The Metaverse: searching for compliance with the General Data Protection Regulation

Abstract

Inspired by Meta’s vision for the Metaverse, this article addresses Meta’s proprietary Metaverse and compliance with the laws of the European Union (EU), particularly the General Data Protection Regulation. This framework is examined through the lenses of the technology, such as the headsets that Meta users will utilize to enter the Metaverse. Due to the unique nature of the Metaverse and the wide variety of data that will be processed, including inherently sensitive and biometric data gathered from functionalities, such as motion tracking, hand tracking, face tracking, and eye tracking, Meta’s compliance with the EU’s regulatory frameworks is not straightforward. The rules and principles do not cover all the aspects of this novel and complex digital ecosystem, nor do they adequately address all the risks in a way that will protect the users’ rights. The Metaverse concept is not new. First introduced in Neal Stephenson’s novel ‘Snow Crash’,1 the book featured a virtual world, existing in parallel with the real world, populated by user-generated avatars that enter a Metaverse using electronic goggles. As the word suggests, it is a universe beyond (‘Meta’) reality. Although Snow Crash was a work of fiction, online environments like ‘Second Life’ and ‘Roblox’ were instrumental in shaping the Metaverse into the reality it has become.2 Today, due to the emergence of new technologies, companies such as ‘Meta’, ‘Microsoft’, and ‘Google’ have heavily invested in creating the Metaverse.3 Although no agreed definition exists,4 academics have defined Metaverse as a network of 3D virtual worlds that consists of technologies such as, among other things, Virtual Reality (VR), Augmented Reality (AR), Artificial Intelligence (AI), and blockchain. Users exist as avatars, interact with each other, and create content.5 The interactions are multidimensional: Instead of viewing digital content, users can immerse themselves in multiple VRs or an enhanced real-life experience with overlaying virtual elements (AR).6 Meta claims the Metaverse is the next generation of the ‘embodied Internet’7 and has already created advanced headsets, such as the Quest Pro device.8 Exploring the Metaverse’s potential and development is essential. Despite its current stage, with relatively few active users compared to the popular 2D applications, the assertion that the metaverse is faltering is inaccurate; instead, it’s poised for significant growth and it is only beginning to take off, with projections of substantial growth by 2030.9 Moreover, recent advancements in immersive technologies, significant investments by major tech companies, and the development of the necessary infrastructure highlight the growing momentum of the Metaverse.10 For instance, Apple has also joined the Metaverse race by creating its headset with advanced tracking functionalities called Apple Vision Pro, which was made available in early 2024.11 However, this article will focus on Meta’s (née Facebook) vision of the Metaverse. Meta has been singled out for this assessment for three key reasons. Its transition from Facebook to Meta signifies a substantial commitment to leading in the metaverse, backed by significant investments in VR and AR technologies.12 This rebranding is not just a new name but a declaration of the company’s strategic direction in shaping the Metaverse’s future. Secondly, Meta’s prominence brings regulatory scrutiny, placing it at the forefront of critical discussions on ethics, privacy, and regulation.13 Its shift from a social media giant to a metaverse company intensifies this focus introducing unique privacy concerns. Lastly, Meta’s competitive pricing strategy for its VR/AR headsets, offering a more economical alternative to competitors like Apple,14 could democratize access to the Metaverse. Such a strategy might not only widen its user base but also strengthen Meta’s role in the Metaverse ecosystem, further underscoring the importance of focusing on its activities and technologies. To better illustrate the possible future characteristics of the Metaverse, as well as the disruptive potential of the concept, the following section offers an imaginary the immersive virtual worlds of the Metaverse the way future The is by Meta’s vision of the Metaverse, as was by the company’s Meta Metaverse and they it will the way and with a with a virtual a VR of and such as and is to a to the the user the headset and in for the on and the into a of can or as can with in of the the of work in the Metaverse. a to the and the to the and are to with such as and to such as or the of they in the the the that was the of a made on VR headsets to an an virtual exist as avatars by access to face and with virtual the avatars the an for a that the of the to the users the headset are they enter the VR to headset to The might and from reality. However, Meta to an users will such as The Meta such as the Quest VR headsets and AR Metaverse’s vision is a reality. Despite the of the Metaverse, from a more immersive and to and of are also risks data privacy, and The disruptive potential of the Metaverse is it from current 2D like ‘Second This article that the is the and in the Metaverse data including that of biometric to a unique to data for a Metaverse user could be to a by on data from VR such as biometric data from eye using and its and of the of the is real and is The focus of this article is the of the Metaverse on VR and AR technology, which and of including of data from and face and eye with data from the users’ interactions in the Metaverse, companies could with an of and which can in users or a into and As for data are also and to the data privacy as the risks from this data on and data with This article addresses to by Meta’s compliance with European for data more its into the of the General Data Protection Meta’s Metaverse. This on the interactions and the virtual