What kinds of privacy problems await the metaverse?

One of the tech buzzwords of this new year is metaverse.

Even though lots of tech companies are promising we’ll soon have an immersive experience where you can stream your favorite show, host a virtual work meeting, or even buy a virtual house, there is still a way to go before we get there.

One of the issues to be sorted out first — hopefully — is how user privacy works in a world build on augmented and virtual reality.

Jessica Lee, a partner at the law firm Loeb & Loeb who advises companies on user privacy, says companies still have some time to sort this out. The following is an edited transcript of our conversation.

Jessica Lee: When we talk about the metaverse and when companies are talking about the metaverse, this is something that they’re envisioning will be multiple years out. The idea is that you could have potentially various metaverse environments, but that you can move interoperably between them. So right now, you might get on your phone and you open one app and you’re in that app experience, and you go and open another app. You know, you could move seamlessly throughout all of those different apps or different metaverse environments, once we get to this new version of it, which, again, is several years down the line.

Kimberly Adams: Several years down the line. What do you think is in between now and then?

Lee: When we’re talking about the metaverse, it’s really built heavily on a combination of VR, AR and mixed reality. And over the past few years, I think we’ve seen some stops and starts with innovation in all three of those spaces. One key hiccup has been getting a headset and a device that people actually want to use and put on, and provides a good experience, so I think we’ll see innovations in the devices. And I think we’ll start to see more development of the pieces of the metaverse and that will include things like the evolution of blockchain and engaging in transactions across the blockchain, NFTs. Web3 isn’t the same thing as a metaverse, but they’ll work side by side and so, as we get to this decentralized version of the web, the metaverse will kind of grow into that as well. So I expect to see these different iterations between now and whatever the future state of metaverse looks like.

Adams: What kind of privacy issues do you think are unique to this new and emerging space?

Lee: I think we’ll see the “big data” problems get even bigger, and the ability to track people will get even more enhanced. Because, if I give myself as an example, there are probably four devices I use every day. I have two email addresses — a work email and a personal email — and then when I’m on social media, I have different handles because I signed on at different times. So there’s a fragmentation of my identity. We might see the ability to unify all of that into one person, and so while you can do some amount of tracking, and obviously companies know a lot about us and our activities, there’ll be an enhanced ability really, to understand your movements, your location, your interest, and then layer on top of that access to biometric information through the headsets. So, one example of this might be you get that message on Netflix, “Are you still watching?”. Well, Netflix won’t have to ask you that, because you’ll have the headset on and it can scan your retina and know where your eyes are pointed, so it’ll know that you’re watching.

Adams: Or if you fell asleep.

Lee: Right. Exactly. So it’s really enhancing the access to information that we have today.

Adams: How valuable is that data, especially that biometric data from a user’s time in the metaverse or some version of it?

Lee: Well, it’s going to be extremely valuable. I mean, it won’t be valuable for every single purpose, but for companies who really want to know who their audience is, who their consumer is, so they can either create products that are more specific, so that they can market those products in a more targeted fashion, so that they can develop technologies that speak to user preferences — all of that is helpful. The more information we know about what people do and how they engage and what they’re interested in, the more we’re able to sort of develop products that speak more specifically to that or create experiences that speak more specifically to users needs. So I think that information will become very valuable.

Adams: Very valuable to companies. Is there going to be any change in how much consumers are able to control their monetarily valuable information?

Lee: If you talk to people in the privacy space, there’s a lot of concern about the ability to track in the metaverse, particularly when you layer on the concept of a virtual workspace, blurring the lines between work and personal life. But on the individual side, there’s opportunity because once you can create this seamless identity, there’s a concept that you could have more ownership and control over your identity, and who you allow to give access to your information. In the past couple of years, we’ve seen companies that have popped up trying to help consumers monetize their data. And I’ll say, I’m not personally a fan of that concept, because I think on an individual level, an individual’s data isn’t that valuable. Data is valuable at scale. But I do think that there’ll be more opportunity to explore innovation around monetization, but I think what will be more important will be the opportunity for users to have more control about who they allow to access information about themselves.

Adams: One of the ways that people have talked about deploying the metaverse is that companies may use it as a virtual office or a remote workplace. Does that bring any additional privacy considerations, beyond sort of using it for gaming or working out or other recreational uses?

Lee: Oh, absolutely. Because if we think about the information we’re able to track, we really will want to understand, if we’re in a virtual workplace, what information will our employer have about us. I’m off-camera. Now, I might roll my eyes, and my employer might not see that, but if that information can be tracked through the device I have, if they have access to that information — and that’s kind of like a silly example — but it just opens the door to potentially your employers getting more information about your activities. And I think particularly as we’ve been mostly remote for the last two years, there’s been a concern about how much employers are tracking their employees at home when they’re working remotely. I think those concerns will continue to scale.

Adams: So then how do companies and consumers prepare for the privacy concerns in these new virtual spaces?

Lee: Well, the metaverse is being developed at a time where there’s a big spotlight on privacy. And I think that will be a good thing. Because I think we’ve seen the errors of our ways, hopefully. Now with a spotlight on privacy, and this is a spotlight that’s coming from the consumers themselves. It’s coming from regulators. It’s coming from other businesses who will want to, you know, the metaverse, you’ll have a host of the metaverse, but brands will want to partner and they want to make sure they’re setting their consumers into safe spaces. So I think there’ll be pressure from all parties to make sure that the metaverse is safe from a privacy perspective. So I expect that we will see rules around what data can be used, how much can be kept, what will be shared, issues around data hygiene. So you might need to collect biometric information to engage in the space or to provide an experience, but you don’t necessarily need to keep that information in all cases or use it for other purposes. And so I think we’ll start to see more rules around data hygiene as the metaverse starts to develop.

Related Links: More insight from Kimberly Adams

For a healthy dose of skepticism about just how close we are to a functional metaverse, The Washington Post published an interesting analysis piece last week.

And Harvard Business Review is out with a guide on how brands can use the metaverse. Virtual art galleries and fashion shows might be the future, but the author points other attempts at the metaverse, like Second Life, have been around for a while without taking over the economy.

Finally, back on the privacy front, Facebook whistleblower Frances Haugen told the Associated Press in November that the version of the metaverse Facebook’s parent company Meta is pushing will be addictive and rob people of even more of their personal information, while at the same time giving Meta even more of monopoly when it comes to our lives online.