The metaverse - how deep does the rabbit hole go?

The Metaverse postulated by Mark Zuckerberg is supposedly a place where everyone can enter through yet-to-be developed high functioning AI that puts you in an environment of your choice. A place where you can interact with others, wearing different personas from their real selves, and to experience a virtual reality so realistic, it may even become difficult to tell the difference between the Metaverse and real life. It's a choice that will impact how much personal data we are handing over to ‘Meta’ the new name for the group that owns Facebook, WhatsApp and Instagram, amongst others.

In recent months the 'Metaverse' has dramatically entered the consumer zeitgeist, with over 2.6 million Google searches for the term on 21 October 2021 alone, the day it was announced.

But many people struggle to define what it is. There’s no doubt that the Metaverse can be confusing and difficult to define. But, it’s not a new thing.

Gamers have been spending time in alternative universes for over a decade; gaming, socialising, and engaging in commerce, the most popular of these being, Second Life, Mineshaft and Fortnite.

So, what is The Metaverse?

In the simplest terms, the Metaverse is a virtual version of our physical world where digital representations of people (avatars) can work, socialise, relax, learn, shop and play.

It can encompass 3D worlds, NFTs, cryptocurrency and the blockchain. Access to it can require software installation or linking of crypto wallets.

It's where users interact as virtual avatars within virtual spaces. The Metaverse essentially brings the internet to life, making it three-dimensional. Users can use virtual reality (VR) headsets for a more immersive experience, or the Metaverse can be used on a screen. This 3D space is usually explored using the VR headsets. An important point is that there is not one virtual world but many worlds that are typically accessed by a link provided by an organisation or the platform itself. Meta is developing far more sophisticated headsets and virtual reality ‘gloves’ to enable sensations to be experienced, and to pick up objects in the virtual world.

The key is that it's all powered by its digital economy. This is where the issue of what information they hold and what happens to this data becomes important.

The Metaverse is widely tabbed by some as the next phase in human evolution.

The Metaverse is big business too. In 2020, the Metaverse market was worth $46 billion. The tech industry predicts the Metaverse market will hit $800 billion by 2024 and reach 1 billion people by 2030

It is largely viewed as the basis of Web 3.0 - the next generation of the internet, where the web is more intelligent and connected.

One vision of the future is one where it’s a more personalised and interactive web, where users can control their data and privacy - a decentralised internet, where individuals own and govern sections of the internet, rather than companies like Google, Apple, or Facebook. Decentralisation can help to create trust, transparency, and privacy.

It’s no secret that a huge focus of the Metaverse is eCommerce. From previewing physical goods to purchasing digital goods & NFTs to embracing uniquely tailored and ultra-personalised experiences, the Metaverse is set to impact every part of eCommerce. Last year, Mark Zuckerberg, CEO of Meta, claimed to be building a horizon marketplace where creators can sell and share 3D digital items. And he hopes that this will enable a lot more commerce and help grow the overall Metaverse economy.

So, what’s not to like about the Metaverse?

On one hand, the Metaverse might make it easier for users to maintain anonymity. While this might seem like a good thing if you're worried about keeping your information private, keep in mind that it could also work in the favour of cyber criminals.

If you thought securing your data was important on the internet we know today, it's even more so in the Metaverse. That's because the way things work in the Metaverse is infinitely more complex than anything we've known up to now.

We simply don't know all the abilities and limitations of how data is shared, collected, and stored in the Metaverse. And although Mark Zuckerberg has made the right noises about privacy, the very nature of a deeply interactive Metaverse means that we will be sharing more data, including things like facial recognition and biometric information.

The Metaverse tracks individuals more intimately than any social media platform we're familiar with.

Whilst we have known that companies have been tracking users' data for many years, from their location to what they're spending the most time reading - but the Metaverse opens a whole new range of data points companies can know about us.

This allows companies to have a deeper understanding of a user's behaviour than they have ever before and expose data we didn't even know could be tracked.

