Privacy in the Metaverse: Who is Responsible?

Dec 8, 2022
Share this post
Sharing to FacebookSharing to LinkedInSharing to XSharing to Email

Sign Up

What is the Metaverse?

Before we get to privacy in the Metaverse, we first have to define "Metaverse" itseld. Ever since the word hit our vocabularies in 2021, there has been ample confusion with many publications trying their hands at making sense of what it means:

“It may even be the case that any real “Metaverse” would be little more than some cool AR applications, VR games and digital avatars in Zoom calls, but mostly just something we still think of as the internet.” - Wired

I believe the confusion stems from a few examples given of what the Metaverse could be (a place to hang out with friends, a place to do work, a place to experience things without physically being there…) but no actual analogy to help guide the concept.

Imagine having the Internet explained as a place where there’s electronic mail and “other things” or explained what art is by being shown a Van Gogh and the statue of David, or even what video games are by just being shown Doom and Pac Man then being told that anything in the same realm can count as fitting under these terms. It would be just as confusing. These are all concepts that we’ve learnt about over time and have developed our own perceptions of, often differing from those of others.

Perhaps, the Metaverse will blend into the term Internet and some of us will have a different understanding of what the Internet means, or maybe we’ll associate it mainly with extended reality (XR), but whatever we call it, it will be something that we each make our own.

What the Metaverse Means to Me

I started out just as confused as the rest of the world.

“Whatever the Metaverse is, it’s not just virtual reality, or augmented reality, or the blockchain and NFTs, or virtual worlds and games.” - NYT

The Metaverse may not be VR on its own, but it does seem like the closest place to start. Having tried VR back in 2016, it was difficult to understand why now is the time to be driving excitement towards the concept of the Metaverse. Being lucky enough to be able to pick up a VR system myself this year, I was amazed by how far the technology has come in only 6 years.

My initial reaction to seeing that YouTube and Netflix were available in VR was to snicker: why would anyone want to watch Netflix on here? Curious, I booted it up and it felt just like standing in your own personal giant movie theater. Trying YouTube VR meant exploring Petra as if one were actually there.

I loved it. I love it so much. The possibilities are so exciting. The educational possibilities, the ability to recreate scenarios that simulate emotional lived experiences, the experiences, even the ability to gamify fitness like never before, all of which can all lead to a healthier, more compassionate, and more educated world.

I want this to work out from the very core of my being, but only without it leading to a dystopian future. For that, from the very beginning, VR has to be developed with privacy by design and deployed with a privacy-first ethos. In the metaverse, privacy will be more relevant and important than ever.

Privacy and the Metaverse

The Wall Street Journal published “Come the Metaverse, can Privacy Exist?” where David Uberti quotes Kavya Pearlman (founder of the XR Safety Initiative) as saying:

“At any given time, the way you move, the way your gait is, the way you’re gazing, your pupil dilation, is giving away information to developers. [...] For instance, she said, an insurance company might obtain information that suggests a user has a health problem before the person noticed any physical changes or saw a doctor.”

The sort of things that can be determined on an individual-basis when using systems that collect massive amounts of personal, environmental, biological and contextual data, and more, are endless. These include:

  • Socioeconomic status
  • Cognitive and physical conditions
  • Effects of aging
  • People in your environment
  • Learning speed
  • Persistence
  • Teamwork
  • Ability to focus

Systems that will be used to access the Metaverse will have Operating Systems installed that define the initial boundaries around our personal data. We need to be able to trust these systems and we need to be able to trust that these systems will protect our privacy and deter any misuse, abuse and malicious actions.

Privacy and the Different VR Devices: What Kind of Start Are We Off To?

A man using a VR headset in a dark room

Let’s take the top 4 VR devices of 2022:

Oculus Quest 2: We all know what sort of relationship Meta/Facebook has had with privacy over the past decade. Let’s pretend we believe that they will put privacy in the Metaverse first when it comes to the data they collect, although their current privacy policy does not make me hopeful. With regards to the data third parties collect on their system, here’s what their privacy policy says:

“Third-party content providers may also collect information from you directly through the experiences they provide. Please note that any information you share with these (or other) third parties will be subject to those third parties’ own privacy policies, not this one.”

This is simply not good enough!

Sony PlayStation VR and Valve Index VR Kit: Both of these have privacy policies which are not specific to their VR systems. Privacy policies need to be updated to account for the new levels of types and sensitivities of the data that can be collected through VR systems as opposed to PC games and game consoles.

