They include messaging with your Oculus pals, along with photo and video sharing and livestreaming to Facebook. You can create events to set up a time to play games with your buddies or arrange meetups, and form parties that all your Oculus friends can join (parties were invite-only until now). Your Facebook friends will also be able to group up with you in VR when you send them links via Messenger.

Oculus says to use these features — and existing ones such as joining parties, adding friends and visiting people’s Homes — it’ll ask you to sign in with Facebook, which powers the social interactions. Facebook has updated the Oculus Privacy Policy to clarify that.

You won’t have to log in with Facebook to use the VR platform. If you do, you’ll still keep your existing Oculus friends, username and profile. You can decide to display your real name (as per your Facebook profile) on Oculus and whether to automatically add your Facebook friends as Oculus contacts. You’ll have control over what you share from Oculus to Facebook as well, along with who can see those posts.

It’s worth noting that if you do sign into Facebook on the VR platform, the former will tap into your Oculus data to power the social features, as well as recommendations and ad targeting. It might suggest things like VR events you might be interested in and ads for apps on the Oculus Store. The privacy policy changes won’t affect third-party apps and games. An FAQ spells out the types of data Oculus and Facebook will share if you connect the accounts.

The ties between Oculus and Facebook services will deepen over time, with new features such as Facebook Group sharing options and watch parties on Quest on the way. A beta for the Facebook Horizon social VR world is also slated for next year.

Twitter has finally made a change users have been waiting a long time to see. No, it’s not editable tweets, but as of today everyone can enable two-factor authentication on their account without linking a phone number.

While SMS-based two-factor can be a fallback for people who lose access to code-generating devices or don’t have security keys, it’s very vulnerable to SIM-swapping attacks. Twitter added code generator support a while ago, but still asked users to add a phone number if they wanted the extra verification and you couldn’t remove the fallback. That’s upsetting for those concerned about their privacy, they may not want to link a phone number to their account at all, and Twitter has already admitted that it used phone-numbers to target ads even for users who declined that.

Attackers used SIM-swapping to send tweets from Twitter CEO Jack Dorsey’s account earlier this year, and while the exploit didn’t use two-factor codes, it showed how vulnerable the SMS-based system can be. If you already have a phone number linked in your profile, then you can go ahead and remove it now. However, a security engineer noted that you can’t remove the number and rely simply on a security key for access since that’s only supported on the website.

Under the updated terms and conditions, which Facebook confirmed to TechCrunch will apply worldwide, the company is also amending its policy on the limitation of liability. It “now acknowledges its responsibility in case of negligence, for instance in case data has been mishandled by third parties.” Essentially, it’s on the hook for any future Cambridge Analytica-esque data misuse scandals — the European Commission asked Facebook to change some terms in the wake of that affair.

Facebook is also giving up the right to “unilaterally change terms and conditions by limiting it to cases where the changes are reasonable, also taking into account the interest of the consumer.” It will only be able to retain content you’ve deleted under certain circumstances — for instance, up to 90 days for technical reasons, or when authorities make enforcement requests. Additionally, Facebook will have to amend the “language clarifying the right to appeal of users when their content has been removed.”

It agreed these changes with the EU in part to bring its terms in line with the bloc’s consumer rules. The European Commission and Consumer Protection Cooperation Network (a cross-Europe enforcement network of national consumer authorities) will keep a close eye on how Facebook implements these new terms. It will have to make the changes by the end of June. Otherwise, it could face penalties from regulators. Facebook will share more details on the updates as it rolls them out over the next few months.

The EU noted it has also asked Twitter and Google+ to update some of their terms, though the request for the latter to do so is now moot after it closed down this month in the wake of a mass data leak.