Mixed reality (MR) technologies are emerging into the mainstream with affordable devices like the Oculus Quest. These devices blend the physical and virtual in novel ways that blur the lines that exist in legal precedent, like those between speech and conduct. In this paper, we discuss the challenges of regulating immersive technologies, focusing on the potential for extensive data collection, and examine the trade-offs of three potential approaches to protecting data privacy in the context of mixed reality environments.