Why Privacy and Security Are the Top Barriers to Metaverse Adoption

The hype surrounding the metaverse continues to grow within the big tech economy. According to Gartner's projections, by 2026, 25% of the world's population will connect to the metaverse for at least one hour a day, whether for shopping, working, attending events or socializing. However, the array of technologies — like virtual reality, augmented reality, 5G, AI, and blockchain — that enable the metaverse all raise data privacy and security concerns. A third of developers (33%) think these are the biggest hurdles the Metaverse needs to overcome, according to a report from Agora.

Another Gartner report states that "75% of all organizations will restructure risk and security governance for digital transformation due to the implosion of cybersecurity threats, internal activity and increased attack surfaces and vulnerabilities".

Recent legislation has addressed the privacy of personal data. For example, the GDPR gives consumers the "right to be forgotten", requiring companies to be prepared to delete consumer information upon request. It also requires private companies to obtain people's consent to store their data. Helping businesses to comply is a growing business, and European regulators have moved towards stricter enforcement measures. As regulations become more stringent, organizations striving for metaverse leadership need to prioritize privacy and data security more than ever.

Although digital privacy on websites is now quite regulated, the metaverse is still very new and there is no legislation in place to enforce privacy there. According to Tim Bos, Founder and CEO of ShareRing, "Small group metaverses will be where people can have authentic experiences that they currently can't get in the real world." He added that "a lot of companies are trying to build something with the appeal of Fortnite or Minecraft, but where they can exist beyond battle royale games. I haven't seen anyone solve that puzzle yet. There also has a growing trend of online shopping through the metaverse, but again they haven't quite figured out how to offer more than just a website2.

The threat to privacy in Web3 and the Metaverse is greater than in Web2, as 20 minutes of VR use generates some two million unique pieces of data. These can include the way you breathe, walk, think, move, or look, among many others. The algorithms map the user's body language to gather information. Data collection in the metaverse is involuntary and ongoing, making consent nearly impossible.

Existing data protection frameworks are woefully inadequate to deal with the privacy implications of these technologies. Research also shows that a machine learning algorithm with just five minutes of VR data with all personally identifiable information removed could correctly identify a user with 95% accuracy. This type of data is not covered by most biometric laws.

Privacy issues in the metaverse include data security and sexual harassment. "I think the reason it [regarding harassment] applies to the metaverse, whatever that even means, is right now in Web2, we clearly don't quite get it," said Justin Davis, co- founder and CEO of Spectrum Labs. "[Not] in terms of trust, security, and content moderation in any given company, let alone at scale across the entire Internet."

One of the reasons why there are no metaverse-specific privacy policies yet is that the global scope...