Publikations-Information

Download

Shady Mansour, Verena Winterhalter, Florian Alt, Viktorija Paneva
A Multi-Layered Privacy Permission Frameworkfor Extended Reality
In NSPW '25: Proceedings of the New Security Paradigms Workshop. January 01, 2026. Association for Computing Machinery, New York, NY, USA. (bib)

Extended Reality (XR) systems bring arrays of sensors closer to the user's body, enabling the collection of extensive user and contextual data, from motion and biometrics to behavioral analytics, that users might not be aware they are sharing. This poses significant risks to users' privacy. Yet, despite the immersive and dynamic nature of XR, most platforms still rely on static, text-based privacy mechanisms inherited from traditional 2D interfaces. We \newpropose a new paradigm of \textitcontinuous consent in XR, where privacy decisions unfold as a relational, context-aware, and renegotiable process embedded in the experience -- not a single consent event. To this end, we propose a \emphMulti-Layered Privacy Framework spanning five interdependent layers: regulatory compliance, technical implementation, permission models, user experience, and user perception and cognition. We then introduce the \emphUser Privacy Journey Model, which operationalizes the framework as a sequential user pathway: from onboarding and contextual prompts to in-experience control and post-session review, along with the \emphXR Privacy Checklist to support practical adoption. By rethinking consent as a continuous journey, we present a new paradigm for XR privacy, one that opens a new research perspective on what "informed" consent means in immersive environments where the boundaries between self, system, and space are increasingly blurred.