Legal advice in the metaverse

After the Internet of Things, the metaverse is the next evolutionary stage of the internet. We shine a light on the legal issues of the future.

At the end of October, at Connect 2021, Facebook announced that it would operate under the company name Meta Platforms, Inc. (Meta) in the future. Meta is reacting – not unlike Google when it rebranded as Alphabet in 2015 – to the reality that it no longer consists only of Facebook, but also includes services such as Instagram, WhatsApp & Co., and will in future focus on the so-called metaverse. To this end, an initial $ 10 billion investment was also announced.

Ultimately, however, this realignment has been on the cards at Facebook for years. The company not only has an in-house R&D department for virtual reality (VR) and augmented reality (AR) technologies in the form of Facebook Reality Labs. It also has the necessary hardware in the form of Oculus VR glasses (acquired in 2014) and its own VR games, such as Beat Saber.

Blockchain technology gives new impetus to metaverse discussion

However, Meta did not invent the metaverse, nor is Meta alone in its development. In fact, the term "metaverse" was coined as early as 1992 by the author Neal Stephenson in the science fiction novel "Snow Crash". By the 2000s, millions of users' avatars were already busy interacting in "Second Life" and buying virtual objects, land or advertising space. In the computer games sector, by contrast, World of Warcraft is one of the most successful metaverses, although today games such as Minecraft (with around 112 million monthly active users), Roblox (around 100 million active users) or Fortnite (around 78 million monthly active users) also dominate the metaverse games market.

The discussion is now also gaining momentum because blockchain technology is laying the foundations for a new iteration of the internet, Web 3. It differs from Web 1.0 (static websites) and Web 2.0 ("the web as a platform", social media) in that it allows for the transfer of value (crypto-currencies, tokenised shares, tokenised rights, etc.).

This means it is now possible, for example, to make rights to virtual goods "visible" in the form of blockchain-based "tokens" . This tool gives us direct control over such tokenised assets. It is a novelty in the history of the internet. It comes as no surprise, then, that numerous metaverses have also emerged or are in development in the crypto world in recent years, such as Decentraland with its MANA token (a metaverse similar to Second Life with virtual land and objects, live events, concerts, vernissages and even its own casino) or The Sandbox with its SAND token.

The authors assume that the current environment provides fertile ground for parts of our lives to take place in such metaverses in the future. Many companies seem to share this view. In addition to specialised start-ups in this field, established companies such as Nike are also interested in the metaverse and are already filing trademark applications accordingly to allow them to protect and offer their products in virtual worlds, too. Adidas, for example, has launched on The Sandbox.

This then raises a number of questions: what exactly is the metaverse (or what will it be)? What new opportunities and business sectors can emerge from it, what does the metaverse have to do with so-called non-fungible tokens. And most intriguingly from a legal perspective, what issues will "metaverse lawyers" have to grapple with in the future?

What is the metaverse? What opportunities will it bring?

In short, the Metaverse is a virtual world to which participants connect via the internet to interact with other participants.

The look and feel, range of functions and purpose of the various virtual worlds out there differ depending on the provider. In general, the metaverse is a 3D environment, which appears either as a hyper-realistic replica of the real world (reminiscent of Star Trek's Holodeck), or as a science fiction or fantasy world. In metaverse games, the focus is more on the gaming aspect and certain missions have to be completed (either alone or in multi-player mode), certain game levels have to be earned, or other players have to be defeated. Virtual worlds such as Second Life, Decentraland or Meta's planned metaverse, meanwhile, are all about participants generally interacting, communicating and collaborating – without the need for certain predefined objectives or goals.

Apart from gaming, the metaverse opens up many possibilities: Attending (hybrid or purely virtual) events such as concerts, exhibitions or conferences (as a next-generation alternative to live streams), exchanging ideas with colleagues and customers in virtual conference rooms (no more phone calls, voice and video chats – Microsoft recently announced a VR update for Teams, for example), researching in digital libraries (no more databases using search forms) or shopping for (real or virtual) goods in virtual shopping malls (the metaverse could revolutionise e-commerce).

Now that real objects such as industrial facilities ("Industry 4.0"), buildings ("smart homes"), vehicles ("connected cars") and personal objects ("smart wearables") have all been digitised in the Internet of Things, humans are now digitising themselves in the metaverse and creating their own avatars in a virtual world. While this may sound like science fiction to some and dystopian to others, to a large extent this is already today's reality, and only confirms Marc Andreessen's theory: "Software is eating the world."

