In the 1990s, author Neal Stephenson envisioned an immersive world that would be accessed by virtual reality goggles. He named the world the metaverse.

Today, the metaverse is broadly conceived of as a virtual reality and augmented reality that “combines aspects of the digital and physical worlds”. It also offers an enormous business opportunity as it represents a potential $13 trillion market and five million users by 2030. It is no wonder then that businesses are fighting to be part of this market, with Facebook even rebranding itself as “Meta” to capitalize on the metaverse.

From a human rights perspective, the metaverse certainly presents some advantages. For instance, it can help with the right to health. Metaverse-related technology is already being used to treat lazy eye disorder in children and helping to locate tumors in diagnostic imaging scans. The metaverse is further being used to improve the right to education by making education more globally accessible and improving students’ learning opportunities.

However, alongside these human rights benefits, the metaverse also raises risks to human rights. For one, it continues down the path that other technological advances have already made in creating threats to privacy. Most of us are already aware of the threats to our data privacy that the internet poses through its data collection and data sharing functions. For the most part, the privacy concerns centre around information data; information such as names, addresses or credit card information. The metaverse will continue these human rights risks, although, as a commentator has noted, the metaverse will involve “data collection on steroids”.

That is because the technology involved in the metaverse will enable the capture of much more specific information about us. Information such as our eye movement, our body poses, our voice and even the way we scrunch our noses will be tracked. This biometric data information will then be used to make inferences about us.

For instance, tracking data about eye movement can reveal a host of information about a person. This can include information on gender, age, or ethnicity to more intimate information such as their fears, interests, or sexual preferences. As a result, we could enter the metaverse to enjoy a game and end up revealing an intimate portrait about our life without even knowing it.

The metaverse also raises concerns about autonomy. Human rights are “protections of our normative agency” and as a result limitations on our autonomy may have an impact on the agency that underpins our human rights. The metaverse creates a situation that has been described as “patiency”, or being like a patient, which is the converse of agency. In the metaverse, “things are done” to the user and the user often has little ability to prevent these things from happening.

In short, while the metaverse may offer human rights opportunities, it is clear that it has a human rights problem. That raises the question as to whose role it is to regulate the metaverse to prevent human rights violations.

To answer this question, we need to remember, that no matter where we are in the world that we are all entitled to human rights, as the Universal Declaration of Human Rights reminds us. We also know that states bear a duty under international law to ensure that our human rights are protected.

The United Nations Guiding Principles on Business and Human Rights further tell us that businesses have different responsibilities for human rights than states. Contrary to a state’s duty to protect, respect, and fulfill human rights, businesses only have a responsibility to respect human rights.

In the non digital world, there is a logic behind this lesser responsibility for businesses than states. The state has sovereign authority over a territory, meaning that they are in a position to enact all necessary laws to ensure the protection of human rights.

However in the metaverse, it is unclear who has “sovereign authority” over the metaverse. It could be the metaverse platform owner, the state in which the metaverse platform owner is headquartered, or even the owner of individual “lands” in the metaverse on which a human rights violation occurred.

While determining who is ultimately responsible for enforcing human rights in the metaverse is unclear, what is clear is that the classic paradigm of states having primary responsibility for the protection of human rights has been upended. Since the metaverse is created by business, businesses in the metaverse arguably occupy the same role as the state in the classic paradigm. That is, businesses as the creators of either the metaverse itself or lands within the metaverse may have taken on the role of de facto sovereign ruler. This would suggest that businesses should bear a much larger role in respecting – and arguably protecting and fulfilling – human rights in the metaverse than the UNGPs would suggest.

One way to ensure that businesses would be obliged to take on an enlarged human rights protection role in the metaverse would be to establish a Metaverse Charter of Human Rights. This would outline the human rights that need to be protected in the digital world and the businesses’ legal obligations to ensure the protection of these rights. Moreover, every metaverse platform provider or even every entity establishing a land in the metaverse could be required to adhere to obligations in the Metaverse Charter. Failure to abide by the obligations in the Metaverse Charter could be enforced through an action in an international court or arbitration.

However, even if business obligations for protecting human rights in the metaverse were expanded, states should still have a role as well. States could be tasked with developing protocols to assure the protection of human rights in the metaverse. They could be required to enact data protection legislation which limits the collection and use of both information and biometric data. Businesses’ failure to adhere to such data protection legislation could also be enforced by independent governmental agencies. Indeed, this might be one of the key roles for states in this area, by providing oversight of all the activities governed by businesses in the metaverse.

To ensure proper protection of human rights in the metaverse, we need both business and state action. Without this, we risk leaving the metaverse to become a virtual wild west and a threat to human rights.

Read more on this topic in Business and Human Rights Journal.