Going Incognito: How To Protect Our Privacy In The Metaverse

In the image below I am in a “Virtual Escape Room” created by academic researchers at UC Berkeley’s Center for Responsible Decentralized Intelligence. The simulated world requires me to complete a series of tasks, with each unlocking a door. My goal is to move from virtual room to virtual room, unlocking doors by solving puzzles involving creative thinking, memory skills and physical movement, all naturally integrated into the experience.

I can proudly say that I came out of the virtual labyrinth and back to reality. This was, of course, made by a research lab, so you’d expect the experience to be more than it looks. And you’d be right: it’s designed to demonstrate the major privacy issues in the metaverse. It turned out that as I solved the puzzles and moved from room to room, the researchers used my actions and reactions to uncover a wide variety of information about me. I am talking about highly personal data that a third party could have obtained through my participation in a simple virtual application.

Since I’ve been involved in virtual and augmented reality for decades and have been warning about the hidden dangers for years, you would think that the data collected wouldn’t have surprised me. But you would be wrong. It’s one thing to warn about the risks in the summary; it’s different to the . to experience Personal problems first hand. It was actually quite shocking.

That said, let’s take a look at the personal data they were able to gather from my brief escape room experience. First, they were able to determine my location. As described in a recent article about this study, metaverse applications generally ping multiple servers, allowing the researchers here to quickly predict my location using a process called multilateration. Even if I had used a VPN to hide my IP address, this technique would still have found where I was. This isn’t shocking as most people expect their location to be known when connecting online, but it’s a privacy issue nonetheless.

The researchers went deeper and were able to use my interactions in the escape room to predict my height, the length of my arms (wingspan), my dexterity, my age, my gender and basic parameters about my physical condition, including how low I could squat and how quickly I could respond to stimuli. They were also able to determine my visual acuity, whether I was color blind, and the size of the room I was in, and make basic assessments of my cognitive acuity. The researchers could even have predicted whether I had certain disabilities.

It’s important to point out that the researchers used standard hardware and software to conduct this series of tests, mimicking the capabilities a typical application developer might use when building a virtual experience in the metaverse. It’s also important to point out that consumers currently have no way of defending themselves against this – there is no “incognito mode” in the metaverse that hides this information and protects the user from this kind of evaluation.

Well, there wasn’t any protection until the researchers started building one – a software tool they call “MetaGuard” that can be installed on standard VR systems. As described in a recent article by lead researchers Vivek Nair and Gonzalo Garrido of UC Berkeley, the tool can mask many of the parameters used to profile my physical features in the metaverse. It works by cleverly injecting randomized offsets into the data stream, hiding physical parameters such as my height, wingspan and physical mobility, which could otherwise be used to predict age, gender and health characteristics.

The free software tool also allows users to mask their handedness, the frequency range of their voice and their physical condition, and hide their geospatial location by interfering with triangulation techniques. Of course, MetaGuard is only a first step in helping users protect their privacy in immersive worlds, but it’s an important demonstration that consumer-level defenses can be easily deployed.

At the same time, policymakers should consider protecting basic rights for users around the world against invasive tracking and profiling. For example, Meta recently announced that the next VR headset will include face and eye tracking. While these new capabilities will likely unlock very useful features in the metaverse, such as allowing avatars to express more realistic facial expressions, the same data can also be used to track and profile user emotions. This could enable platforms to build predictive models that anticipate how individual users will respond to a wide variety of circumstances, and even enable adaptive ads optimized for persuasion.

Personally, I believe the metaverse has the potential to be a deeply humanizing technology that presents digital content in the form most natural to our perceptual system – as immersive experiences. At the same time, the vast data collected in virtual and augmented worlds is a major concern and likely requires a range of solutions, from protective software tools such as MetaGuard to thoughtful metaverse regulation. For those interested in the pursuit of a secure metaverse, I point you to an international community effort called Metaverse Safety Week that happens in December.

Louis Rosenberg, PhD is an early pioneer of virtual and augmented reality. His work began more than 30 years ago in Stanford and NASA labs. In 1992, he developed the first interactive augmented reality system at Air Force Research Laboratory. In 1993, he founded the early VR company Immersion Corporation (public on Nasdaq). In 2004, he founded the early AR company Outland Research. He received his PhD from Stanford, received more than 300 patents for VR, AR and AI technologies, and was a professor at California State University.