Who will govern the metaverse? Examining governance initiatives for extended reality (XR) technologies

In this article, we follow definitions of media and technology governance, understood broadly as the set of legal, political and economic relationships shaping the interactions between users, technology companies, governments and other stakeholders. Governance can be both restrictive (limiting individuals and entities’ capacities for action) but also enabling (providing means for individuals or entities to act). A key reference point is the work of technology policy scholar Robert Gorwa (2019a, 2019b). Building on Abbott and Snidal’s (2009) model, Gorwa (2019a) conceptualises the governance of technology (in his case, focusing specifically on platform technologies) as a ‘triangle’ – a three-sided relation between technology firms, nation-state agencies and non-governmental organizations (NGOs). Crucially for Gorwa, each of these points of the triangle are not bracketed off from one another, but rather interrelated in ways that are dyadic (e.g. state-NGO co-governance) and triadic (e.g. state-firm-NGO co-governance).

From the perspective of the governance triangle, there are a range of possible governance frameworks. Technologies can be self-governed in a way that is voluntary and non-binding – such as industry standards bodies or self-imposed initiatives (e.g. Meta’s ‘Oversight Board’, see Wong and Floridi, 2023). Technology is also subject to external governance – such as through the increasing application of laws and public policy to the conduct of platform businesses and end use practices (Flew, 2021). Technology is also commonly subject to co-governance – collaborative rulemaking between governments, industry and CSGs (such as creating standards, or through consultation with industry in the law-making process).

Yet, governance is not value neutral. For researchers studying technology governance, it is imperative to understand not only what approaches to governance are, but why they are implemented and to whom they deliver benefit. An interdisciplinary literature has demonstrated how technology governance is heavily influenced by market and state ideologies (Jasanoff and Kim, 2015; Mansell, 2012) and geopolitical contexts (Gray, 2021; Siu and Chun, 2020). Governance shapes what technologies get made and how they get used, in ways that benefit some stakeholders (and not others). For example, technology governance often elevates and legitimates the commercial interests of large industrial stakeholders. We might think of how corporate self-governance is deployed self-servingly by tech firms in response to public and regulatory controversies (see, for example, Gillett et al., 2022). Or how industrial calls for governance – particularly in emerging technology sectors like artificial intelligence (AI) – might shape emerging legal and regulatory measures in ways aligned with industrial interests (Veale et al., 2023: 17–18). In other words, techno-politics – the way that human actors assemble institutions, procedures and objects in pursuit of particular ends (Winner, 1980) – is not just about how technologies are made or what they do, but how they are governed.

While XR technologies have not seen widespread adoption, a small (but growing) literature has focused on their governance. This literature concentrates on two broad areas – governance issues and governance initiatives. The former identifies governance challenges, often proposing potential resolutions through policy or regulation. The latter, a smaller literature, identifies XR’s governance mechanisms (and often interrogates the material and ideological interests underlying governance).

Early work on XR governance issues has focused on high-profile technologies, like the Google Glass – Google’s AR device which never reached a consumer market – examining how emerging AR computing interfaces conflict with privacy laws (Meese, 2014; Wassom, 2014). More recent research has focused on the resurgence of XR over the last decade, and how new technologies, business models and practices coming with it have legal and regulatory implications. Echoing tenets of feminist critiques of VR and notions of virtuality (e.g. Green, 1999), recent work in media studies (Carter and Egliston, 2024; McStay, 2023) has argued that thinking about governance in XR requires taking seriously the social, political and economic structures surrounding XR’s development and use, interrogating how it might benefit some and not others.

