The Metaverse Is Shining a Virtual Light on Data Privacy and Ownership


The metaverse is quickly growing from a technical idea shrouded in mystery and misunderstanding to an emerging tool for businesses and brands across industries. So much so that Deloitte recently launched a Metaverse Services Division, aimed at providing education around transformative Web3 tools in its own custom virtual environment, while at the creative festival, Cannes Lions, Meta debuted a virtual metaverse marketing showcase enabling avatars to explore and enjoy the Côte d'Azur. Last year in support of the Special Olympics, Coca-Cola launched its inaugural NFT campaign, providing NFT holders with a virtual good bag of digital assets, and connected to its annual billionaire list, Forbes recently launched Virtual NFT Billionaires. 

The energy for and adoption of the metaverse—and the NFTs populating the space—by so many companies begs the question, who owns this content? And perhaps even more importantly, who owns the personal data connected to the metaverse and NFT experiences? 

From Web2 to Web3 

The metaverse is more than just virtual spaces and avatars, it signals a paradigm shift in the way brands and customers interact and information is shared. The metaverse is built on the idea of Web3, a new iteration of the internet that prioritizes decentralization and individual ownership over the authority of third-party intermediaries. 

In our current version of the internet, referred to as Web2, tech and social media platforms gather and monetize consumer data in exchange for providing consumers with access to their communities and services. With Web2, there are clear rules and regulations around data protection and privacy that third-party platforms and businesses must adhere to. In the Web3 future, however, consumers, not platforms or intermediaries, will have greater control over their data, and thus, their digital identity, creating new challenges and opportunities related to asset ownership and data privacy. 

Personal Data Shift

The idea of identity ownership is foundational to Web3 and the metaverse. Right now, digital wallets are commonly used to store cryptocurrencies and NFTs. However, these wallets are more than a storehouse, they also serve as a form of a digital ID card, in which data about an individual’s activities and preferences can be stored. Essentially, as the Web3 and the metaverse mature, the reins controlling how personal data is used and shared will transfer from tech platforms to consumers.  

In this scenario, companies will be incentivized to build direct relationship with consumers versus taking a mass marketing approach. For example, instead of Facebook ads, a coffee shop could provide customers with NFTs that offer coupons on drinks or updates on weekly specials. In exchange for the value provided by the NFTs, the consumers allow the coffee company access to their data. This one-to-one relationship brings privacy to the forefront. As consumers are empowered to determine how, when, and where their data is shared, companies will need to take greater precautions around data security, especially as individuals will be more identifiable by their data. 

Digital Asset Ownership 

As indicated, one of the most recognizable features of the metaverse are NFTs, also known as non-fungible tokens. Of note, the NFTs populating the metaverse go well beyond the headline-grabbing static pieces of art and music that have sold for millions in months past. When used effectively, so-called Smart NFTs are practical and impactful tools for confirming authenticity, connecting NFT ownership to a community or company, and offering ongoing rewards, access, and content to their owners.    

No matter the subject matter, digital ownership is core to the use of NFTs. That being said, one of the big sources of uncertainty in this nascent virtual landscape is exactly what NFT holders own. 

In the physical world, a person purchasing a poster can choose to hang it, enhance it, or even destroy it. NFTs, on the other hand, include attached conditions that control what rights holders actually have with respect to the digital assets they acquire. When boiled down, most NFTs are merely a ledger entry that contains a reference to the content that is purchased; they do not contain the actual content. Oftentimes, the actual content is hosted on a web server separate from the blockchain that contains the NFT entries. 

In most cases, NFT holders have no rights to a token’s underlying creative content. For instance, someone buying an NFT of a media clip (say, an NBA top shot) does not acquire any ownership of the media it contains—what is purchased is solely the exact expression of the clip. Further muddying the ownership waters is the fact that NFTs can be programmed in ways that limit how the purchased content can be shared or edited. Likewise, royalties can be programmed into NFTs, providing monetary benefit to the creator each time it is transferred. While potentially lucrative, this unique feature highlights additional nuances and risks around data privacy and digital ownership. 

Considerations Going Forward 

With more and more companies and businesses leaning into the metaverse and NFTs as tools for customer engagement, much thought and rigor must be given to rights and usage issues. An emerging concern for those issuing NFTs is whether holders will use these digital assets in a manner that may violate the wishes of their creators. As the metaverse and, by extension, NFTs become more commonplace in everything from marketing to entertainment, regulations will need to evolve that prioritize data privacy and protection.  

As the full impact of the metaverse and Web3 on business and society continues to come into focus, there is no question that this new iteration of the internet is poised to shift the way we think about identity, ownership, and community in a digital space. To be sure, companies and brands plotting their Web3 strategy must keep data privacy and ownership top-of-mind if they are to mitigate risk and preserve valuable customer relationships.

This blog post is not offered, and should not be relied on, as legal advice. You should consult an attorney for advice in specific situations.