by Meta’s Metaverse. will be with a on the data the and development of advanced digital like the Metaverse. The of the regulatory and its on digital will be an this This article on Meta’s compliance with including rules for biometric and other unique data and that Meta to with the the of the Metaverse. To it is necessary to the with the by Meta to create the Metaverse, with a focus on Meta’s advanced VR the Quest Pro VR is to that this will not to other aspects of the such as the of the role of or alternative for data Moreover, the article to on to it will from such as ethics, and future Meta is a Metaverse including and The company’s on existing VR headset and the of VR/AR is to AR and VR and other such as and is a that and users interact a or digital VR a immersive virtual AR such as or to virtual elements the the real and virtual and digital The and This article to the VR/AR is an the technologies. The article on the VR functionalities of the Quest Pro headset for reasons. Meta’s AR is in the early of with in the and the in Secondly, data is VR and AR This article the for data and and are the for the Metaverse. VR are with and to the The data from users and which are by the and to the company’s the the users’ and it into the virtual world, that a to the by avatars is by and on the this data from multiple data activities will the As the data activities and Meta’s are in the European Union (EU), the Meta’s users are and data to that is or could be to data is elements could to or the to be the and and the available at the The and are as defined in the to such as and using this Meta is the for the and of the users also be data or in this will focus on Meta’s to better illustrate compliance in Meta is the data The data in Meta’s Metaverse user data from the Meta Quest data from the and data from companies and However, Meta’s Metaverse is unique it and sensitive data to and it biometric data are defined by the as data from to the or characteristics of a which or the unique of that Meta such data using for in a way that for unique the data will be biometric the that Meta will to the data as biometric data are The which consists of and real-life such as the and and For instance, the current headsets to virtual in The VR headsets also and users’ such as by tracking and on and tracking, and tracking, and of The can the of the headset and and such as users to in a direction or or This a more and immersive user also offers advanced tracking due to the to and tracking data with other data by Meta Quest Pro on the privacy Moreover, in Meta’s Metaverse, users can for functionalities, which for data on the and data the hand and hand data using not only the but also three The hand and hand data be with the tracking in the Metaverse is to with companies like Apple in and that can be for this for the Meta’s Quest Pro for eye and face tracking to create more and the face and eye the users to The on the and data of the and face are to and data from the or the of the The data are and in real on the However, the user an by Meta access to the eye or that the and data be and on Meta to the such as in a Although of the data can be biometric it is to they the biometric data with it is to compliance with the biometric data in Meta’s Metaverse. As was in the the to Meta’s data activities the are also in the However, be further examined is biometric data by Meta are only biometric data or they the biometric data on this the of the it to biometric is for as a they have to be to the The European Data Protection also that biometric data be to a to be Meta of biometric the will only be the is to the data The to biometric data as not in a way that to the For instance, biometric data from hand tracking are are to the experience by tracking the it to and the of As for the is with from the Moreover, data from of and face data are on the are not to Meta’s no Meta’s current of biometric data will not the of biometric other of also as of could for instance, data an or or biometric data and other particularly in the of that not all to biometric data it only are for the unique or of the data not the of biometric is a for in potential to sensitive such as or Moreover, the data as a significant in such data be The has using the of that the of an or a not the data as to it is only the at such of data that the of for other of inherently sensitive data that Meta its Metaverse technology, the for the of The Metaverse a VR poised to users an immersive from online the Metaverse technology, the of more and biometric This can and and VR more data in other online that biometric data VR can the of data a of in a VR was examined to the of this was that of users were by a or of tracking an more on an VR users in a popular experience that the could more with an of a of and that VR environments data to and unique As the Metaverse is poised for the and for its are to a transition Such a the of biometric data to Meta to to user This the biometric data to the in it as more is that the Metaverse’s advanced tracking technologies have the potential to sensitive data including that Meta advanced eye tracking, and tracking technologies in the technologies can sensitive a and For can and biometric can also be to functionalities such as and of to functionalities can sensitive a including the current Quest Pro tracking can data users’ on they are or which might be from Meta for The of data from the data is particularly it the of to of data is with The data by the VR/AR can the data including defined that can or Moreover, using tracking and other can sensitive the of including with such as or has that they can from a from the of and of sensitive data were to from 2D applications, or at not possible at that The of in the Metaverse significant to data is to the of sensitive data and sensitive that could user The future potential of Meta’s Metaverse the company not a disruptive potential could Meta such data in the the will be it is on the in This work