The use of virtual reality is still very limited for people, although the success of entertainment devices, like the Wii, proves that if one can diminish the price of the hardware, there really is a market for such tools. Multicore processors, computers with more than one graphics card, high performance graphics processors are already available for the general public. In <st1:place w:st="on">Western Europe</st1:place>, Very High Speed DSL (VDSL) networks are available almost everywhere (at least in most urban areas), which allow users to easily reach databases containing standardised descriptions of virtual worlds. All these tools provide an indication that virtual reality could soon enter into our homes and be widely popular. Virtual reality could be quickly and widely adopted as soon as it has found its killer application, that is, the application that would convince enough people to buy into it.<//font>

During breakfast David sees that the fridge is almost empty. Moreover, the list of important things to buy, which is stuck on the door of the fridge is very long. He probably has to go shopping today. He has always considered this activity as being very boring, and even if the high-tech supermarket shop-bots may do a lot of the work, he does not rely on them. They are rarely very good at choosing the big red tomatoes or a sweet smelling and juicy melon.
Even if most of the time people nowadays go themselves to the shop, some supermarkets offer a virtual shop to their customers which one can visit using a virtual reality (VR) system. This virtual reality system is mainly a VR-suit that, at first sight, one may mistake for a diving suit. It is made of special material to fit as snugly as possible to the body and is equipped with a lot of sensors and effectors. The suit consists firstly of the helmet, which has a high resolution retinal projector, allowing the user to have a real three-dimensional view of the environment. Into the helmet, one may additionally build in a high-performance sound system which gives very precise information for locating elements of the environment. The latest generation of helmets even has a scent diffusion system integrated. Based on a similar idea to an imaging system, one can, mixing a limited number of base odours, reproduce a great range of perfumes.
The second part of the suit is the pair of gloves. These gloves are haptic devices allowing the user to “touch” the things he sees. Using these gloves, David can feel the form of the object, its rigidity and temperature, but not texture. The suit itself is also a haptic device. The arms may behave more or less rigidly to simulate the weight of the object which David touches. It may also simulate some external contacts to different parts of the user’s body, letting the user know when he touches a (virtual) object in the environment.
Watching the technology channel, David has learned that some laboratories are working on an “extension” of the suit. This extension will consist of a cortical interface which should help the user feel the velocity and acceleration, perhaps not so needed for his supermarket experience, but very handy for playing games like aeronautical fighting. Another advantage of these cortical interfaces is that they should diminish or even remove the famous “cyber sickness”. But not all people agree with this new aspect. In the newspapers one can regularly read some letters to the editor (even from university professors and recognised scientists) arguing that these interfaces could allow the firm that produces them to take control of the brain of their users, for example by influencing their political opinion or changing their shopping behaviour. During the 20th century there were many warnings of the possible use of subliminal pictures in advertising, but no one was really able to prove it. But this fear seems much more serious now. As such, David chooses not to have such options.
Before wearing his suit, David chooses a supermarket, and feeds the list of thing he has to buy into his computer. He is totally aware that everything he buys in this shop could then be used (and probably will be used) to profile him and his family. For example insurance companies use profiling to check if someone is eating too much sugar or too many “rich meals”. The laws do not allow a firm to ask a potential female employee if she is pregnant, but knowing – through profiling – that she has recently bought some pregnancy tests may be a sign the she will need maternity leave in the near future.
To protect against these more or less aggressive profiling methods, David has on his computer a program which warns him if he deviates from an “average Joe” profile. This is surely not a perfect solution, but better than nothing.  Moreover, whenever possible he always tries to reach the best anonymity he can. But, for the present case, where the things he wants to buy should be delivered to his home, it is necessary to reveal his real name and address. For activities like shopping, David should be registered, and so his personal data are stored in a database at every shop (or at least every chain of shops). To lower the risk of profiling, every member of the family shares the same virtual identity. This means that the shopping platform is not necessarily able to distinguish David from Li-lian. It can try to infer if the virtual shopper is a man or a woman, based on some standard profiles, but it will never be totally sure of the real identity of the family member who is actually present.
