Privacy in Virtual Worlds

Almost all major websites have a “Privacy Policy”. What’s the analogous thing for places in virtual worlds?

There’s usually a link to a website’s privacy policy near the bottom of the page. For example, the Yahoo! Privacy Policy (at least for the USA) is at http://info.yahoo.com/privacy/us/yahoo/details.html

Privacy policies typically tell you what personal information the site gathers and what they do with it. For example, do they sell your name and telephone number to third parties? Do they set or access cookies on your computer? Do they display targeted advertising based on your personal information? Can you edit or remove your personal information in their database?

What about virtual worlds? Let’s consider Second Life. Linden Lab has a privacy policy posted at http://secondlife.com/corporate/privacy.php - It’s mainly concerned with the personal information Linden Lab gathers and what they do with it. Second Life also has Community Standards, which include a section on Disclosure:

“Residents are entitled to a reasonable level of privacy with regard to their Second Lives. Sharing personal information about a fellow Resident –including gender, religion, age, marital status, race, sexual preference, and real-world location beyond what is provided by the Resident in the First Life page of their Resident profile is a violation of that Resident’s privacy. Remotely monitoring conversations, posting conversation logs, or sharing conversation logs without consent are all prohibited in Second Life and on the Second Life Forums.”

The Community Standards also includes a section on Policing (of the standards). In particular:

“Residents should report violations of the Community Standards using the Abuse Reporter tool located under the Help menu in the in-world tool bar. Every Abuse Report is individually investigated, and the identity of the reporter is kept strictly confidential. If you need immediate assistance, in-world Liaisons may be available to help. Look for Residents with the last name Linden.”

and also:

“Generally, violations of the Community Standards will first result in a Warning, followed by Suspension and eventual Banishment from Second Life. In-World Representatives, called Liaisons, may occasionally address disciplinary problems with a temporary removal from Second Life.”

(Note: The purpose of this post isn’t to judge Linden Lab on how well they live up to these policies and standards.)

Should places in Second Life have their own privacy policy, or are the Community Standards enough?

For example, if a venue has sensors that record avatar locations as they move around, should the venue owner disclose that monitoring? Should they tell visitors what they do with that data? Should avatars be able to opt out of monitoring? The SL Community Standards are silent on this issue.

As another example, SL stores can keep detailed records of everything you’ve ever bought from them. They can use that information to target advertising and they can sell that information to other stores. Should they disclose that they are doing so? Again the SL Community Standards are silent.

You can get the IP address of another avatar in Second Life, although it’s not as easy as the recent CSI:NY episode made it look. One way is to force a movie to play on the parcel where they are standing - then you just check the IP address receiving the movie stream. Once again, the SL Community Standards say nothing about this.

Clearly the Community Standards don’t cover everything. Should sim/store/venue owners be posting a privacy policy detailing what information they collect and how they use it? What measures can you take to protect your privacy in Second Life (and other virtual worlds)?

If privacy issues in virtual worlds interest you, then you are welcome to attend a workshop being put on next week, organised by three of the UK’s Knowledge Transfer Networks (KTN) and supported by the European Commission. It’s part of “A Fine Balance 2007 - Privacy enhancing technologies: How to create a trusted information society”. The workshop will begin with a keynote by Paul Ledak of IBM and then the floor will be opened up for discussion. It will be a mixed-reality event, with participants in Second Life and participants at the RL venue in the UK. Here are the details:

Date: Wednesday, November 21
Time: 2pm UK time, 6am SL time (Pacific), 9am Eastern time
Location: Auditorium on the sim ‘UK Future Focus’, SLURL: http://slurl.com/secondlife/UK%20Future%20Focus/199/142/49

Linden Lab may choose to shut down the Second Life grid for maintenance on November 21, in which case the SL part of this event will be canceled.

Photo credit: ‘privacy’ by grigiomedio on Flickr (Creative Commons Attribution 2.0 License)