Embodying this perspective, a nascent scholarship has identified policy and governance challenges facing contemporary XR. For instance, the intersections of XR in work contexts and anti-discrimination regulation (Egliston and Carter, 2021: 11–14), harassment and social harm (Blackwell et al., 2019), and market competition (Egliston and Carter, 2022c). More prescriptive academic work, such as that published by industry-adjacent academic venues like the Institute of Electrical and Electronics Engineers, has addressed issues such as trolling, harassment and esafety with aims to effect changes in design and policy (Cortese and Outlaw, 2021). Perhaps unsurprisingly, given the data-rich nature of contemporary XR devices (Miller et al., 2020), there has been much attention to potentials for surveillance and implications for privacy – such as a focus on gaps between XR technology and existing privacy law (Heller, 2020), or the regulatory implications of how XR data might be operationalised (namely, for new frontiers in targeted advertising; see Heller and Bar-Zeev, 2021).

A smaller literature has shifted from studying governance issues to studying governance initiatives. Particular attention in the current literature has been to corporate policy. For instance, research has analysed XR ‘best practice’ initiatives advanced by industry (particularly by Meta), many of which have been critiqued as a cynical effort to drum up goodwill (Applin and Flick, 2021; Harley, 2023). Other work has explored how terms of service agreements govern user or complementor behaviour (Egliston and Carter, 2021; Trimananda et al., 2021), and set out speculative design guidelines for how VR software developers might implement policies that more meaningfully attain user consent (of particular importance given the technology’s data-rich nature, see Selinger et al., 2023).

Building on the current literature, and its focus on both issues and initiatives, this article offers a comprehensive account of XR governance – particularly that developed by industrial, civil society and government stakeholders. We aim to understand what is being governed (identifying its points of cohesion and tension), by whom and why. But beyond its explanatory potential, taking stock of the XR governance landscape allows us to account for its efficacy, its limitations and to think about what future (and perhaps more productive) initiatives might look like.

A common governance issue was privacy (n = 85). Specifically, the most common privacy-related issue was data-related privacy harm (n = 54), consistent with a focus on data and surveillance in the academic literature on XR. In the context of government initiatives, the Australian Attorney General’s Department – in a review of the Australian Privacy Act 1998 – recognises XR as an emerging threat to user privacy due to the sensitive, biometric nature of device data (G7). While the report is not scoped around XR specifically, it is cited as an example of where Australia’s national privacy law falls short, failing to protect against how digital data traces might be used to identify individuals.⁴ Issues of data and privacy have been echoed in the wider European context. As EC President von der Leyen put it in a 2023 consultation on digital connectivity, ‘the amount of data exchanged – and harvested – is larger than ever and will increase . . . The metaverse and virtual worlds . . . are making this even more evident’ (G38). Elsewhere, in a report presented in European Parliament, European regulators note the potential for privacy concerns due to the sensitive nature of XR data – ‘including biometric data and data on the emotional and physiological responses of users, representing sensitive personal data under the GDPR and thus requiring special attention and explicit user consent for each purpose for which data is used’ (G34). As we will return to later, a challenge for the EC (exemplified in the current case of XR) is balancing the tension between protecting ‘data rights’ while also advancing the commercialisation of technological research and ‘innovation’ (a tenet of EC policy, see Guay and Birch, 2022).

Government attention to data dovetails with the efforts of CSGs like the XRSI, perhaps the most vocal advocate of data protections in XR – placing significant emphasis on data-related harms. For example, the XRSI notes forms of physical or physiological biometric identification techniques which could theoretically extend from XR. These include gaze analysis, voice recognition and facial recognition (e.g. CSG1) – with the XRSI highlighting the implications for existing regulatory frameworks, such as the GDPR and Children’s Online Privacy Protection Act. Elsewhere, the Future of Privacy Forum (FPF) – an American data privacy advocacy group – published a resource on XR data governance, identifying data inputs derived from VR sensors (e.g. microphones, outward/inward-facing cameras and inertial measurement units, CSG73, CSG74). As FPF policy analyst Jameson Spivack notes, there is uncertainty about the application of US state-based privacy laws (namely, the Illinois Biometric Information Privacy Act [BIPA]) to XR data collection: ‘BIPA applies to information based on “scans” of hand or face geometry, retinas or irises, and voiceprints, and does not explicitly cover the collection of behavioural characteristics or eye tracking’ (CSG74).