will focus on the of Meta of and as for However, the and the of this they are not as of the for of of the Meta from data for on and the following the recent by the to is by the data the of the data is The that the be is the that it from on it to the to the that the data in an such as a the online world, could also be in an electronic by an by a the of the data or by using an electronic a that to by the data will with the This also with the for a of or no by the data also be which Meta already for its Quest For the to be the has that be be and Moreover, the principles for data also be in The for will be examined in parallel with the principles for data as they are is the data has a and the data they are to is not the data has no or is also not it not for for Meta for for functionalities, such as the which the user can However, this is not the for other such as that are on this Meta for each of such as social Moreover, the user the be no no and for For Meta’s Metaverse not work a the user has to hand Meta that not to the of experience be that can be a on the of on the Metaverse that the concept of in the Metaverse are the data necessary to the to for to be it is necessary to the of a is on to data that not necessary for the of that The of be data to be necessary to a VR However, it is to to the necessary and data for For the of data for and also as might not be necessary to the Metaverse the of user and at all can be to the This is also with the for data in data the data data to be and to is necessary the for which they are The has the and of data and the to the of data The is with the of this also the of However, the of is to the of which in the of the Metaverse, as will be further As for the be a of and the data be the However, aspects of the Metaverse do not with the of data This data and Metaverse and of of data on a of each new of AR and VR technologies not only more users and to the and of virtual but also on data from a base of users and to the of To create a data and virtual and and in a network of virtual This data and the and data for creating and virtual with the data data with principles a significant in the Metaverse is an of data the it be and or more This users more data and they only to for a However, for to be the data the of the This is the principles of and The that Meta the and not The consists of and The that data be only for and that are and Meta’s is not the are in a way that is such as and the or and the user are not Meta more and The that such as users’ or are and do not the of Meta to potential further which might be only to the The of the that data not be further in a with the is on the defined in to This the the the the nature of the and the of further Meta not the for which was and such as the data be into and might be at with the Metaverse’s potential data data for and that are not or at the of However, this not that Meta can data for and further be for which be Meta that its and to the to users better The of is to that have the necessary to Data be with critical elements to an data be of of data the company will it will be and the of each for which is This is with and the that the data the data the of the the for which the data will be the of including and other Meta of this in it is not or For the hand tracking it is that data is and with no it to the hand tracking However, this not the data and not with the data and data to access to the data and the the However, this is not particularly in the of further to and is in the Metaverse, data not the complex and the of due to multiple Meta be the of the the and the for the rights. it be that will be particularly in an like the Metaverse, is a and not be Meta has already been and by the and the data for to to the it to in its social media as it not users the data and the This more critical in the Metaverse, activities are more and is to users are of data are The of is inherently with a framework the The of the of data potential that might have on and the of the including the data and the This that data are in that data and that could be or to the more the Metaverse, user and for in the Metaverse that in the on the Meta that avatars and virtual environments do not or and For instance, technologies the Metaverse and to Meta or virtual to on user or an virtual However, the Metaverse’s immersive technologies unique in with on and data for the a for Meta’s Metaverse, such as or by on data that VR the will it and it to the that it will on the data to that However, in the data will This and of potential and Meta be in its and the that that virtual interactions and do not of users Meta to to and using or and that data is in and not is to that is for users and a of and to tracking in AR be of the of data and have the to or for such from each not be in Metaverse is for in the of the in of biometric Moreover, to data be in which is For instance, Meta’s AR have a that to but it is not from a it for to be of the of Meta’s Metaverse that with the is the activities on the company’s The of data in the Metaverse for the of more user that can be for from to social and is of on data that to or aspects the data such as at and or on data using a of that is at the of the Metaverse, which for Such are further which that users have the not to be to a on including it or This article not a to the data its that it is an for the data be on the of the of the However, the recent in has the and of this in the of which not to be by such a the Metaverse, is the of and significant to the of the in of that is no in the However, the of that might the is The has the no do with to the just a the Metaverse, will be in is not However, it is such will be possible in all the of and the novel of that will be which do not for and The that with is the or significant is necessary to potential Metaverse such as and will the To a on the to have or be on the the have been by the data and by the which a is This that pricing will not be as a it has been that it can