Legal implications of metaverse

LEGAL IMPLICATIONS OF METAVERSE

By Shailja Vikram Singh, Intern, Seth Associates

Keywords- cyberlaw, Artificial intelligence, Metaverse, cybersecurity, data protection , personality rights

INTRODUCTION

A universe that is beyond what we currently know, that is driven by an amalgamation of different technologies comprising Virtual Reality (“VR”)^[1], Augmented Reality (“AR)^[2]AI, blockchain, and so on, is here to present an immersive experience to provide an extended form of the Cyber-Physical Social System wherein the physical systems, human society, and cyber systems are all interconnected. Metaverse, a portmanteau of the Greek prefix “Meta” (beyond) and the universe, is still in its nascent stage of development and is ambiguous on what kind of technologies will ultimately give it a shape. It is expected to evolve through four broad stages. It is currently in its first stage wherein the users will be able to experience visuals and sounds in the Metaverse. The second stage aims to involve touch-enhancing hardware and movement to enable further sensory immersion. Thereafter, the third stage is expected to use advanced VR to simulate activities by transferring information directly to the brain via neural signals which is currently being explored by Elon Musk’s Neuralink^[3]. The final stage is envisioned to completely merge the physical and virtual worlds with the help of advanced neurotechnology.

As the tech giants, businesses, and investors are grappling with the complexities and ambiguity of      Web 3.0[4] and Metaverse, several legal challenges are also rapidly evolving, thereby altering how laws and legal rights were being comprehended till now. Justice Stephen Breyer rightly highlights the importance of analysing law in tandem with evolving technology through his statement, “In this age of science, science should expect to find a warm welcome, perhaps a permanent home, in our courtrooms… Our decisions should reflect a proper scientific and technical understanding so that the law can respond to the needs of the public.”

Therefore, it is crucial to navigate the legal challenges posed by the evolution of Metaverse and fully realise it in this emerging space of virtual reality which not only blurs the line with the physical world but also the jurisdiction of the law.

This article will highlight the legal implications of Metaverse with respect to data security and privacy, Intellectual Property rights, antitrust and competition, decentralised finance, M&A, and other investment activities as well as civil law principles and personality rights. It will further assess the current regulatory frameworks in India and abroad with regard to Metaverse and how the same must be evaluated.

KEY LEGAL IMPLICATIONS

1. DATA SECURITY AND PRIVACY

User data forms a valuable component of the Metaverse as it indicates a greater integration of technology into the lives of individuals. Since interoperability also forms a significant part of Metaverse, user data would be at risk of exploitation as it will be transferred across national boundaries for data processing. Therefore, obtaining valid consent from individuals should be made a priority. Further, large quantities of sensitive data are collected by the companies operating in Metaverse as they record user movements, brainwave patterns, eye, and facial movements as well as the dilution of pupils. Such information is used to enhance user experience as it helps to analyze user behavior, consumption habits, and personality traits and also predict what decisions the person will make in the next three seconds. There is, thus, a risk of security and privacy breach in the Metaverse as cybercriminals can hack into the system which can lead to misuse of user data and identity theft. They can also gain access to digital assets or restrict access to them by encrypting access keys. Moreover, since user identity is linked to its Avatar, there have been instances of mental and emotional harm caused to the individuals behind those Avatars due to being subjected to sexual harassment and assault. All of the above-mentioned challenges may require the enactment of Metaverse-specific regulations or present laws to be integrated and implemented into the new virtual reality.

In India, the right to privacy is regulated through the Digital Personal Data Protection Act, of 2023 which could be considered in cases where the privacy rights of digital avatars are violated. No personal data shall be processed by anyone without obtaining free, specific, and informed consent of the Data Principal which would be limited to a specified lawful purpose for which the same has been processed, as stated under section 6 of the Act. Chapter III on the Rights of Data Principles enables individuals to access their data and seek information on how it is being processed. The Digital India Act is being proposed and expected to replace the IT Act, of 2000, wherein it aims to ensure online safety and trust and define and regulate high-risk AI systems.

