Online concerns about the Oculus Rift’s Terms of Service have made their way to the Capitol.
Sen. Al Franken (D-Minn.) sent a letter Thursday to Oculus CEO Brendan Iribe, seeking clarification on how the Facebook-owned company collects and intends to use personal data.
That comes after online forums and media outlets have noted that Rift owners, before strapping the VR headset on, must agree to a number of unusual stipulations, including Oculus reserving the right to collect user physical movement and locational data and all activity on Oculus-hosted servers. The terms also suggest that all data collected by the Rift could possibly be shared with Facebook (FB).
That’s enough to spur action by Franken, a noted privacy rights advocate. In his two-page letter, he asked Iribe to be much more specific about what data is being collected and how it’s being used.
“I appreciate that Oculus’ privacy policy provides detailed information about what data are collected, when they are collected, and with which companies they are being shared,” he wrote. “However, questions remain regarding Oculus’ data collection of certain types of information and Oculus’ relationships with third parties.”
Get Data Sheet, Fortune’s technology newsletter.
Over six questions, Franken asks how user data such as location, communications, and physical movement are being used and what precautions are being taken by the company to protect this data. He also inquires about how long Oculus plans to store the information and whether it’s being sold to third parties.
And while Franken doesn’t name Facebook directly, he asks pointed questions about data sharing between Oculus and its “related companies.”
Also not included in Franken’s note or other conversations about the terms of service are how they might impact Samsung’s Gear VR, a product that uses Oculus technology. Gear VR is a very basic headset compared with Rift—and all content comes through Samsung phones via an app. What’s not clear is what information is shared with Oculus and how that information is used.
For more on privacy, watch: [fortune-brightcove videoid=4834098711001]
While the Rift’s Terms of Service are in the spotlight, HTC’s (HTC) Vive has largely escaped scrutiny. That’s, in part, because most software sales are coming from Valve’s Steam digital distribution system. And Valve’s privacy policy clearly states the company “will not share any personally identifiable information with third parties for marketing purposes without your consent.”
HTC has its own “Home” hub for Vive users, but it’s neither heavily promoted, nor seemingly frequently used (or even installed) by the limited number of people who currently own a Vive. (The company has not posted a Vive-specific terms of service or privacy policy on its website.)