Data collection and privacy was also a concern for industry stakeholders. For some, this was as simple as highlighting existing laws under which XR data would fall (e.g. I30). Differently, larger industrial stakeholders like Meta and Qualcomm responded to the issue of data privacy through attempting to cultivate a community of software developers (and other interest groups) that aligned with privacy-centred values (among other kinds of pro-social ideals, I10, I46). To do so, Meta and Qualcomm sought partnerships with researchers, software designers, and CSGs through funding schemes valued at US$50 million and US$100 million, respectively.

Beyond data, industrial attention to privacy included the threat of interpersonal surveillance – how users may be seen by other users in XR. Interpersonal surveillance was a major component of Meta’s October 2021 guidelines for user best practice following the release of its ‘Stories’ smartglasses (I11, I42). These principles, Meta suggest, were developed in partnership with ‘third-party experts’ (all of whom received Meta funding, I42), namely, the non-profit groups the Future of Privacy Forum, the National Network to End Domestic Violence, the National Consumers League, the Information Technology and Innovation Formation, Access Now and the LGBT Technology Partnership. It is notable, but not entirely surprising, that here (and indeed, in its wider treatment of data-surveillance), Meta centres protecting users against ‘bad actors’ (e.g. of users who might record and upload images of other unknowing users to social media) rather than the addressing the corporate imperative to surveil (and its associated harms).

Privacy, particularly data-related privacy harm, emerges as a key concern in XR governance initiatives globally. Governance initiatives focus largely on the data generated by XR technology (although also extend to forms of interpersonal surveillance), indicating gaps in and alignments with existing privacy laws and raising issues around user consent and data protection.

Safety, equity and inclusion was another common focus of XR governance initiatives (n = 86). For some government agencies and CSGs, user safety focused on the prevention of interpersonal harm precipitated by user conduct (e.g. avatar movements and gestures) and content (e.g. materials and imagery created in XR applications) – echoing wider debate among courts and regulators as to whether platforms are liable for user content and conduct (e.g. the UK Online Safety Bill, the Australian Online Safety Act). For some stakeholders, the notion that technologies create environments enabling harm was rendered particularly acute in XR through its interactive and embodied affordances.

For example, Connect Safely (CSG72), a non-profit scoped around technology safety and security, develops resources focused on user education (this initiative, notably, was funded by Meta, and one that would subsequently feed into Meta’s ‘Parent Education Hub’ [I1] – an educational resource for parents of children using Oculus devices published on Meta’s website, and one that Meta cites as an example of its own best practice in self-governing user behaviour in a response to an EC inquiry, see I9). Indeed, for Meta – and the large number of CSG initiatives funded by Meta’s US$50M XR Programs and Research Fund (XRPRF) (I10) – we found a focus on user safety initiatives, chiming with accounts of Meta’s wider self-governance and focus on preventing harm by enforcing ‘safety’ – a way to reinforce ‘a myth that platforms are neutral conduits’ (Gillett et al., 2022: 9), and that harm is the outcome of ‘bad actors’ rather than the technologies and business models of technology firms. Also falling under the umbrella of user safety, NGOs – such as the UN’s Office of Counterterrorism and Violent Extremism (CSG4) – have focused on the governance of conspiracist and extreme content (content, which has notably already appeared in Meta’s Horizon Worlds software as recent investigative reporting suggests, see Baker-White, 2022). As one European Parliament document notes, this is especially problematic given the immersive affordances of XR – with the potential that this content may ‘feel more real’ (G34). For governments, the call to implement guardrails for user safety was covered in more expansive overviews of the regulatory implications of XR (e.g. G20, G34). Government agencies, which have user safety as their sole remit – such as the Australian eSafety Commissioner – have begun developing education-focused initiatives, drawing on consultation with industry and users, to develop a ‘proactive harm prevention approach’ (G18).

