How to be (In)Famous in the Metaverse

Ignorance of the law is not a valid defense

Disclaimer: The following is not legal advice. Not at all.

Do you own your face?

That may seem like a ridiculous question, but the other day I was speaking to a couple of friends and the question about who owns your image in the Metaverse came up.

The discussion went something like this: If I was going to build an avatar for myself in the Metaverse, I probably would not replicate my current image but use it as an opportunity to create the likeness of myself that I wish for, so probably a 20-something red head, athletic, straight nose, high cheek bones, bright blue eyes, no freckles and a really nice smile. I wouldn’t say it is lying about what I look like now, and I don’t think that if I wanted to change my gender or be a bored ape, that that would be lying anyway.

So, if we can create an image of ourself in the Metaverse based on what we want it to look like, does that mean someone else can mimic your face in the Metaverse for their avatar, without your permission, because that is what they want to look like?

What if someone really wants to look like Dwayne Johnson?

To answer this question, we need to do a little law school analysis. In copyright law, the person behind the camera owns the image taken. This principle emerged from the art world, specifically paintings.

Did Mona Lisa own the painting of her or Leonardo da Vinci? Well, Leonardo da Vinci, of course. He should be rewarded for his labor.

But then along came technology, specifically, the camera. I think one of the most significant repercussions of that technology, that the law failed to address, was the rise of the paparazzi. The paparazzi took advantage of two things. High speed, fast click cameras that were capable of taking many pictures within seconds, and the law. The paparazzi could sell their pictures to publishers and make a living from it. Since they took the picture, they owned it and could sell it. There is no doubt that they were selling the faces of celebrities because the law enabled them. I will never forget the tragic death of Princess Diana escaping from the paparazzi in a speeding car.

But that event did not change the law. In fact, in researching for this blog post, it seems that the paparazzi have turned the tables and are now suing celebrities who post photos on their social media pages that were taken by the paparazzi without payment. That’s an interesting twist.

Perhaps the principle of fair use, which is a defense to copyright, should be explored. Fair use can be quite complex, but, generally, it is a permissions exception allowing someone to use a photo, that they did not take, for a transformative purpose. I will come back to this later, but someone using your picture that you took and put on Facebook to make themselves an avatar is hardly a transformative use, so I think fair use is not a great defense for your wannabe to use.

Let’s adjust our question a little. Could someone take your picture and then use technology to turn your image into an avatar for their Metaverse experience?

Our analysis of the law is not complete. While copyright is the obvious law to apply, there are others. For example, let’s look at impersonation laws. Impersonation laws are exactly what they sound like. A fraudster who intentionally takes on the identity of another, whether it is a real identity or fake, with the intent to commit a crime. It is that last part that is the key. Practically, you always have to ask the question, “what is the harm?”

Because impersonation laws, especially for online impersonation, have exceptions, generally for parody, satire and politics, which are freedom of speech rights and not considered harmful.

Sure, you can go to Las Vegas, buy an Elvis costume and walk around pretending to be Elvis, just like you can on Halloween. However, the minute you take money for that parody, well, the Right to Publicity kicks in and you are going to have to pay some royalties to Elvis’s estate. What happens in Vegas, doesn’t always stay in Vegas.

Credit: Maridav

But I think walking around the Metaverse as an avatar of the Rock is slightly different than someone adopting my own image. The Right to Publicity probably protects him because usurping his image is capitalizing on his celebrity.

What about us regular, non-celebrity types?

Hmmm, I am now confused as to where our analysis stands: can someone impersonate my face in the Metaverse as their avatar or not? Because there is certainly no cash in it for them.

I think we have one more law to analyze, if you aren’t asleep already. Biometric laws exist to protect your privacy by restricting how companies can collect identity data on you, like your face. These laws, which are state laws (no federal “one to rule them all” law), were passed in Illinois and Texas. Companies like Facebook have had to defend themselves against these laws.

The problem with facial recognition technology (and there’s more than one problem) is that it allowed the emergence of deep fakes. A.I. generated images that look a lot like real people because they are created from photos of real people. Much like fast click cameras, the law has failed to address the repercussions of this technology, and I think that is a mistake when it comes to the Metaverse and its ability to use deep fakes for impersonation.

I have written before about a company I loathe called ClearViewAI and so I cannot help myself but to mention them again. I loathe them because I think they will end up sending innocent people to jail. Their claim is that because the images they process for facial recognition are public, that they can use them to build their models. Your public Facebook feed is feeding their model.

Remember George’s post on this very topic?

Since ClearViewAI did not take the pictures themselves (copyright), they must be relying on that concept of fair use that I mentioned before. I assume the argument is that facial recognition used for law enforcement is a transformative use or that the facial recognition technology alone is transformative?

Regardless, my point here is that they have your face in their database and they could pivot to a Metaverse company that offers your face for sale as an avatar.

That is why biometric laws could be very powerful. It frustrates the reliance on fair use and says, “you at least need the consent of the person in the image to use the image for another purpose.” When you uploaded your picture to Facebook, you did it to share with your friends, not so some A.I. company could sell it as an avatar.

Putting all of this analysis together, if your avatar impersonates Dwayne Johnson, which you created from publicly available pictures of Dwayne Johnson, and you shoot a movie claiming to be the real Dwayne Johnson so you can collect the profits, then I think you are in big trouble.

If you adopt an avatar of Dwayne Johnson, that you paid for from an official licensor, so that you can attend a Dwayne Johnson movie in the Metaverse as a fan, then I think you are probably okay.

But when it comes to someone else taking a picture and using that picture to replicate my face as their own in the Metaverse ? Based on the analysis here, it’s murky, but I am leaning on the side that the law sort of protects me depending on where I live and what their intent is. I am really starting to wish for a federal biometric law.

But it sort of begs another question, doesn’t it? The question of, how would I ever know?

In the iconic words of Elvis, “Thank you, thank you very much.”

Caroline

P.S. There are many more nuances here and I am trying to keep the flow of the logic, but you may be asking, how does the Right of Publicity work with the paparazzi owning copyright to an image? The Right to Publicity has a newsworthiness exception. The paparazzi sell their pictures to magazines and newspapers to augment stories, thus, they rely on the newsworthiness exception to the Right to Publicity to sell the pictures.

P.P.S. I am sending this newsletter to some of you who registered for our latest event Privacy and Security in the Metaverse: NFTs and Scams but were unable to attend. The recording is here on YouTube. Please unsubscribe below if you no longer wish to receive this newsletter. Our next in the webinar series is on March 31 at 11 AM EDT and the line up is incredible for this discussion on cryptocurrencies. I am also on a Web3 and the law panel next week, if anyone is interested.

---

About the author: Caroline McCaffery is a co-founder at ClearOPS, which stands for clear operations in privacy and security. ClearOPS automates the tedious task of filling out privacy and security assessments and offers vendor monitoring. She is a frequent blogger and speaker with over 20 years of experience as a lawyer working with tech startups. You can connect with her on Linkedin.

Security Expert Marketplace is the only exclusive community for vCISOs. Providing vCISOs with community, private events and public speaking opportunities, the Security Expert Marketplace is on a mission to facilitate better security.