The UK has enacted the Online Safety Act, of 2023, aimed at protecting children and adults from harmful content as well as identifying and deleting illegal content. Part 3 of the Act imposes duties of care on providers of user-to-user services and search services, Part 4 imposes further duties on providers of user-to-user services and search services, and Part 5 imposes duties on providers of internet services (including user-to-user services and search services) that publish certain pornographic content. Section 12 of the Act on Safety Duties Protecting Children includes provisions on protecting children by making social media platforms remove illegal content quickly or prevent it from appearing in the first place, preventing children from accessing age-inappropriate content, enforcing age limits, and age-checking practices.

The General Data Protection Regulations (“GDPR”) ensures data security and privacy by requiring companies that collect and process data to provide transparent privacy notices to users (Article 13&14) and obtain their explicit consent (Article 7) to collect and use their information. The EU has also introduced the Artificial Intelligence (“AI”) Act, laying the foundation for regulating artificial intelligence in the EU. The Act applies to the providers and developers of AI systems marketed or used within the EU. It makes existing EU laws on data protection and security applicable to the collection and processing of such data for AI-based technologies. Chapter II of the Act lays down prohibited AI practices such as AI systems that scrape facial images from the internet or CCTV footage, infer emotions in the workplace or educational institutions, and categorize people based on their biometric data, AI systems that manipulate people’s decisions or exploit their vulnerabilities, systems that evaluate or classify people based on their social behavior or personal traits, and systems that predict a person’s risk of committing a crime and so on. Article 16 on Obligations of Providers of High-Risk AI Systems, under Chapter III of the Act, states that companies providing high-risk AI systems must follow certain rules and ensure that they meet specific standards, have quality management systems, etc.

Data Act has also been introduced by EU, providing legal clarity on access to and use of data. This Act aims to ensure that users have control over the data generated through their connected devices (Internet of Things). Under Chapter VIII of the Act on Interoperability, a feature that constitutes a significant part of Metaverse, the participants in data spaces are required to fulfill criteria to allow data to flow within and between data spaces. Relevant standards and specifications for cloud interoperability will be laid down by an EU repository. The Data Act compliments the right to data portability under Article 20 of GDPR, by allowing users to share data with third parties.

1. INTELLECTUAL PROPERTY RIGHTS

There are two major IPR challenges raised by Metaverse, one being the IP infringement with respect to tokenised work of art created on Metaverse via NFT (“Non-Fungible Token”) technologies and the other on the question of authorship of the work. While the graphical, musical, and software work created on Metaverse shall be subjected to the same IPR and copyright laws as that of the physical forms of Intellectual Property, the tokenised work purchased in the Metaverse does not allow the purchaser to acquire its copyright and does not allow it to use it in any manner other than one prescribed by the copyright law. The Copyright infringement does not arise on the tokenisation per se but on the online display of work as a token in the Metaverse. Furthermore, on the question of authorship of the work, it is helpful to draw an analogy from the copyright practice of pseudonymous works (section 54(b) in the Copyright Act, 1957) wherein the individual behind the pseudonym shall be its copyright owner. Similarly, even though an Avatar is a virtual person, the copyright in works created by the individual behind it should belong to him/her. However, it is to be questioned as to how it is proved by the creator via their avatar that they are the author of the work.

Several major companies have filed applications for trademarks in the Metaverse. McDonald’s had filed 10 applications with the US Patent and Trademark Office for the McDonald’s brand and McCafe. Beauty and luxury brands like Victoria’s Secret and Hermes have also filed trademark applications and entered the metaverse space.

1. ANTITRUST AND COMPETITION

The bulk of anti-competitive practices occurring in the Metaverse can go undetected by regulatory authorities due to the blockchain technology used in it. This will enable the corporations to indulge in such anti-competitive activities with impunity. Such anti-competitive firms may further adopt private blockchains and share sensitive data such as price-related details among the ones with the authorisation of the blockchain owner, thereby allowing it to go unprosecuted by the authorities.

1. M&A AND OTHER INVESTMENT ACTIVITIES

Even though Metaverse has not taken its final form yet, investors and businesses are pouring hefty amounts of money into this growing technology. Large amounts of capital investments would be required in digital assets, digital content as well digital infrastructure such as 5G and fiber network, for the successful implementation of the vision behind Metaverse. There have been significant Venture capital investments, up to $10 billion,  across the gaming sector, augmented reality, and virtual worlds. Major M&A activities are expected to be in the gaming industry, for instance, Microsoft announcing a $75 billion deal for the gaming company Activision Blizzard in 2022, followed a week later by Sony’s $3.2 billion acquisition of Bungie. Further, Metaverse-related IPOs and SPAC (“Special purpose acquisition companies”)^[5] are also expected to be seen in the future.