Another common focus of equity and inclusion approaches was accessibility – particularly, focusing on disability. For industry, firms have implemented their own voluntary standards – such as Meta’s ‘Virtual Reality Check’ a list of best practices for third-party Oculus software developers to implement accessibility features (I13). It bears mentioning that such an approach pushes responsibility from XR providers to app developers (with the former – in the case of Meta – much better resourced to offer device and operating system level accessibility features). For government and CSGs, there was a push to make XR technologies accessible for the diverse requirements of disabled users. European Parliament flags ‘Accessibility and Inclusiveness’ as a major policy issue. As the Parliamentary report reads, ‘Although in principle, the metaverse is open to all, in practice many might have trouble accessing it’ (G34). For other groups, such as the XR Access Network (a disability focused network of industry practitioners and academics), their goal is to ‘modernize, innovate, and expand XR technologies, products, content and assistive technologies by promoting inclusive design in a diverse community that connects stakeholders, catalyses shared and sustained action, and provides valuable, informative resources’ (CSG78).

XR governance initiatives emphasise safety, equity and inclusion. User safety in XR is a significant concern, and resonates with debates about platform accountability for user content and conduct. While legal jurisdictions around the world increasingly favour approaches establishing technological platforms having a ‘duty of care’ in moderating user content and conduct, there was little regulatory focus on harmful user conduct and content (and much industry and CSG work focused on education and best practices to encourage pro-social behaviour). While policymakers recognise disability as a major area for potential inequity, governance through standards and best practices have been largely advanced by industry and CSGs.

The governance of market competition was another area of focus (n = 50). Competition has been the purview of recent regulator engagement with the XR sector. It has been of particular importance considering the outsized influence of big tech firms on XR (namely Meta, following its acquisition of Oculus in 2014, and its rapid consolidation of power in the XR industry over the last half-decade). For example, in July 2022, the US Federal Trade Commission (FTC) sought to block Meta’s US$400 million acquisition of VR fitness software developer Within (the largest in the company’s history of acquisitions). As the FTC’s Bureau of Competition Deputy Director, John Newman, puts it: ‘Meta chose to buy market position instead of earning it on merits. This is an illegal acquisition, and we will pursue all appropriate relief’ (G17). In 2023, Meta won a federal court case approving the acquisition (with the FTC subsequently withdrawing from adjudication).

In the European context, Germany’s national competition regulator – the Bundeskartellamt – has taken aim at Meta and Oculus. Distinct from the FTC, the Bundeskartellamt placed emphasis on Oculus providing Meta a data advantage (rather than a strict focus on a competitive advantage), suggesting that the company breached German data coupling laws in requiring an Oculus account to be connected with a Facebook account (G33), feeding into Meta’s already-significant glut of first-party data accumulated through their social media ‘Family of Apps’. This move follows almost immediately from antitrust charges being filed against Meta by the FTC, and from a 2019 investigation by the Bundeskartellamt into Meta’s internal data sharing practices (Bundeskartellamt, 2019). As the Bundeskartellamt note in a 2022 document, while Meta has suggested ‘there will be no flow of data between the virtual reality services and other services without users’ consent’, it still ‘remains to be clarified to which extent data processing across services can be permissible with . . . or without the users’ consent’ (G6).

The notion that the metaverse will be interoperable – that is, the capacity to make one product or service work with another existing product or service – while technically implausible (Egliston and Carter, 2023) is a nonetheless widely held view by many of its proponents. For some policymakers, this imagined affordance is one that presents considerable challenges in applying competition law. As it is put in a European Parliament inquiry into the metaverse’s policy implications:

The fact that the metaverse environment requires competitors to communicate, collaborate and ensure that platforms are interoperable could also potentially lead to a series of anti-trust challenges, for instance concerning the sharing of sensitive information, such as pricing, or agreements between competitors subject to competition law scrutiny. (G34)

Where governments were interested in ensuring fair competition, many CSGs saw competition as a means to create economic opportunity for market participants (often, focusing on marginalised developer cohorts – such as ethnic or racial minorities within global production hubs, or small companies in regions outside the global north, see, for example, CSG39, CSG57). Much of this emphasis was attributable to Meta’s XRPRF (I10) which framed ‘economic opportunity’ as a major area of focus. For such groups, there is a sentiment that the benefits of competition and innovation should be widely distributed among market participants (and that a failure to do so can have negative implications for economic equity).