We can expect companies in the Metaverse to collect personal information for individual identification, advertisement, and tracking through multiple channels, like wearable devices, microphones, heart and respiratory monitors, and user interactions to an extent that we have never seen before.

What do we know that they can track?

Location data - Just like how most of the countries 'Ring' doorbell cameras have decreased anonymity while out in public in the real world, location privacy will be so much harder to accomplish when using the Metaverse. Not only will AR glasses collect and transmit the location of the users to tech companies, but they could also have facial recognition technology installed. Meaning that any of the user's passers-by can also be tracked. This could be shared with a company's marketing team or a government agency.

Wearable tech can also track where you're looking for every split second with new eye-tracking technology. This will likely be fitted into wearable tech.

Physiological responses and biometric data can also be tracked. Companies will know your every emotion and every reaction.

Do you recall a scene in the film, Minority Report, where Tom Cruise is walking through a station and all the ads around him are hyper-personalised, even using his name? As the Metaverse is a virtual world, there is no reason why this level of personalised advertising couldn't be a reality.

Of course, the more data that’s collected, the more data is out there to be hacked. Even big companies like Facebook and LinkedIn have left their users as victims of data breaches.

Does the EU's General Data Protection Regulation apply to the Metaverse?

Although it could arguably apply to the Metaverse, as could the UK's Data Protection Act, given the nature of the Metaverse, the processes governing informed consent around data processing may need to be looked at again. GDPR applies to the location of the subject when their data is processed, not the country they're in or belong to.

So, what are the risks for consumers?

Just as with social media platforms, privacy issues will be at the forefront of the Metaverse as it develops and begins to gain widespread traction among users.

For users, it could mean violation of their privacy, potential identity theft, and other types of fraud.

Another consideration lies in the hyper-realistic avatars like the ones being developed by Meta. These avatars could allow users to hide their identity or even make it possible for children to appear as adults. How would this impact consent in the Metaverse?

Is the Metaverse safe?

It's not yet known how much information things like virtual reality (VR) headsets can collect from users. The truth is, the Metaverse could make it way easier for cybercriminals to steal information and take advantage of curious users who are just trying out something new.

Perhaps we don’t need to avoid the Metaverse altogether; in fact, avoiding it may become impossible in the coming years. But it makes a lot of sense not to jump in too quickly without examining the cybersecurity risks.

It's important to know what the potential risks are while operating within the Metaverse. After all, how can you protect yourself from something you're not aware of?

Here are some factors to consider before donning that VR headset:

• Another level data collection. In addition to collecting your personal information like email address and phone number, companies in the Metaverse will be able to collect data about body language, biometric information, and social behaviours, what you like and even what you look at
• Greater surveillance. Existing in the Metaverse will require new devices like VR headsets, cameras, sensors, and microphones. These devices can collect and store your information without your knowledge. Because the Metaverse is so new, laws regulating what data these devices can and cannot collect haven't fully been thought out yet
• Multiple access points. Each device in your home that connects to the internet opens a new door through which cyberattacks can enter. Since the Metaverse will require multiple devices and sensors, you're making yourself even more vulnerable to data breaches.

These factors might sound scary, but that's exactly why awareness is important. When you know the cyber threats that exist, you'll be better equipped to safely experience the Metaverse.

Perhaps the most valuable tip for safely experiencing the Metaverse is to use common sense and always be on the defensive. Be selective about which devices, apps, and websites you use. Take some time to read the user agreements that you usually just skim or even skip altogether. And be smart about which companies you share your information with.

Be cautious when interacting with other people within the Metaverse. As mentioned earlier, anonymity is easy when you're face-to-face with a virtual avatar and not an actual person. It’s more important than ever to approach the Metaverse with caution, and maybe even a bit of suspicion.

To secure and protect your data, always be aware of what information you're sharing, and with whom. Do your research before connecting new devices or working with different virtual reality companies.

And, above all, always proceed with a privacy-first mindset.

To help protect yourself from scams, you can get your data deleted from organisations that don’t need it by using Rightly Protect, our tool that helps identify who’s got your data and then helping you send a request to get it deleted in a single click, for free.