HTC Vive Pro 2: This is the provider that comes the closest to truly highlighting a concern for user privacy, with a privacy policy that is clearer than many, but that still says:

“We also cannot control and are not responsible for any Third-Party Sharing Services or their actions, including the data that these Third-Party Sharing Services collect from you and your device, or how they use such data. Please review the privacy policies of all Third-Party Sharing Services to understand their privacy practices. “

What Else Could These Providers be Doing?

While it is understandable that providers do not want to take on the responsibility or liability of what a third party does with their users’ data, imagine the sort of controls these companies have the power to implement – and the fundamental ethical obligation to enforce – in order to limit the harm from the applications they allow onto their platforms. Imagine how seriously companies would take the right to privacy if an entire revenue stream could disappear were they non-compliant with the privacy requirements of the platform.

There are limitless ways in which self-expression, knowledge, empathy, and otherwise inaccessible experiences can be created and enhanced through the Metaverse. Let’s work together to ensure that users’ personal information and privacy rights are regulated and protected in order to drive the growth of this amazing new technology without enabling a dystopian world. We all have the tight to privacy, in the Metaverse or not.

Are you building products for the Metaverse and concerned about privacy? Private AI can identify the personal information within your systems and help you manage, protect and use it in a safe and effective way. Let’s collaborate!

Data Left Behind: AI Scribes’ Promises in Healthcare

Data Left Behind: Healthcare’s Untapped Goldmine

The Future of Health Data: How New Tech is Changing the Game

Why is linguistics essential when dealing with healthcare data?

Why Health Data Strategies Fail Before They Start

Private AI to Redefine Enterprise Data Privacy and Compliance with NVIDIA

EDPB’s Pseudonymization Guideline and the Challenge of Unstructured Data

HHS’ proposed HIPAA Amendment to Strengthen Cybersecurity in Healthcare and how Private AI can Support Compliance

Japan's Health Data Anonymization Act: Enabling Large-Scale Health Research

What the International AI Safety Report 2025 has to say about Privacy Risks from General Purpose AI

Private AI 4.0: Your Data’s Potential, Protected and Unlocked

How Private AI Facilitates GDPR Compliance for AI Models: Insights from the EDPB's Latest Opinion

Navigating the New Frontier of Data Privacy: Protecting Confidential Company Information in the Age of AI

Belgium’s Data Protection Authority on the Interplay of the EU AI Act and the GDPR

Enhancing Compliance with US Privacy Regulations for the Insurance Industry Using Private AI

Navigating Compliance with Quebec’s Act Respecting Health and Social Services Information Through Private AI’s De-identification Technology

Unlocking New Levels of Accuracy in Privacy-Preserving AI with Co-Reference Resolution

Strengthened Data Protection Enforcement on the Horizon in Japan

How Private AI Can Help to Comply with Thailand's PDPA

How Private AI Can Help Financial Institutions Comply with OSFI Guidelines

The American Privacy Rights Act – The Next Generation of Privacy Laws

How Private AI Can Help with Compliance under China’s Personal Information Protection Law (PIPL)

PII Redaction for Reviews Data: Ensuring Privacy Compliance when Using Review APIs

Independent Review Certifies Private AI’s PII Identification Model as Secure and Reliable

To Use or Not to Use AI: A Delicate Balance Between Productivity and Privacy

To Use or Not to Use AI: A Delicate Balance Between Productivity and Privacy

News from NIST: Dioptra, AI Risk Management Framework (AI RMF) Generative AI Profile, and How PII Identification and Redaction can Support Suggested Best Practices

Handling Personal Information by Financial Institutions in Japan – The Strict Requirements of the FSA Guidelines

日本における金融機関の個人情報の取り扱い - 金融庁ガイドラインの要件

Leveraging Private AI to Meet the EDPB’s AI Audit Checklist for GDPR-Compliant AI Systems

Who is Responsible for Protecting PII?

How Private AI can help the Public Sector to Comply with the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024

A Comparison of the Approaches to Generative AI in Japan and China

Updated OECD AI Principles to keep up with novel and increased risks from general purpose and generative AI

Is Consent Required for Processing Personal Data via LLMs?

