Personal Information Protection in the Metaverse

The metaverse world is a convergence of the virtual and real worlds. As metaverse users' avatars possess their own identities as alter egos, the current Personal Information Protection Act has limitations in protecting personal information and preventing privacy violations within the metaverse. Furthermore, headsets utilizing virtual reality, augmented reality, mixed reality, extended reality, and AI technologies in the metaverse pose a growing risk of personal information infringement, such as the collection of biometric information without prior consent, targeted advertising, or the sale of collected biometric information to third parties. Therefore, establishing legal and institutional frameworks is urgently needed. Despite this, Korea's Personal Information Protection Act and the Virtual Convergence Industry Support Act lack adequate legal and institutional frameworks for personal information protection within the metaverse. In particular, the metaverse is inherently more harmful to children under the age of 18 than to adults, requiring age verification, consideration of the rights of child guardians, consideration of children's primary interests, and appropriate age-appropriate privacy design. Furthermore, the introduction of a data impact assessment system is required. Below, We examine the legal nature of the metaverse and examine the necessity of privacy protection in the metaverse. Furthermore, we examine the privacy protection laws of the US and UK metaverses from a comparative legal perspective to explore implications for Korea. Specifically, we propose improvements to: i) establishing privacy protection laws for the metaverse; ii) ensuring consistency and traceability of avatar identities; iii) ensuring prior consent and minimization of personal information in the metaverse; iv) measures to protect children's personal information in the metaverse; v) the metaverse and data privacy issues; and vi) legal issues related to mitigating privacy concerns in the metaverse.