There's been talk about them not even needing your video feed data, that's too heavy to constantly send to their servers. They can just get your movement data, which is pretty unique to each user. So basically without logging in and just putting on the headset they know exactly who's using it.
They have zero competition though and that's a problem. Their headsets are like a gift from the devil. Too good to pass up, but you know it's wrong.