Even from the above examples of metaverse use cases, it is already apparent that the metaverse will revolutionise numerous sectors. This will of course affect traditionally non-digitised sectors such as the sports industry (even though digitisation has of course already found its way into this sector in the form of electronic sports trackers or digital coaches, sport itself still largely takes place in the real world). But there are also business areas which, although in principle already digitally accessible, are essentially still limited to Web 1.0 and Web 2.0, meaning to the presentation of information in the form of two-dimensional web pages, rather than an immersive presentation of the product or service in a virtual world.

Building the metaverse: a convergence of many technologies

In addition to these new possibilities and business opportunities in the metaverse, the provision of technologies and content for the metaverse also opens up numerous opportunities.

As already shown, there is no "one" metaverse. In fact, numerous metaverses already exist today – some with a focus on gaming (such as Fortnite) or e-commerce (such as RedFox Labs, Highstreet), and others without a predefined purpose (such as Second Life, Decentraland). All metaverses are constantly evolving and getting more features, better graphics, new content or compatibility with peripherals such as virtual reality (VR) glasses. This creates an enormous market for hosting providers, software and game developers, hardware manufacturers and content creators.

Each metaverse is itself made up of a wide variety of technical components. In terms of hardware, first of all you need servers that provide sufficient storage space and computing power. The servers can either be operated centrally in a data centre (such as Amazon AWS, Microsoft Azure) or decentralised to a large number of nodes (for example IPFS, a decentralised file system). When it comes to peripherals, there is a need for input and output devices that allow users to fully immerse themselves in virtual worlds, such as VR glasses, systems enabling face and hand gesture controls, haptic gloves that let you feel VR objects, and perhaps even brain-computer interfaces (BCI) in the future. Software-wise, the first thing that is needed is an underlying platform allowing users to register, and which forms the foundation for virtual worlds that build on it. The virtual worlds themselves require, on the one hand, a high-performance graphics and physics engine to display layers and vector graphics and to calculate the laws of physics as exist in those worlds, but on the other hand also the graphics themselves, be they landscapes, skies, buildings, people, objects. The digital assets that users can buy and exchange in the metaverse, such as virtual properties, vehicles, outfits, wearables, advertising space and much more, require on the one hand a virtual currency (in-game currency) that must be protected against manipulation and loss. On the other hand, they require a secure store of value for the digital objects acquired by users that is ideally interoperable with other metaverses.

Metaverse and blockchain technology: win-win?

This of course creates numerous opportunities in the crypto sector. But the metaverse also benefits from numerous technologies and concepts that have been developed, tested and used in the blockchain world for years. In theory, all the "components" for the metaverse mentioned can also be solved by means of a purely central solution. However, the success of metaverses will turn on whether users trust the metaverse concept, especially when buying virtual items with "real money". This trust can be built in particular through the use of decentralised in-game currencies and digital assets.

Blockchain-based tokens are ultimately predestined for this. Being highly secure and difficult to manipulate, they are already popular with traditional game and software developers. Of particular interest is the possibility of representing digital assets as so-called non-fungible tokens (NFTs for short). In a nutshell, NFTs are digital, non-exchangeable ("unique") assets that are stored immutably on the blockchain, making them attributable to a unique owner. Even with otherwise centralised approaches, it is possible to protect digital assets in a way that is at least similar to ownership, and to secure them against loss due to server failures or data theft, for example. The use of NFTs also offers the perhaps one-time opportunity to achieve true interoperability between different metaverses, so that once purchased, digital assets (for example, virtual clothing, items in games) could also be used when exploring other metaverses. In this respect, Mark Zuckerberg also repeatedly emphasised the relevance of NFTs to the metaverse in his video presentation, The Metaverse and How We'll Build It Together.

However, NFTs are only one use case for decentralised technologies in the metaverse. Blockchain-based metaverses like Decentraland are already showing the way. There, not only are digital assets mapped on the blockchain, but the virtual world itself is hosted and operated decentrally by users on a multitude of nodes. Decentraland goes even further and is even managed by a decentralised autonomous organisation (DAO), meaning the organisation behind Decentraland is itself decentralised as regards its members' codetermination rights. Technologies for decentralised data storage have been around for some time, the InterPlanetary File System ("IPFS") is just one example.

