The “metaverse” seems to be the latest buzzword in tech. In general terms, the metaverse can be viewed as a form of cyberspace. Like the internet, it’s a world – or reality, even – beyond our physical world on Earth.

The difference is that the metaverse allows us to immerse a version of ourselves as avatars in its environment, usually through augmented reality (AR) or virtual reality (VR), which people are and will increasingly be able to access using tools like VR goggles.

While it all seems very exciting, a curious lawyer like me is inclined to ask: who or what governs the metaverse? The way I see it, there are three key areas which, at this stage, are legally murky.

1. A boundless marketplace

Transactions in the metaverse are generally monetised using cryptocurrency or NFTs (non-fungible tokens). An NFT is a unique digital asset: it could be an image, a piece of music, a video, a 3D object, or another type of creative work. The NFT market is booming – in some cases we’re talking about sales equivalent to millions of pounds.

While it’s difficult to say whether this is simply a trend, or a new and exciting form of capital investment, these kinds of transactions raise some interesting legal questions.

For example, in the “real” world, when it comes to purchasing a piece of art, property law dictates that ownership is two-fold. First, ownership can be attributed in the actual physical art work. And second, the buyer may or may not own the intellectual property of the art work, depending on the terms of the sale.

But what kind of ownership is precisely included in a transaction of digital art? International law firm Reed Smith has said that “ownership” in the metaverse is nothing more than a form of licensing, or provision of services. In such instances, true ownership still lies with the owner. This may mean, for example, that the buyer cannot sell the item without permission from the true owner.

Virtual real estate has also become an NFT, with individuals and companies spending enormous sums to own a “property” in the metaverse. Do the intricacies of land law apply here? For example, will real-world legislation cover trespassers on private land in the metaverse? Can you take out a mortgage on your virtual property?

The metaverse may also be susceptible to hosting a virtual marketplace somewhat like Silk Road, which was a dark web marketplace dealing in illegal drugs, weapons and, allegedly, “murder for hire”. What kinds of laws can be put in place to safeguard against this happening in the metaverse? It would be ideal to have a global regulatory authority overseeing the metaverse, although this would be difficult to implement.

2. Data

Another possible legal implication of the metaverse is around data and data protection. The metaverse will expose new categories of our personal data for processing. This might include facial expressions, gestures and other types of reactions an avatar could produce during interactions in the metaverse.

The EU’s General Data Protection Regulation (GDPR) could arguably apply to the metaverse, as could the UK’s Data Protection Act. But given the novel nature of the metaverse, to ensure that users’ rights are protected, the processes governing informed consent around data processing may need to be revisited.

Further, the “no-boundaries” nature of the metaverse means that while we might want to assume the GDPR will apply, the clauses dealing with transfer and processing of data outside the EU may need to be clarified. The GDPR applies based on the location of the subject when their data is processed, not on their home country or citizenship.

So can we look to the location based on the person operating the avatar, or is it more appropriate to look at the avatar itself, since it’s the avatar’s data that will be processed? And if we look to the avatar’s location, how would we determine which jurisdiction the metaverse falls under?

3. User interactions

When users interact through their avatars, we may have situations where some kind of altercation occurs that would equate to breaking the law, if it took place between people in the real world. Such incidents could be in breach of tort law (which covers civil claims such as negligence or nuisance) or criminal law (involving illegal acts and crime such as assault, murder, burglary or rape).

Imagine one avatar assaults another. Could we apply criminal laws of assault and battery to this situation? How could we make an avatar responsible for their actions in the metaverse? This would be complicated, because it would mean that we need to attribute a legal persona to the avatar, giving them rights and duties within a legal system; allowing them to sue or be sued.

Proving assault or battery would also be much more difficult because it usually requires “actual bodily harm”. In the metaverse, there will naturally be no actual bodily harm. It would be challenging to prove harm, loss or injury suffered by an avatar.

Worryingly, sexual predators are already emerging in the metaverse, masking their identity behind an avatar that may not easily be traced back to its operator in the real world. For example, we’ve seen incidents of groping. Users in the metaverse can wear haptic vests or other technologies which would actually allow them to feel the sensations if they were touched or groped.

Sexual harassment laws do not require physical contact to constitute sexual harassment. But are existing laws adequate to deal with this issue? Within the environment of VR and gaming, for example, upon whom rests the responsibility to ensure the safety of users?

There is little doubt issues of sexual harassment will make their way into the metaverse, particularly if unscrupulous users know this is a grey area. Believing that their actions cannot be proved, or that they cannot be held responsible for events that take place in the metaverse, might embolden such behaviour.

This comes back to the question of legal personas of avatars – is a legal persona necessary to make avatars responsible for their actions in the metaverse? And what kind of standards and criteria need to be in place to distinguish between a “legal” avatar and the true legal person who operates that avatar? These issues should all be addressed before the metaverse becomes mainstream.