Digital Identity in the Metaverse: Addressing Kids & Teens

PRIVO hosted an event for Identity Management Day 2022, with an in-depth discussion on why identity is important in the metaverse and what will it mean to “get minors identity right” in this new virtual environment. In spite of its relative maturity, the digital world continues to be fraught with identity risk for children. The evolution of the metaverse will accelerate those risks exponentially, especially for children and teens, who bring unique vulnerabilities and challenges regarding identity and authentication.

To kick off the webinar, Nic Mitham, founder of Metaversed, shared his Metaverse Universe chart, showing virtual worlds segmented by how they are accessed (via browser or virtual reality headset) and whether they're on or off a blockchain and browser/HMD access indicating the status, and the number of MAUs. Nic highlighted that the age distribution of the 440 million MAUs sweet spot is 12 to 13 years old, driven primarily by Minecraft, Fortnight, and Roblox.

Nic went on to report, “86% of the current metaverse population is 18 or under yet the lion's share of the worlds that are in development on blockchains which, by definition, require crypto wallets to access them with minimum legal age requirements.”

As the other panelists started to chime in, James G. Gatto, Partner at Sheppard Mullin, who specializes in technology law like blockchain (including blockchain games, cryptocurrency/NFTs); interactive entertainment (metaverses, virtual worlds, games, AR, VR, fantasy sports, esports); AI and more, went on to discuss that from both a business and legal perspective, these different technologies and business models within the metaverse drive different legal issues, highlighting the importance of Identity and privacy.

"One of the challenging things with the metaverse is governance in general. The real-world law applies. Then you have another level of governance to think about. If you own land, you can impose in some situations conditions on people entering your land or businesses that you create on that land. There's this layer hierarchy of governance that is incredibly complex and then, when you layer blockchain and crypto currency and everything on top of it, it creates even more complex and these are the issues that we're dealing with,” explained Gatto.

Claire Quinn, PRIVO’s Chief Privacy Officer, moderating the discussion, pointed out the importance of knowing your audience in order to treat them appropriately, asking the panelists to weigh in on this topic. As the fastest growing audience online, children will be at the door of these metaverses, whether companies like it or not.

“We know that kids are probably one of the largest group of fraudsters on the Internet, when it comes to age and parents are fairly complicit in that as well,” stated Denise Tayloe, PRIVO’s CEO. Tayloe continued, “You're going to have to assume there's a child, on the other side of that device until somebody can prove otherwise.” Due to cost, families will be sharing devices, headsets and even wallets for some time. Companies will need to default the device being used by a minor, unless an adult can prove otherwise.

Tayloe predicts there will be a need to bring in two factor authentication before the device can go into play in certain land and spaces within a metaverse, confirming the family member prior a verified pin or QR code. Part of smartening up our age gates, will not be to just rely on the gate when you create an account, but verification checks along the way. Crypto wallets, as explained by Gatto in the discussion, will not a reliable source for identity and age checks for multiple reasons, including the ability to easily share private keys.

“Identity vs Personas”
The topic of addressing the management of identity and digital personas within these metaverses is important. As James Gatto pointed out, the definition of legal identity is typically name, gender, day you born and where. When you layer on top of that, the fact that people will purposely create different digital personas and may want to keep those separate from professional personas liked Linked in, a social friends and family persona to a fantasy persona you don't really want to be associated with your real identity. Identity and digital persona management in general is difficult, but it's going to be definitely even harder with kids in the metaverse.

Gatto then went on to explain, “One of the great things you know we hear is this term decentralization, with respect to blockchain and Web 3. It's a very powerful thing to take the power out of the central organizations and give power to the people, but with that power comes accountability as well and, and this is one of the aspects of accountability.”

Denise Tayloe responded, “And if the parents knew that they were filling up a wallet with money that forget the password and you've lost all the money and there is no company neck to come and ring to get back into it, that will be an interesting component as well.”

Other topics such as biometric data and safety, existing regulations and up and coming children privacy regulations were also highlighted in the conversation.

In conclusion, the planning and design for compelling enrichment and entertainment opportunities in these evolving virtual environments must consider minors’ safety and privacy as fundamental. This means delivering accurate age assurance, streamlined and authentic parental consent, and enabling privacy enhanced, interoperable digital identity credentials; effectively a digital passport that children can use across compliant environments to better protect them from online harms. Companies cannot continue to build these solutions on their own. An industry wide approach to adopting holistic solutions is a must.

“Whether you're building a platform, buying land, operating a business or providing a service on someone’s land, you absolutely have to get a full legal review up front and understand what all the legal issues are to protect your brand,” reinforced Gatto.

Nic Mitham concluded, “It all starts with the platform operators, the companies building the virtual worlds recognizing, whether they like it or not, they're going to have kids inside their platforms. They've got to take it seriously.”

Starting now, stakeholders in the metaverse have the equivalent of a blank new slate for “getting it right” for minors. Are they willing to do what it takes to get it right? We hope and are standing by with the solutions, whether they want to block or engage, for them to do so.

*Watch the webinar here for the full discussion.