1. DECENTRALISED FINANCE

Decentralised finance (“Defi”) goes behind traditional national currencies and involves digital currencies like cryptocurrency, as well as virtual economies and virtual real estate. Large amounts of money are spent in the gaming sector on virtual items like avatar skin. A ‘play to earn’ model is also offered on these gaming platforms wherein players can earn digital currencies by playing. A game called ‘Axie Infinity’ saw its player base grow from 30,000 to a million in a few months in 2022. Such activities lack regulation and therefore pose a risk of criminal activities, like rug-pulling (scams where developers abandon a project after taking investors’ money) and gold farming (earning in-game currency to sell for real money).

1. CIVIL LAW PRINCIPLES AND PERSONALITY RIGHTS

Individuals on Metaverse are represented by their avatars, with different physical attributes presented in the form of graphical illustrations. They allow the users to interact anonymously which allows them to have reduced accountability with respect to their behavior on the Metaverse. This complicates how, the person who has been wronged can seek remedies under civil law, and legal liabilities are imposed on the individual, particularly, when such avatars do not fall under any one jurisdiction. Avatars have the liberty to be involved in activities that might be unacceptable in the offline world or misrepresent an individual by altering its avatar thereby leading to defamation. Several outrageous activities like robbery, theft, shooting, etc. which form part of the gaming culture may influence the physical world and therefore be required to be differentiated from acceptable contextual behavior. Furthermore, if the individual behind an avatar dies, there is no certainty as to who will have access to its digital assets. Also, several questions are raised regarding the personality rights of the individuals in the Metaverse, for instance, upon their personal data being hacked or misused, whether the personal data relates to the virtual avatar or the individual. Can an avatar be sued for infringing upon the rights of another avatar? There are several complex legal questions that do not have a clearly defined answer yet.

The Centre for Countering Digital Hate (CCDH) recently conducted an investigation wherein researchers, represented as minors, used platforms like Oculus and VR Chat ^[6]within Metaverse and observed instances of abusive behavior occurring every seven minutes. As per a survey conducted by Extended Mind and Pluto VR  in 2018,  nearly half of female VR users reported being subjected to sexual abuse within the virtual space. These instances of sexual misconduct within the immersive virtual environment cause mental and emotional turmoil to the victim as well as exacerbate the trauma faced by victims of sexual harassment in the physical world.

However, the provisions of criminal laws cannot be extended to real-life instances as the penal code only applies to living persons and not to digital avatars, thus, specific laws must be framed to address crime taking place in Virtual Reality. Therefore, digital avatars should be considered as an extension of a living person’s identity which would render certain provisions of the IT Act, 2000 such as section 66E (punishment for violation of privacy) could be extended to acts violating the privacy of avatars, section 66C (punishment for identity theft), 67 (punishment for publishing or transmitting obscene material in electronic form), 67A (punishment for publishing or transmitting of material containing the sexually explicit act, etc.,) and 67B (punishment for publishing or transmitting of material depicting children in sexually explicit act, etc., in electronic form), applicable to the digital avatars. The new criminal law, Bharatiya Nyaya Sanhita (BNS) 2023, includes cyber crimes under organised crime (section 109) which awards imprisonment not less than 5 years and goes up to life imprisonment along with a fine, not less than 5 lakhs.

CURRENT REGULATORY FRAMEWORK IN INDIA AND ABROAD 

Metaverse will soon fully revolutionise the legal and regulatory framework, currently prevalent in countries around the globe and therefore there is a need for global regulations on it and its users. The UN Guiding Principles on Business and  Human Rights could act as a starting point to regulate Metaverse. It calls for a need to respect an individual’s privacy and asks businesses to adopt ‘best practices’ to ensure the safety of vulnerable users.

Some of the key regulations and laws in the EU, apart from the General Data Protection Regulations (“GDPR”), include the Draft Digital Services Act and the Digital Market Act which collectively aim to protect minors by blocking access to illegal content, ensure fair competition in the market and also protect user privacy by reducing targeted advertising and getting rid of annoying push ads.