When he has his suit on, he starts the program which opens for him the doors of the virtual supermarket. He can then walk along the aisles between the shelves and pick whatever he needs. But, unlike real shops, he regularly sees some items jumping out of the shelves and “dancing” in front of him or calling him. Why precisely theses items? Because, in virtual reality, one can profile the customer in much more detail than is possible in real life. Here, the system may be aware of everything David has touched or even seen in the past within this supermarket (or even other ones which collaborate). The supermarket has very precise information about the type of package (colour, size or form) David likes, and then may propose (or impose) a customised shop, built to attract the eyes of David and convince him to buy more than he planned. For example, there is stracciatella gelato in the middle of the path, blinking and calling him. The ice cream was not on the list he entered but he loves stracciatella. Since he was a kid this was always his favourite. He picks up the box to add it to his shopping cart. Immediately a red light is blinking at the tip of his finger. This is his anti-profiling program which is warning him that he has already bought too many sweets, and his health insurance company may consider that all this sugar is a sign to check if his family should be switched to a bad risk customer category. He is now informed that if he wants another dessert, he has to go to buy it in the real world and pay in cash. One can note here that in this situation, the virtual world acts as an interface between the real world where David lives and the real world where the goods are. What David sees in his virtual shops are, for example, real fruits. This is necessary to allow him to choose the sweet smelling melons he loves.
When David has collected all he needs, he is ready to pay. Another advantage of virtual shopping is that there is no need to wait in the queue of the checkout. At the end of every aisle, there is a (virtual) button which will automatically establish the bill of the customer. The identification of the user is done by the different biometrical sensors embedded into the VR-suit. The data of David’s credit card are already known by the supermarket and within seconds, the billing process is finished.
The goods he bought will be delivered during the afternoon to his home.
Before he takes his helmet off, the idea of planning the next holiday with his family crosses his mind. Looking at the catalogues of travel agencies is very interesting, but, using an immersive tool to check “directly” the view of a beach in the Caribbean is much more exciting. He just wants to have a quick glance and not have to identify himself. Therefore, he disables the identifying process in his computer. Pointing a finger at the top displays a menu in front of him. He then just has to point his finger to the needed functionality to make him almost anonymous. Then, he can walk along the beach and check which hotel he would like to book for his holidays. While anonymously walking on the beach, the information he gets on the hotels, their advantages or actual room prices are not personalised and, for example, no discounts (based on e.g. recent stays in the same hotel company) are available. When he has selected his favourite hotel, he can still identify himself to look at the discounts etc. available, but for now, he prefers to stay anonymous in order not to get too much unwanted advertising over the coming days.
For this situation, the virtual word in which David walks is probably not the real world around the area where he plans to spend his vacations. For the purpose of advertising, the company has probably chosen a day where the weather is nice and sunny, where the season shows a nice environment, etc. They may however claim that it is virtually the same!

The use of virtual reality is probably one of the less dangerous emerging technologies from the point of view of privacy. The use of a standard computer, equipped with anonymisation programs, anti-profiling programs and strong cryptographic mechanisms should provide a level of security which is probably sufficient for “all-day” use. As explained in the scenario, the weakest points are the operations where the user has to explicitly give real details. Clearly, the differences between identification, authentication and authorisation are of major interest here and must be openly communicated for the user to be able to have influence on the profiling processes or better on the data available to such processes.
There are links between the virtual reality situations as described above and Ambient Intelligence (AmI), some of the problems are shared, typically the issues with respect to privacy and profiling. In both situations shops or other suppliers are interested in giving appropriate treatment to the client, in the case of virtual reality, the client is only virtually present at the shop whereas in AmI, the client is physically present in the shop. In both situations, profiling might be a central issue for “appropriate” services. With the actual possibilities of “enhanced” reality using, for example, head-mounted displays with semi-transparent mirrors, there is no real border anymore between these two.
The FIDIS NoE has discussed several concepts related to the presented scenario. Issues with respect to AmI have been discussed in D12.2: ‘Study on Emerging AmI Technologies’ and D7.9: ‘A Vision of Ambient Law’. The impacts of RFID have been a central issue in D12.3: ‘A Holistic Privacy Framework for RFID Applications’, and – more generally – brain interfaces are discussed in D12.6: ‘A Study on ICT Implants’. Aspects of profiling in general are covered in D7.3: ‘Report on Actual and Possible Profiling Techniques in the Field of Ambient Intelligence’ and especially also in D7.5: ‘Profiling the European Citizen - Cross-Disciplinary Perspectives’. Identification and the respective technical aspects are also of major interest for VR scenarios, as explained above in the context of a payment using a simple credit card. Typically, as one is using a VR suit, biometric identification might be easily implemented. D3.10: ‘Biometrics in Identity Management’ focuses thereon. The presence of a virtual character in a virtual shop is similar to an avatar in a game. This kind of “virtual identity” is described in D2.13: ‘Virtual Persons and Identities’. Further elements of “virtual identities” are discussed in the deliverables of WP17, e.g. D17.1: ‘Modeling New Forms of Identities’.