Metaverse privacy concerns and how to address them

How does the metaverse work and does it account for data privacy?

The metaverse is a virtual environment in which people -- avatars in metaverse terms -- can connect, interact and make transactions. This convergence of the digital and physical world stems from the Greek meta, meaning beyond or after, and verse, short for universe.

There are the two main forms of the metaverse:

1. Virtual reality. VR provides an artificial reality, typically using a headset that takes over the user's field of vision to provide an immersive experience. Immersive experiences include audio and positional tracking of the body to enable movement of body parts, such as the hands, to interact with the virtual environment.
2. Augmented reality. AR is less immersive than VR. It adds virtual overlays on top of the real world using a lens of some type. Users can still interact with their real-world surroundings. AR examples include a smartphone using the Waze app in which the host can see a user's location and guess their intentions.

Currently, there are no regulations or governing bodies tackling the privacy concerns that go along with new technology. This includes the metaverse's two core technologies -- VR and AR -- that use potentially intrusive sensors and data collection.

How could metaverse data privacy issues affect businesses and users?

For businesses jumping into the metaverse as property owners or renters, it's important to be aware of two main dimensions of privacy: the privacy practices of the platform owners that host their property and -- on top of that -- their own privacy policies that they'll adhere to.

These two policies need to be aggregated and distilled into a privacy framework that customers can understand. The lack of a regulatory framework makes this challenging, yet without this aggregation, the business runs the risk of a privacy incident causing reputational damage that could go beyond the metaverse world and into the real world.

Consumers are even less aware of what metaverse privacy means, so businesses that take a leadership role in explaining this concept in simple terms at its infancy can build a robust and loyal customer base.

What metaverse privacy issues should you be aware of?

Some of the main privacy issues in the metaverse that businesses and their customers should be aware of include the following:

• Lack of privacy regulations.
• Intrusive and extensive data collection.
• Users' data rights and ownership.
• Interpreting current regulations in the metaverse world.
• User-to-user privacy.
• Minors' privacy concerns.

What can you do to mitigate these concerns?

Businesses can take the following actions to mitigate privacy concerns in the metaverse. Users should also ask about these actions when vetting privacy policies in the metaverse.

Provide a privacy policy tailored for your business

Much like in the connected real world of today, metaverse property owners or renters making their services or products accessible to third parties -- i.e., customers, partners and guests -- must provide a privacy policy. The privacy policy should be clear and easily understood by customers -- and strictly followed by the property owners and renters.

Note that some of this information might already be part of the hosting metaverse platform provider's policies. However, as a property owner or renter, your customers are your responsibility, and you need to augment the metaverse provider's platform policy with your own practices based on the features and services your property provides.

Create a viable metaverse privacy policy

A metaverse data privacy policy needs to state in a human, understandable fashion what data is collected and for how long. Types of data include the following:

• Sensor data.
• Location data.
• Physiological data.
• Social data.

The policy must also spell out users' rights to access, download and purge their personal data.

Manage asset ownership

Content generated by users in the metaverse -- referred to as virtual digital assets -- is varied, unique and can run the gamut from non-fungible tokens to avatar skins. As noted above, malicious users assuming fake identities can cause havoc by usurping and claiming content ownership. The result is customer distrust of the property and dissatisfaction. Implementing technologies such as blockchain for asset ownership tracking is one way to manage content ownership and ensure the privacy of ownership of assets.

Apply existing data privacy regulations

Since the metaverse is available worldwide, the traditional definition of data locality and the privacy regimes based on locality as defined by GDPR, for example, aren't entirely applicable. For instance, if an EU citizen decides to check out a U.S. property hosted by an Australian platform, all three privacy regimes could be applied. To mitigate risk, it's recommended that platform owners, property owners and renters rely on the aggregation of the strictest privacy regulations. This might not be feasible for expediency and cost reasons, but if this practice isn't followed, the risk level shoots up.

Enforce user-to-user privacy

Unlike the real world -- where spying on people and illicitly using that data might be obvious -- recording and sharing data without participants' knowledge is perfectly easy to do in the metaverse. Due to a lack of regulations, there are no penalties or repercussions for doing so. Since metaverse avatars could be minors, there's a critical need for strict checking to prevent abuse in user-to-user communication. The onus once again lies with the platform owner, property owners and renters to spell out that unauthorized collection and sharing of data isn't permitted and that there are penalties for doing so.

The future of data privacy in the metaverse

The future of data privacy in the metaverse will be determined not by regulatory bodies or governments, but by businesses and consumers.

The following are three likely scenarios:

1. Large businesses that are forward-leaning and have a customer base they need to preserve and grow will take a proactive stance and create a privacy bill of rights for their customers. This also enables proactive businesses to dictate which metaverse platforms they will select based on adherence to these principles.
2. Businesses building properties on the metaverse will play second fiddle to metaverse platform owners. Businesses that don't invest the time or energy in understanding what the privacy policies of these platforms are will remain at risk even as they invest more time and budget in the metaverse.
3. Big tech metaverse platforms such as Meta will continue to dictate what data privacy is and isn't. Both the businesses and consumers of these platforms -- who are the source of massive amounts of valuable user data – will be merely spectators as these policies unfold.

Ashwin Krishnan is a technical writer based in California. He hosts StandOutin90Sec, where he interviews cybersecurity newcomers, employees and executives in short, high-impact conversations.