top of page

METAVERSE: A new challenge for the Privacy of Personal Data

The Metaverse, is a path without return and will be multiple billions business in the coming years, but since this business is going to change our life, we need to understand what it is, why people are excited about it and how this will be a new challenge for the privacy of personal data.

For this article I will focus specifically on the Protection of Personal Data, which will increase exponentially in the Metaverse. The damages will potentially result in big losses with huge penalties and expensive litigations if there is noncompliance with the Data Protection Laws.

The idea of this article is to invite the readers to think about the legal implications concerned to the Personality Rights and its Data Privacy Security, which will come with the future of in-person interactions in this parallel world.


With the Metaverse, problems as: time lost in traffic, risk of infecting with some contagious virus, bad work environment… will be solved in couple of minutes.

· Why travel to the office when you can enter a room in your own home and immediately be together with your colleagues?

· Too dangerous to be physically together with high-risk person? No problem… the metaverse will make you feel as if you are physically together.

The concept of `Meta Universe´ originally came from the novel `Snow Crash´published in 1992. Therefore, it started as a game, but now it has become the platform in which a whole generation of people hang out and with all these big tech companies have announced its own ventures into it.


Today, we are showing only the content we agree, but if you take that concept into the Metaverse, they will manage, not just your newsfeed, but your entire world because in the Metaverse you will be using voices, gestures and even just thinking by using devices as Neuralink which will make possible to send a message to someone by just thinking about moving your fingers, or even by using headsets like ¨Project Cambria¨, which will track your facial expressions in real time.

Observe that we are talking about data collection on the level of measuring your brain activity, that in a future you could be giving it to Metaverse´s companies.

Typically, law will follow new business with delay, there are some questions related to Personal Data Protection that will need answers before the creation of this "parallel reality":

· What will be the legal limits for the processing of data which will now also be from your body language to your physiological responses?

· What will be, and if there will be, a point for the permission of the processing and sharing of this data?

· Or can the data collected from Avatars be considered "personal data"?

In the Metaverse, the volume of data collected by companies which are building their platforms in it, will be infinitely be greater than the already present immense amount of information processed by its users.

All this information brings a series of questions that need to be answered as the Metaverse becomes an inevitable part of our lives, such as:

· What will it be like when we become a digital environment, where our profiles are not just some vacation photos that we choose to share, but literally everything you did in the Metaverse?

· What the person behind this Avatar is saying, or if it's just what companies like Meta want us to hear to keep us on the platform for as long as possible?

· How do we give a whole new level of trust to a company that doesn't reveal exactly how they use our information?

To win back the trust of Consumer´s Service, companies must create core principles of data protection right by design to minimise the amount of data that will be collected of the people in the Metaverse and being transparent about it.

Some crucial points that are covered by the Data Protection Laws and noncompliance can result in a lot of problem not only in this physical, but specially in the digital world that is shaping up now.


Cybercrime has increased lately with sophisticated and complex versions of ransomware. Even the company have files’ backup, if doesn’t pay the ransom relying on it, the attackers threaten to leak the data, which can bring complications to the company and fines for breaking the Data Protections Laws, forcing, in any case, the institution to pay the required amount.

Imagine it in the Metaverse, where an entire ecosystem will be operational through the network, where the company will be represented by Avatars. If one of your friend’s accounts got hacked in the Metaverse; you could be sitting in the same room as a cybercriminal, and you wouldn't even know.

Who has access to that Meeting room in the Metaverse? It could occur that anyone who is in that digital environment has access. And that's where privacy conversations become much more complex, because all this leak or damage done will result in a big loss with huge penalties and costly legal disputes, loss of credibility with customers, users, and investors, loss of market value.

Add legal costs, the massive ransom paid to hackers and the costs of adequacy and recovery of systems, customer, and business losses. Obviously, it could be even worse in the Metaverse since it requires twice as much care in the manipulation of the data processed in a digital universe.

Today there are already widespread concerns about data privacy, in the Metaverse, these will become a bigger since `personal data´ is not only name, date of birth, ID etc., but it´s also anything that may help identify or share the characteristics of a person as their voice, their image, their behaviours. Our Avatars will represent us in fully emotions and behaviours, so, it´ll be a biometric date information, that is specifically recognized by Data Protection Laws, as a subset of "sensitive" category of personal information, warranting robust protection since any security incident with these types of data may have more serious consequences.


To take advantage of this wonderful new world, our legislators must be prepared with privacy and ethics considerations.

This article does not pretend to answer all doubt and questions related to the Metaverse, rather than that, it’s just a provocative way to draw attention to it. The above questions are just some of the legal points that will be posed by the creation of a Metaverse.

So, is your company, your country or government prepared to this new world?


Follow LexTalk World for more news and updates from International Legal Industry.




bottom of page