User privacy protection in the metaverse

Regulating metaverse - existing and upcoming legislations

A recent report recognizes that ‘governments must enact or update legislation that limits data collection and processing’. While the GDPR regulates privacy, it requires amendments to effectively regulate the metaverse. For example, if a data breach results in the loss of cryptocurrency, there must be more accountability for metaverse owners and third-party service providers like crypto platforms, so users can transact securely.

Some regulations have been proposed. For instance, Europe’s Digital Services Act mandates the explicit mention of restrictions on data usage, while the Digital Markets Act proposes the strict regulation of organizations providing core platform services if they qualify as ‘gatekeepers.’ The EU’s Artificial Intelligence (AI) Act is likely to play a critical role in regulating the identity of avatars and related content.

Creators too will need to proactively engineer practices that run like a golden thread across the metaverse. In the days to come, we can expect countries to amend existing laws or introduce new ones to regulate metaverse privacy.

The University of Amsterdam suggested that ‘Privacy of the virtual identity can neither be adequately protected by real world privacy rights, nor by privacy enhancing technologies in the virtual platform. Therefore, virtual right to privacy should be granted to avatars in respect of their bodily, locational, and informational privacy.

Figure 2 highlights some benefits of proposed proactive meta governance. These include transparency, compliance with legislation, ability to respond clearly to stakeholders, better controls, and so on.

For cross border data security, technologies like confidential computing that facilitate protection of data in transit may be implemented. Privacy experts must ensure strict compliance with existing and proposed regulations and cross-border agreements like the GDPR Standard Contractual Clauses. Practices like transfer risk assessments and data privacy impact assessments can help mitigate privacy risks.

Privacy experts must ensure strict compliance with existing and proposed regulations and cross-border agreements like the GDPR standard contractual clauses.

Children, who are more vulnerable to privacy risks, must be protected through a well-designed ‘techno-privacy protection’ approach. There must be controlled access for children with explicit parental consent, and real-time data transfer to ensure transparency. For instance, if a child assumes the avatar of an aggressive character, messaging alerts can be sent to parents. Such practices however must comply with established technical standards and regulations.

From a contractual due-diligence perspective, there must be well-defined and documented clauses between stakeholders. Agreements between metaverse creators and virtual asset service providers must include well-constructed anti-money laundering clauses, so parties will co-operate with investigative agencies in the event of a data breach. Similarly, since blockchain does not support data deletion, NFT transaction details may get permanently recorded. A privacy notice must inform users that they may not be able to exercise the ‘right to be forgotten’ after transacting virtual assets.

Advertisements in metaverse must be strictly regulated via a combination of technical and regulatory solutions like privacy-by-design, architectural security, and consent. Personal data must not be misused for targeted advertising. If a user interacts with a brand as an avatar, the PII obtained must not be utilized to identify the real user for the purpose of selling products in the physical world without their express consent.

In the metaverse, blockchain may require improved designs. While smart contracts enable both secured and permissionless transactions, additional rules in terms of child consent may still be required. The protection of cryptocurrency and virtual asset data also necessitate a well-defined strategy. For example, if integrated metaverse platforms provide initial coin offering (ICO), each participant must verify that user PII is not compromised.

While some countries have recognized cryptocurrencies, many others like India and China have not. This may create a complex situation, and to overcome such challenges, metaverse developers must proactively participate with governments and international bodies to develop universally recognized protocols and make them legally binding to mitigate potential risks.

Although blockchain provides decentralization and pseudonymity, issues may occur if data is shared with investigative agencies (mandatory disclosure). Cross-border investigations involving metaverse must be safeguarded by treaties that take a balanced approach between investigative powers of agencies and protections of persons’ privacy and human rights. Adopting adequacy agreements may also aid in lowering the hazards associated with cross-border data exchange. 

Lastly, handling real-time data will require both technical and regulatory due diligence. While confidential computing and AI techniques may be used for real-time data anonymization, regulatory diligence may come via well-structured privacy and legal frameworks. Some measures may include defining the foundations of privacy in the early stages of design and development, while considering users and stakeholders’ interests and concerns.

Toward enhanced security

While it may not be possible to foresee all the privacy risks that emanate in the metaverse, adopting the practices discussed above, especially while designing the metaverse can help in eliminate and mitigate major risks. Further, the EU’s ‘Guiding Principles on Business and Human Rights’ may be expanded to include privacy protection, since many nations view the right to privacy as a basic right.