Mission Control: Privacy and the Xbox One

Are you giving — or, better yet, hoping to get — a new Xbox One this holiday season?  With recent news that the NSA is spying on gaming networks and Microsoft’s transparency report revealing how the company received over 7,000 demands for user information from US governments last year, it’s no surprise that privacy is on gamers’ radar. With that in mind, here’s some important privacy information that you should know on Microsoft’s new console.

The Xbox One includes some very cool gaming tools, like the Kinect, a camera and microphone that sits atop or near your TV and can record and recognize speech, facial expressions, skeletal shapes, hand gestures, and even your vital signs. But these features also mean that it is collecting and storing a lot more personal data than a traditional gaming console. Information such as facial scans and skeletal shapes are stored as strings of numbers unique to you. If you play the included app Xbox Fitness, the device records your “exercise information,” including information about your heart rate and calories you’ve burned. And, of course, your Xbox knows how you use it: are you really using that fitness app as much as you say you are, or mostly sitting down with LEGO Marvel Super Heroes or streaming a movie instead?

Once this personal information is collected, it could end up being used in a lot of ways you might not want or expect – from serving you targeting advertisements to being handed over to the government. In fact, according to the Xbox’s privacy policy, users have NO privacy rights “concerning your use of the live communication features such as voice chat, video and communications in live-hosted gameplay sessions.” Exercising your privacy rights about other data requires you to actually go through and change the default settings, so here are some important tips related to the Xbox’s privacy settings to help you control what the console collects, keeps, and sends to Microsoft.

How to tweak your privacy settings

• Head to the Settings menu. 
• Choose to “Block” recordings of your voice from being shared with Microsoft for “product improvement.” This will delete voice data stored on your console awaiting upload, not what has already been sent to Microsoft.
• Disable the “Kinect sign-in” feature, which scans your face and remembers it to enable access to the console, and select "Remove my Kinect sign-in data."
• Choose to “Reset my Kinect data” to delete the Kinect data already collected from you and stored on the console. This will not delete data that may have already been sent to Microsoft.
• Choose to use Kinect as an “unauthenticated guest” rather than an “authenticated user.” This way, a unique identifier can’t be linked to your activity on the console. Of course, the downside to this is that you won’t be able to associate your gameplay with your profile.
• Finally, if you really want to make sure Kinect isn’t even capable of connecting you to the NSA, you can disable Kinect altogether from the Settings menu. Or, as the Xbox’s privacy policy helpfully notes, you can just unplug it.

While Microsoft provides certain options regarding how your data is collected, the options are far from comprehensive. Getting a grip on all the different privacy controls requires searching menus, FAQs, and the Xbox’s detailed privacy policy. It’s also disappointing that the console collects so much user data by default and that enabling privacy-enhancing features may mean losing gameplay benefits. That shouldn’t be the case, and as the ACLU of Northern California’s speech and privacy guide for businesses illustrates, it doesn’t have to be.

You shouldn’t have to trade away your privacy just to enjoy new technology, so be sure to let Microsoft and other companies know when they forget that. In the meantime, take advantage this holiday season of the privacy settings available to you. With a few minor adjustments, you can help ensure that you can play without getting played.