Virtual reality – a site of renewed interest for major players in the tech industry – is increasingly one fraught with questions of data capture. This article examines the case of the Facebook owned virtual reality company Oculus and its intensifying privacy and surveillance risks with respect to the data generated and gathered through its devices. To explore the surveillance-centred structures of Oculus, this article examines Oculus’ privacy policies from December 2014 (the first version following the company's acquisition by Facebook), and October 2020 (the most recent iteration of the policy). In so doing, we examine these policies as sites of discourse, asking how they frame and afford power and control to Facebook, and position Facebook and Oculus’ surveillant aims and logics relative to societal concerns about, and regulations of, data.