What legal issues will we be dealing with in the future?

Today, we can only guess what opportunities and business models will emerge in the metaverse. However, the legal questions that arise will be just as diverse as the possible applications of the metaverse itself.

Data protection law, which we address in greater detail below, as well as legal issues surrounding NFTs, therefore only serve as examples. Competition law (how can companies advertise their products in the metaverse?), copyright law (what must be observed when digital assets are embodied as NFT or real buildings replicated in the metaverse?), securities and banking supervisory law (are there licensing and prospectus obligations for trading digital assets in the metaverse?), tax law (how should income from renting virtual land be treated?) or general civil and criminal law will keep lawyers busy in the future.

Some legal issues will arise in the development phase of the metaverse. Others may arise only later, when companies decide to establish themselves in the metaverse and offer/advertise products or services there. However, metaverse developers should take all relevant legal issues into account right from the start and, for example, implement privacy-by-design principles from the very first line of code or transparently stipulate requirements for advertising products in the metaverse in merchants' terms and conditions. Of course, this presupposes clarifying from the outset which law is applicable at all. The argument that a project is decentralised and therefore no law applies is bound to backfire: If in doubt, the appropriate law for any given case applies (for example, "lex fori"). Early-stage initiators are especially at risk of being caught in the net when it comes to regulatory enforcement.

Legal issues around NFTs

From a copyright point of view, it is hugely important to communicate to the buyer in a transparent and easily understandable way (think: "Creative Commons" symbols) exactly what rights they are acquiring with the purchase of a digital asset and what restrictions on use there are.

From a regulatory point of view, it should be noted that tokens generally qualify as crypto assets and thus as financial instruments within the meaning of the German Banking Act (KWG), which can entail a number of licensing requirements – it is therefore important to distinguish them from purely technical services that do not require a licence. Under securities law, it is particularly relevant in the case of NFTs to check that securities or investments are not being issued with the sale, as this triggers prospectus obligations, which in turn can be avoided by keeping below certain thresholds. In the future, the EU MiCA Regulation will regulate the crypto securities market throughout the EU – until then, it is advisable to follow German law, which is already similar in parts.

Data protection issues

With regard to data protection, new types of data will be processed in the metaverse, such as facial expressions, gestures and other physiological reactions to certain content and events in the metaverse. No doubt the advertising industry will be highly interested in such data (conceivably: what are a customer's physical reactions on seeing a certain product/brand?). In addition, through the use of 3D cameras, LIDAR sensors and microphones, VR glasses will also process a range of data about users' private environment in the real world, for example about their private home or housemates. Such data may also include special categories of personal data as defined in Article 9 GDPR, but either way require special care in processing. In particular, the principles of data minimisation and purpose limitation play an essential role in the processing of personal data in the metaverse, not only on compliance grounds, but also for reasons of trust. The metaverse will only be accepted by users if they can and wish to "be" in the metaverse in good conscience.

This also requires transparent information for users, which means providing not only detailed but also easily understandable information about the data processing that takes place. This implies a rethink for such versatile products as the metaverse: away from long privacy notices as part of the registration process, and towards easily understandable symbols and brief data protection information as needed, for example before a user enters a virtual department store in the metaverse (or participates in an event) and the operator/organiser collects personal data about the visitor. Moreover, the rights of data subjects under data protection law must always be guaranteed in accordance with Article 15 ff. GDPR, and users must have simple ways to exercise their rights.

The issue of which data protection responsibilities (controller, joint controller, processor) are shared by platform operators and companies in the metaverse will also occupy us in the future. This is not always entirely clear even in the Web 2.0, and there have only been court rulings on certain scenarios (such as for "fan page" operators on social networks). However, one thing is clear: the Schrems II challenges that currently still exist must be solved before the metaverse can go mainstream. After all, the idea that international data transfers can be avoided in an interconnected virtual world is really the only thing that really does seem unimaginable in the metaverse.

Technology and the law are not mutually exclusive, but complementary

The metaverse is neither science fiction nor dystopia, but already a reality today and is here to stay. It will give rise to countless opportunities and new business models.

The law needs to be considered early in the development phase to avoid major upheaval later on. This interplay between law and technology begins with the first line of code written and the first graphic created for the metaverse.