be as an to enter an it will not significant of a from the the also a and the in and online the further on the the is also the on the data be or to be of in a way that will the or of the or will to or and not just that Meta’s that might more to the users the However, a is to the will be For pricing will not be by but only in such as it has the of a significant from or The is for on to the not have elements be such as the of the the the way the is and the and However, the for in and not protect users’ rights. As will be further on has disruptive and to as, not or to might in social For instance, Meta’s which users on they have VR headsets to with might have on other is no and by such will the will be a and The is that other might not be due to the is that in future Meta’s Metaverse not but the of other such as data on users’ virtual activities and Meta will the to the recent However, the the of which are of the by including data a role in the it not the existing including the for significant and other that Moreover, for that will the of are such as the data has The in the section are more the data could to that will be made on which will is necessary are in all of including is on of However, the are not and in is not are with the that the data to the in the of for this in the Metaverse. will not adequately the data with a of the risks with such as Secondly, the is only in and not in the it not an to The only to the data is the to and the However, this is not in as it is to data to and such are no the of and only that or be by data to no However, might be to a that will not protect in the Metaverse, might be on in the virtual world, which might from the reality and in with significant Meta is from using and that will have such on do not and such The for more in the of and is better with the of in the Metaverse. To it is that the a for using the that in with a for a which will not be a social media However, this has not in of data Meta is user data will be into Meta’s the which is on will to a role the development of the media already on user data or Meta has to the of data for on its social media by the for to users on or and the of the Metaverse a unique The of data in a Metaverse are already existing due to the and the the user might in the virtual The more the more the and into to users will the will be on is the or in the Metaverse, it can be on biometric and For eye and face tracking is Meta and could into the users at an in the virtual they and This not Meta’s on on data data from and eye tracking could also to are data will be gathered in the the data Moreover, Meta that the eye and data will the experience to each it is not to the of that the Metaverse can which can be and to the data from and of the and data and the to and This more with data from or and data will not be as biometric and to a it will have the in data on that will be to the and will not be due to the unique nature of the Metaverse and the potential Users to data from or and such as to have a with users in the virtual to of users to on the company’s from biometric and they to a data and is not the is and is not companies already to by of and However, the of the Metaverse and the potential for a on of inherently sensitive data and in the the of principles be and the for data and be to protect the users For Meta to with the and users’ data it is to data by and by and data be into the development and of Meta’s and Meta take and as a data to users’ data The the of the and and the risks to users’ rights. Meta is to a Data Protection its of data on a with Meta the for the Metaverse. and be into the and be with in real into Metaverse is for user for instance, to further user data by the of the data sensitive on data the that user interactions the Metaverse can in the Metaverse, data on users’ privacy by data among are instrumental in a Metaverse, and can they do not in the Metaverse, users can be as was in the Meta also technologies following the principles in of the Data and can be in the of functionalities, and social media and Meta’s be The vision only and necessary data for each by and or of and from the and face tracking also For eye tracking only eye and eye The also be in the of the user with necessary and in a and can also be into the with VR headsets and AR are Data by principles to be into the by that be in the of the Data be by with to biometric data and the of on such and not for that the also the of users’ sensitive which only be in necessary to the a and alternative to data activities that are not necessary be by Meta to more user privacy and for data the data to from data the and by Meta be to be and the of the with all the in this section is to This article the of Meta’s compliance with regulatory in the of the Metaverse, a digital with potential risks to user to its advanced and disruptive the of this novel to of and regulatory compliance be in the of development to the of future of this is the of Meta’s with the particularly in biometric data Although Meta not users by biometric the three to biometric in VR the of of data with Meta’s investments in and and motion tracking technologies, the to other of such as with the and to the principles of data and more complex by the unique characteristics of the Metaverse. The significant in the by Meta’s Metaverse. frameworks on Meta’s and they are in offering user is to the for such by for However, the to users for it to and which have in the Metaverse not adequately protect the is an for regulatory to and the the unique by the Metaverse. is to user compliance for this such as the are in offering and the development of of and This the of principles to biometric data in the Metaverse, VR and that users’ are Such user privacy and the Metaverse with other like the is for a to data in the Metaverse. and technologies, the privacy the Metaverse can be more As this digital a is to that privacy with the in the Metaverse, the and of in an immersive digital

Topics & Concepts