In sum, XR emerges as a high-profile site for broader regulatory efforts to prevent big tech incumbents from further entrenching dominant market positions (as well as growing their economic and data advantages through consolidating complementors or competitors). Yet elsewhere, as some CSGs show, competition in the XR market is not just an object of regulation but something that can deliver a wider social and cultural benefit (for instance, through emphasis on diverse market competition from individuals and organisations outside the global north).

Governance initiatives have sought to harness the economic benefits of the metaverse for industry and regional software sectors through approaches to XR commercialisation (n = 69). For example, the 2021 US Innovation and Competition Act – a Biden Administration bill which would later become law in 2022 as the CHIPS and Science Act, allocating roughly US$280 billion in funding to boost US semiconductor and technology manufacturing – identifies ‘Immersive Technology’ as 1 of its 10 key technology focus areas (G30). European policy has more stridently advanced an agenda for commercialising XR research and development – in line with a wider EC agenda for commercialising technological ‘innovation’ (G9–G15, G35–G36). A major focus in the EU has been on addressing the industrial and economic impacts of XR through policy initiatives enhancing regional software production. For example, VR and AR are a component of the EC’s Media and Audio-visual Action Plan (MAAP) – a funding initiative to ‘help maintain European cultural and technological autonomy’ (G35). Under the MAAP is the European Virtual and Augmented Reality Industrial Coalition – an initiative aiming to ‘inform policy making, encourage investment, facilitate dialogue with stakeholders and identify key challenges and opportunities for the European VR/AR sector’ (G36). Elsewhere, the Horizon Europe program – a 7-year research and innovation funding initiative – has placed emphasis on VR, soliciting proposals for a ‘VR Media Lab’, which will ‘develop and prototype advanced solutions for the creation, distribution and consumption of new immersive VR/AR media products, and bring together skills from a variety of disciplines, including the creative sector’ (G15). It is notable that for some government efforts to commercialise national or regional XR development, there was a tendency to buy into technological boosterism and highly speculative future visions. For instance, the EC’s MAAP (G35) justifies the need for focus on VR and AR as ‘by 2030, Virtual Reality (VR) and Augmented Reality (AR) have the potential to add about 1.3 trillion euros to the global economy’.

Industry groups, such as standards groups, have likewise sought to realise the economic and industrial benefits of the metaverse. For example, the Metaverse Standards Forum is a group of largely industry stakeholders that ‘aims to encourage and enable the timely development of open interoperability standards essential to an open and inclusive metaverse’ (CSG36. See also CSG80). Notably, the forum will not actually create these standards, but rather will facilitate dialogue among industry stakeholders to do so. Standards are viewed as a critical technical element of industrial growth to prevent XR from being siloed in proprietary formats, part of a need for ‘wider industry standardization, coordination and cooperation’ (CSG36). The aim for the standards forum as a governing body is not just to encourage ‘good’ practices, but also to encourage the construction of ‘good’ (interoperable) infrastructure.

Taken together, the commercialisation data present a point of contrast to the previous governance issues we have identified. Rather than focusing on how governance can prevent harm, governance structures are also needed to support and strengthen national and regional technology industries to harness commercial benefits of an emerging class of technology. While there were a number of concrete commercialisation initiatives, commercialisation efforts were primarily based on popular industry claims about the economically transformative potential of XR and the metaverse.