arXiv: Beyond GDPR: Examining Disclosure Gaps in Mobile AR Privacy Policies under U.S. State Privacy Laws

This paper, published on arXiv in July 2026, is a research study that examines how mobile augmented reality (AR) applications disclose their data practices under U.S. state privacy laws, comparing these practices to the standards set by the EU’s GDPR. The study identifies significant disclosure gaps, particularly in how AR apps collect sensitive biometric and spatial data, often failing to provide clear, specific notices or obtain proper consent. While the paper does not represent a regulatory change itself, it highlights a growing enforcement risk for companies operating across both U.S. and EU jurisdictions.

Organizations most affected are developers and publishers of mobile AR applications, as well as any company integrating AR features into their platforms. This includes sectors like retail, gaming, healthcare, and advertising that rely on immersive technologies. The findings suggest that current privacy policies for AR often fall short of GDPR’s transparency and consent requirements, exposing these firms to potential fines and regulatory scrutiny from EU data protection authorities, especially as EU regulators increasingly look at emerging technologies.

Compliance teams should immediately conduct a gap analysis between their AR app’s data collection practices and the disclosures in their privacy policies. Focus on biometric data, geolocation, and camera-derived information. Update consent mechanisms to meet GDPR’s explicit consent standard, particularly for sensitive data. Finally, monitor EU regulatory guidance on AR and prepare for potential harmonization efforts between U.S. state laws and GDPR, as this paper signals a likely area of future enforcement.