The evolving landscape of data privacy legislation in healthcare in Germany

The CIO’s and CISO’s Guide for Proactive Reporting and DLP with Private AI and Elastic

The Evolving Landscape of Health Data Protection Laws in the United States

Comparing Privacy and Safety Concerns Around Llama 2, GPT4, and Gemini

How to Safely Redact PII from Segment Events using Destination Insert Functions and Private AI API

WHO’s AI Ethics and Governance Guidance for Large Multi-Modal Models operating in the Health Sector – Data Protection Considerations

How to Protect Confidential Corporate Information in the ChatGPT Era

Unlocking the Power of Retrieval Augmented Generation with Added Privacy: A Comprehensive Guide

Leveraging ChatGPT and other AI Tools for Legal Services

Leveraging ChatGPT and other AI tools for HR

Leveraging ChatGPT in the Banking Industry

Law 25 and Data Transfers Outside of Quebec

The Colorado and Connecticut Data Privacy Acts

Unlocking Compliance with the Japanese Data Privacy Act (APPI) using Private AI

Tokenization and Its Benefits for Data Protection

Private AI Launches Cloud API to Streamline Data Privacy

Processing of Special Categories of Data in Germany

End-to-end Privacy Management

Privacy Breach Reporting Requirements under Law25

Migrating Your Privacy Workflows from Amazon Comprehend to Private AI

A Comparison of the Approaches to Generative AI in the US and EU

Benefits of AI in Healthcare and Data Sources (Part 1)

Privacy Attacks against Data and AI Models (Part 3)

Risks of Noncompliance and Challenges around Privacy-Preserving Techniques (Part 2)

Enhancing Data Lake Security: A Guide to PII Scanning in S3 buckets

The Costs of a Data Breach in the Healthcare Sector and its Privacy Compliance Implications

Navigating GDPR Compliance in the Life Cycle of LLM-Based Solutions

What’s New in Version 3.8

How to Protect Your Business from Data Leaks: Lessons from Toyota and the Department of Home Affairs

New York's Acceptable Use of AI Policy: A Focus on Privacy Obligations

Safeguarding Personal Data in Sentiment Analysis: A Guide to PII Anonymization

Changes to South Korea’s Personal Information Protection Act to Take Effect on March 15, 2024

Australia’s Plan to Regulate High-Risk AI

How Private AI can help comply with the EU AI Act

Comment la Loi 25 Impacte l'Utilisation de ChatGPT et de l'IA en Général

Endgültiger Entwurf des Gesetzes über Künstliche Intelligenz – Datenschutzpflichten der KI-Modelle mit Allgemeinem Verwendungszweck

How Law25 Impacts the Use of ChatGPT and AI in General

Is Salesforce Law25 Compliant?

Creating De-Identified Embeddings

Exciting Updates in 3.7

EU AI Act Final Draft – Obligations of General-Purpose AI Systems relating to Data Privacy

FTC Privacy Enforcement Actions Against AI Companies

The CCPA, CPRA, and California's Evolving Data Protection Landscape

HIPAA Compliance – Expert Determination Aided by Private AI

Private AI Software As a Service Agreement

EU's Review of Canada's Data Protection Adequacy: Implications for Ongoing Privacy Reform

Acceptable Use Policy

ISO/IEC 42001: A New Standard for Ethical and Responsible AI Management

Reviewing OpenAI's 31st Jan 2024 Privacy and Business Terms Updates

Comparing OpenAI vs. Azure OpenAI Services

Quebec’s Draft Regulation Respecting the Anonymization of Personal Information

Version 3.6 Release: Enhanced Streaming, Auto Model Selection, and More in Our Data Privacy Platform

Brazil's LGPD: Anonymization, Pseudonymization, and Access Requests

LGPD do Brasil: Anonimização, Pseudonimização e Solicitações de Acesso à Informação

Canada’s Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies and How to Comply Using Private AI

Private AI Named One of The Most Innovative RegTech Companies by RegTech100

Data Integrity, Data Security, and the New NIST Cybersecurity Framework

Safeguarding Privacy with Commercial LLMs

Cybersecurity in the Public Sector: Protecting Vital Services

Privacy Impact Assessment (PIA) Requirements under Law25

Elevate Your Experience with Version 3.5

Fine-Tuning LLMs with a Focus on Privacy

GDPR in Germany: Challenges of German Data Privacy (Part 2)

Comply with US Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence using Private AI

How to Comply with EU AI Act using PrivateGPT