The Unique Data Profile of Immersive Devices
Augmented reality (AR) and virtual reality (VR) headsets collect data that is fundamentally different from traditional computing devices. These immersive technologies track eye movements, map physical spaces, record hand gestures, capture facial expressions, and in some cases monitor physiological responses. The data they generate creates an intimate digital profile that goes beyond what any smartphone or laptop captures, touching on biometric, spatial, and behavioural information that is deeply personal.
As AR and VR devices move from niche gaming accessories into mainstream enterprise applications, including training, design, remote collaboration, healthcare, and retail, the volume of these devices in professional environments is growing. When enterprise AR/VR headsets reach end of life, the disposal process must account for data categories that most IT disposal policies do not yet address.
What Data AR/VR Devices Collect and Store
Eye tracking data is one of the most sensitive categories. Modern VR headsets from Meta, Apple, HTC, and others track where the user looks, how long they focus on specific objects, pupil dilation, and blink patterns. This data is used for foveated rendering and user interface interaction, but it also reveals cognitive processes, attention patterns, and potentially health information. Eye tracking data can indicate conditions like ADHD, autism spectrum traits, and early signs of neurological disorders.
Spatial mapping data records the physical environment around the user. AR devices in particular build detailed 3D maps of rooms, buildings, and workspaces. This spatial data reveals the layout of offices, homes, and other private spaces. For enterprise AR used in manufacturing or design, spatial maps may capture proprietary facility layouts and equipment configurations.
Hand and body tracking captures gesture data that is used for interaction. This movement data, combined with other biometric indicators, can create a unique physical signature for each user, essentially a movement biometric that could theoretically be used for identification.
Audio recordings from built-in microphones capture ambient sound during use. Passthrough cameras on VR headsets record the user’s physical surroundings. Both of these data streams may capture other people, conversations, and details of the physical environment without the explicit awareness of those being recorded.
User accounts and application data store login credentials, application settings, preferences, and potentially enterprise application data accessed through the headset. VR collaboration platforms may cache meeting recordings, shared documents, and participant information locally on the device.
Enterprise AR/VR Disposal Scenarios
Training and simulation environments use VR headsets that rotate through many users. A VR headset used for safety training in a mining operation might be used by dozens of workers, each leaving traces of their eye tracking data, spatial awareness calibrations, and interaction patterns on the device.
Design and engineering teams use AR headsets to visualise projects, review 3D models, and collaborate remotely. These devices may store or cache proprietary design data, facility scans, and intellectual property viewed through the headset.
Healthcare applications use VR for therapy, rehabilitation, and surgical planning. Health-related VR applications may store patient interaction data, treatment protocols, and health assessment results on the device.
Remote collaboration platforms accessed through VR headsets may cache meeting content, shared screens, and participant data locally. Enterprise metaverse applications store user avatars, workspace configurations, and interaction histories.
Data Destruction Approaches
Performing a factory reset through the device’s settings is the first step for any AR/VR device being disposed of. Meta Quest devices, Apple Vision Pro, HTC Vive, and other major platforms all offer factory reset options. However, the thoroughness of these resets varies, and for enterprise devices that stored sensitive data, additional steps may be warranted.
Deregister the device from all associated accounts and management platforms. Enterprise mobile device management (MDM) platforms that manage VR headsets should have the device removed and wiped through the MDM system before physical disposal.
For devices with accessible internal storage, consider whether the storage can be sanitised using standard NIST 800-88 methods. Some VR headsets are essentially Android devices with accessible storage, while others use proprietary architectures that are less accessible to standard sanitisation tools.
For enterprise devices that stored particularly sensitive data, such as those used in healthcare, defence, or R&D environments, physical destruction of the headset’s storage components provides the highest assurance. The value of the data on a VR headset used in classified defence training far exceeds the residual value of the hardware.
Cloud-based data associated with the device should also be addressed. Manufacturer platforms, enterprise collaboration tools, and application-specific cloud storage may retain data linked to the disposed device. Remove all cloud-stored data associated with the specific device before considering the disposal complete.
Policy Considerations
Organisations deploying AR/VR equipment should update their IT asset disposal policies to specifically address immersive technology. These policies should recognise the biometric nature of much AR/VR data and apply appropriate destruction standards, potentially treating eye tracking and movement data with the same sensitivity as other biometric information.
User awareness is important. Employees using enterprise AR/VR devices should understand what data the devices collect and how it will be handled at end of life. This transparency supports informed consent for biometric data collection, which is particularly important given the Australian Privacy Act’s heightened requirements for sensitive information.
An Evolving Challenge
AR and VR technology is rapidly evolving, with each generation of devices collecting more data in more ways. The Apple Vision Pro, with its eye and hand tracking, spatial audio, and environment mapping, represents a leap in data collection capability that will only accelerate in future devices. Establishing disposal practices for today’s immersive devices builds the foundation for handling the even more data-rich devices of tomorrow.