.

3 Likes
43

Hope you feel better soon.

The main concern here is widely more on the morality and ethics of doing so, than whether they are legally valid terms. People are questioning how much this pushes the law. Why are we pushing the boundaries of privacy at all? Why should people outside of EU etc just be SoL and have to live with being spied on? Who is benefitting from this?

Also, the seeming removal of the statement of not recording children is very alarming.

2 Likes
44

We’re not really pushing boundaries, this is actually pretty boilerplate standard stuff when compared to similar services to VRC. I get what you’re saying though, VRChat isn’t a game, its a place where people live. Conversations aren’t about K:D ratios or if you should rush A or B, it’s about life stuff. Private stuff. We understand that too, so we’re very careful and thoughtful when we make changes like this

I am not a lawyer, but from my layman’s perspective, when the EU and California make changes, most companies (including VRChat) make changes to their terms globally. While Terms might say “for EU residents” or etc, policies usually change to adhere to those regions even if you don’t live in them. Again, not a laywer, handwaving, this is personal experience and expressed opinion

Finally, the people that benefit from us saying “sometimes, in some cases, we can record data on your usage” are the victims of harm, abuse, etc that are very hard to protect when you run a service that transmits body motion and voice. Without going into detail (and I’m sure you can fill in the gaps), some terms and law violations require in-depth investigation. We already use things like server logs and analytics to help with these investigations, but that isn’t always enough.