Hey, You Stole My Avatar!: Virtual Reality and Its Risks to Identity Protection

• Jurisdiction: United States,Federal
• Publication year: 2020
• Citation: Vol. 69 No. 4

Hey, You Stole My Avatar!: Virtual Reality and Its Risks to Identity Protection

Jesse Lake

HEY, YOU STOLE MY AVATAR!: VIRTUAL REALITY AND ITS RISKS TO IDENTITY PROTECTION

Abstract

Virtual reality (VR) consists of technology that injects users into a virtual world and will allow users to interact on an unprecedented level of cyber intimacy. VR technology is at a consumption tipping point as the technology is now cheaper and more accessible than ever before. Given the possible applications of VR in professional and business settings, some users will use their true name and likeness to interact with others, creating an effective extension of their person into the virtual world. By injecting their real identity into VR, these users are subject to risks of identity misappropriation—or the unauthorized use of their name and likeness by others. While identity misappropriation is already a sizeable problem in current social media interaction, VR is poised to exacerbate the issue. Unlike current social media identity misappropriations that yield only fixed media such as still photos, short videos, and written thoughts, when a VR identity is appropriated the thief can both create new content and continually interact with other people as the stolen identity. The problem is further intensified by other factors such as the real-time interaction between users, sophistication of perpetrators, and increased user investment in their virtual identity.

As it stands, the current substantive legal framework for redress of online identity misappropriation amounts to a web of inconsistent privacy laws leaving gaps in protection for the millions of users that log onto the VR servers. These inconsistencies are substantially caused by procedural barriers brought about by dated Internet laws. These procedural barriers include Internet personal jurisdiction, strong judicial preference toward protecting the anonymity of anonymous online users and sweeping immunity for Internet Service Providers (ISP). Together, these barriers leave plaintiffs without a defendant to sue: Anonymity and personal jurisdiction laws make enforcement against the appropriator virtually impossible, and ISP immunity prevents the plaintiff from suing the VR provider.

This Comment will argue for the lifting of these procedural barriers to give victims of VR identity misappropriation the opportunity to bring their claim to court. The proposed solutions include reworking personal jurisdiction precedent, adopting a plaintiff-friendly John Doe subpoena standard, and rewriting the Communications Decency Act to both reduce immunity and establish a victim compensation fund. Implementing these proposals will deter

[Page 834]

VR identity thieves from committing future misappropriations and incentivize VR providers to police their own products.

Introduction.............................................................................................835

I. Virtual Reality: A Whole New World.....................................838

A. VR Technology Background..................................................... 838
B. Application of VR ..................................................................... 841
C. VR's Effect on the User ............................................................ 844
D. The Risk of Identity Misappropriation in the VR World........... 845

II. Current Identity Laws.................................................................848

A. Right of Privacy........................................................................ 849
B. Right of Publicity...................................................................... 852

III. Internet Law's Impact on Identity Misappropriation............856

A. Internet and Personal Jurisdiction ........................................... 857
B. Anonymity of User .................................................................... 860
C. Communications Decency Act .................................................. 865

IV. Proposed Solutions to Lift the Procedural Hurdles Brought by Internet Law.............................................................................872

A. Fitting the International Shoe onto VR..................................... 872
B. Removing the Shield of Anonymity for VR Identity Thieves ..... 874
C. Redrafting the 1996 Communications Decency Act for 2019's Internet Landscape ................................................................... 876
D. Proposal's Effect on Substantive Law ...................................... 877

Conclusion.................................................................................................878

[Page 835]

Introduction

Increasingly, there is an augmented world growing among us. This world is virtual, created by state-of-the-art virtual reality (VR) technology that immerses users into computer-generated experiences. users will be able to accomplish a wide range of activities, including shopping at an Amazon VR kiosk,¹ holding "face-to-face" business meetings in virtual conference rooms,² or watching a live NBA game from courtside seats.³ This technology will, quite literally, add a new reality to people's everyday lives. But VR will also create new legal questions. These are questions that our legal system must answer before millions of users log onto the VR server. Without these answers, the legal landscape of VR will be governed by private user agreements that consumers will likely not even read but can substantially limit their rights in their new world.

Current laws have not been tailored to provide adequate recourse to the many transgressions that can occur in a VR world. The adoption of VR is one direct example of technology moving faster than the law, as our society is becoming transfixed by cyberspace. Particularly, identity misappropriation, while already a pervasive problem with current cyber technology,⁴ will likely be a more frequent and dangerous issue in VR. Identity misappropriation occurs when someone uses the identity of another person without authorization to extract some type of benefit.

In the VR world, everyone will possess an online identity (or avatar)⁵ that they will use to interact with others. A user's avatar is the virtual manifestation

[Page 836]

of their actual person and will serve as their identity in VR society. From local "small-city" servers (hosting 10-20 users) to large "metropolitan" server farms (hosting millions of users), users will be known in their VR communities by the likeness and popularity⁶ of their avatar. Thus, as users become incentivized to gain popularity by investing in their VR avatar, criminals will be even more apt to exploit the popularity of other avatars.

VR will further exacerbate the issue of identity misappropriation because VR enables users to interact with a level of unprecedented intimacy. These interactions will occur in real time, robbing victims of the opportunity to authenticate the validity of avatars they interact with. These interactions could occur in a virtual marketplace, nightclub, or office building, and will mimic real-world human interaction. Hence, while VR communication elevates digital communication to quasi-organic human interaction, it also creates an environment where users cannot verify exactly who (or what) they are interacting with, leaving many fraudsters undiscovered and free to dupe more victims.

Victims of these frauds manifest on both sides of the transgression. On the one hand, there will be avatars whose identities are stolen and used to defraud other VR users. And on the other hand, there are the users that are defrauded by stolen VR avatars. As with any crime, the damages of such actions depend on the circumstances of the crime. Some can be high profile, such as a thief that steals the identity of a prominent businessperson and broadcasts a "lucrative" business opportunity to his millions of followers. Or that same thief can publish the confidential conversations that the businessperson had with their partners. Other instances may be more localized but just as severe, such as stealing the identity of an ordinary person to interact with that person's lover. The possible types of these misappropriations can be endless and, if left unaddressed, would lead to a collapse of trust in the VR world.

From a substantive legal perspective, the victim's recourse depends on many different factors, including the motivation of the infringer and the popularity of the user. Some jurisdictions only recognize an action for identity

[Page 837]

misappropriation when the perpetrator derived a commercial or monetary benefit, while others have broader definitions of what constitutes a benefit.⁷ Additionally, some jurisdictions permit recovery only when the victim was aware of the misappropriation, leaving victims who were unaware of the misappropriation without remedy.⁸ These inconsistencies leave gaps in identity protection for the millions of eventual VR users.

The reason for these inconsistencies likely stems from the many procedural restraints brought about by dated computer and Internet laws. These restraints have limited the number of cases heard on the subject, hindering the legal evolution of identity misappropriation laws. These outdated Internet laws have produced intractable cyber jurisdictional questions, sweeping protections for anonymous cyber criminals, and broad immunity for Internet service Providers (ISP).⁹

As an illustration, imagine two VR users whose avatars depict their true name and likeness. Then, an identify thief comes in and copies both avatars, but for different purposes. Avatar A is copied to endorse his new clothing line at his VR storefront, and Avatar B is copied purely because the thief likes the way the avatar looks and walks around a VR club interacting with others as Avatar B. While the act of misappropriation in both instances is functionally the same, the redressability for each victim will depend on a number of factors. Some of these...