Furthermore, Japan announced in 2022, the Web 3.0 Policy Office under the Ministry of Economy, Trade, and Industry to tackle issues related to blockchain, NFT, Metaverse, etc. Similarly, the UK had announced the inclusion of Metaverse activities by commercial entities and users taking place in the UK’s jurisdiction under the Online Safety Bill, which is now an act on the protection of children and adults online. The US on the other hand does not have any specific regulations on Metaverse yet and it continues to be regulated by the existing legal framework on data privacy, IPR infringement, etc.

In India, cyber crimes are generally governed by the IT Act, of 2000, and the criminal laws. Before formulating a Metaverse-specific law, it is important to integrate the existing laws to the challenges emerging therefrom. The IT Act itself includes cybercrimes like phishing and cybersquatting. The same regulations can be extended to incriminate offenses in the Metaverse like identity theft, rug pulling, etc. Other regulations that deal with virtual digital assets include the Cryptocurrency and Regulation of Official Digital Currency Bill, 2021 on official cryptocurrencies to be issued by RBI and Guidelines for the advertising of Virtual Digital Assets and linked services.

CONCLUSION

In conclusion, as the Metaverse evolves, it’s crucial to address potential crimes and misconduct. Current regulations can serve as a foundation for new rules that protect users, and data privacy, and promote responsible behavior in this emerging virtual world. As governments consider regulations for the Metaverse, several key aspects need attention. First, avatars should be assigned a separate legal identity and be granted rights similar to that of a company to ensure greater accountability and responsible behavior in the Metaverse. Secondly, the prevalent data protection laws like the EU’s GDPR, India’s Digital Personal Data Protection Act, the US’s Illinois Biometric Information Privacy Act^[7], etc. do not cover the involuntary actions and dynamic movements captured in the Metaverse. State security is another concern, as the Metaverse could be used for cyberattacks, similar to past incidents like the Ukraine power grid attack. Regulations must be prepared to address such threats, especially given the Metaverse’s potential for increased connectivity.

^[1] VR or Virtual Reality is a simulated three-dimensional (3D) immersive environment that lets users explore and interact with a virtual surrounding in a way that approximates reality, as it’s perceived through the users’ senses.

^[2] AR or Augmented Reality is a technology that enhances the real world by adding virtual elements to it.

^[3] Neuralink is a neurotechnology company founded by Elon Musk that’s currently developing an implantable brain computer capable of converting thoughts into action.

[4] Web 3.0 aims to be fully decentralized, putting content creation in the hands of the creators and not platform owners. Its features include semantic web, AI, 3D graphics and spatial web, bockchain and cryptocurrency,and ubiquitous connectivity. Web 3.0 can empower people to have more control over their data by enabling them to participate in decentralise network. It can also lead to nw business models and improved transparency.

^[5] SPAC is formed strictly to raise capital through IPO for the purpose of merging with or acquiring an existing company.

^[6] Oculus is a VR platform and subsidiary of Meta. VR Chat is a free-to-play online VR platform.

^[7] US’s Illinois Biometric Information Privacy Act makes it unlawful for private companies to use facial recognition technology to identify and track people without their consent.

REFERENCE LIST

1. Clifford Chance, “The Metaverse: What Are The Legal  Implications?”,Published in February, 2022, <https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2022/02/the-metaverse-what-are-the-legal-implications.pdf>
2. Srijoni Sen, & Gauri Kumar,“The Metaverse : A Tech and Policy Brief for India” , published on 8^th March, 2023, National Law School of India University, Bengaluru,<https://www.nls.ac.in/wp-content/uploads/2023/03/NLS-WEB-PRIMER-2-metaverse.pdf>
3. Shravishtha Ajaykumar,“Crime and Punishment in the Metaverse: A Primer”, published on 26^th December, 2024, Observer Research Foundation, <https://www.orfonline.org/research/crime-and-punishment-in-the-metaverse-a-primer>
4. Dora Petranyi,et al., “Legal issues in the metaverse”,CMS, <https://cms.law/en/che/publication/legal-issues-in-the-metaverse>
5. Jana Arbanas,et al., “Considerations for regulating the metaverse: New models for content, commerce, and data”, published on 14^th September, 2023, Delloite Insights, <https://www2.deloitte.com/us/en/insights/industry/technology/emerging-regulations-in-the-metaverse.html>