Advertising And Privacy: The Rules Of The Road For The Metaverse

Aug 18, 2022 by Eric Reicin, President & CEO of BBB National Programs

The metaverse is being hailed as the next big technological revolution, with countless brands exploring the incredible potential to engage with existing and new customers in immersive virtual worlds. The rules of the road for the metaverse are beginning to be written, with businesses and nonprofit organizations watching closely for signs on how the metaverse itself will evolve.

According to Deloitte, over the next few years, the evolution of the metaverse will take on one of three likely scenarios: "low orbit: the metaverse excels at certain things but never becomes a general-purpose platform;" "double star: there is not a single metaverse, but a handful of major players vying for a share of a dynamic marketplace;" or "big bang: an open, interoperable metaverse becomes the dominant interface through which we conduct most of our daily activities."

Regardless of how the metaverse evolves, there are already a variety of innovative ways for brands to engage, with spending on metaverse advertising on track to total between $144 billion and $206 billion by 2030, according to a new report from McKinsey. Similarly, Mark Zuckerberg recently stated on CNBC that he envisions a billion people in the metaverse spending hundreds of dollars each on digital goods to express themselves or decorate their virtual homes or conference rooms in the second half of the decade.

As businesses explore how to participate in the metaverse, they also should consider challenges that the metaverse can present, such as creating safe spaces for children and teens, consumer data privacy, false or misleading advertising, financial transaction security, brand safety, consumer trust and safety, global considerations, evolving legal standards and more.

In this article, I am going to discuss some of these metaverse concerns through the lens of advertising and privacy, and the intersection of these with children’s well-being.


Advertising And Privacy In The Metaverse

A shift to an immersive world with virtual reality (VR) headsets means businesses can collect even more intimate details about consumers than they can via traditional screens. The technology has evolved such that tracking facial expressions, vocal inflections, and vital signs are possible. This data is susceptible to use for highly targeted advertising.

As Jon Callas and Kavya Pearlman explained to the Washington Post, “VR headsets could provide a frightening pathway to biometric information previously inaccessible to companies, employers, law enforcement and the government... And that includes any inferences drawn from that information... VR companies and their advertising partners could use the way we move our eyes, heads, and arms to infer things about our personalities, health, and habits, and use that information to market to us.”

More data also means more potential for deceptive advertising. Louis Rosenberg, CEO of Unanimous AI, warned, “In the metaverse, we won’t be hit with overt pop-up ads or promo videos, but simulated people, products, and activities that seem just as real as everything else around us.” There will be computer-generated personas “programmed to engage you in conversation, reading your facial expressions and vocal inflections so they can pitch you more skillfully than any used-car salesman. And they’ll be crafty, armed with a database of your interests and inclinations, plus a history of your previous interactions with similar ads.”


Children’s Advertising And Privacy In The Metaverse

The stakes described above are amplified for children because they are a uniquely vulnerable population. As Senator Ed Markey and U.S. Representatives Kathy Castor and Lori Trahan put it in a recent letter to the Federal Trade Commission, “Research indicates that children struggle to identify embedded advertising in video content. This raises concerns that they may experience similar difficulties identifying marketing in VR.” They argue that this could lead to marketing practices that are “inherently manipulative of children.”

Relatedly, several VR offerings are not positioned as products meant for children but are nevertheless used by the under-13 audience. Companies should consider implementing strong guardrails to keep children out of adult-only environments. And for environments that are meant for children, businesses should be following the protections and safeguards laid out for children in the Children’s Online Privacy Protection Act (COPPA). In addition to privacy protections and appropriate advertising limitations, these considerations include preventing harms such as bullying, harassment, predation, violence, or exposure to adult activities.


What This Means For Businesses

While this new technology is in an evolving growth mode, I suggest that businesses and nonprofits apply the same advertising and privacy practices as they do in the typical online world.

Make sure your advertising is truthful, non-deceptive, and clearly identifiable as advertising. This means that proper, easily viewable disclosures are important, not only in ads, endorsements, and brand-building events, but also in influencer content. As a reminder, influencers cannot be misleading in their promotion of the product or service. And ask influencers to clearly disclose their relationship to the sponsor. These disclosures must be hard for consumers to miss.

For privacy, this means following the web of relevant state and federal laws and disclosing the data you are tracking, collecting, or sharing. Consumers are already seeing this to an extent with targeted advertising, but because the metaverse introduces so many more ways to track and evaluate consumers, there is greater potential for businesses to personalize a user’s virtual environment, making these disclosures more important. Businesses should also be sure to adhere to relevant biometric privacy laws and have a compliance strategy to implement consumer data rights.

Regulating the metaverse will require active involvement and coordination among business leaders, policymakers, and consumers, necessitating a new paradigm of cooperation and accountability. This all begins with the companies themselves. I encourage businesses to come together to identify problem areas and develop self-regulatory systems and safeguards to both protect consumers and encourage continued innovation in this evolving space. As the metaverse itself continues to evolve, so too must the rules of the road.

Originally published in Forbes.

Suggested Articles


KOSA (and Children’s Privacy) on the Move

The Kids Online Safety Act (KOSA) is gaining traction in the U.S. Senate after the most recent round of revisions released this month by Senators Richard Blumenthal and Marsha Blackburn, following on the heels of proposed changes to the COPPA Rule. Here are CARU's high-level takeaways from the KOSA revisions with some insight into each revision.
Read more

Location Not Found: Mitigating Precise Geolocation Consent Flow Risk

Privacy-minded Federal Trade Commission (FTC) watchers have seen two bombshell enforcement actions related to alleged mishandling of consumer geolocation data. The Privacy Initiative team delves into those cases, the breadth of the penalties the FTC has included in the proposed orders, and best practices to avoid the crosshairs.
Read more

The ABCs of DPF and GDPR

Easing data flows across the Atlantic, the EU-U.S. DPF satisfies requirements outlined under the General Data Protection Regulation (GDPR), helping companies avoid steep fines.
Read more

The FTC Joins the Global CBPR Party

This month the Federal Trade Commission (FTC) announced participation in the Global Cooperation Arrangement for Privacy Enforcement (Global CAPE), signaling the agency’s interest in keeping pace with the increasingly global nature of commerce and marks an important step forward for the global expansion of CBPRs.
Read more