The Ghosts in the Code: Who Writes the Rules of the Unreal?

Extended reality is knocking at the door. Yet private companies have a disproportionate say in shaping technical standards, privacy rules, and platform governance in ways that prioritize their business interests and treat people as customers more than citizens. Can we rebuild the wild internet or will we create walled gardens?

By

Joseph Foti

In Susannah Clarke’s Piranesi, the titular character is trapped in a labyrinth, quite certain that he is one of only two humans that have ever existed. He roams the halls, documenting their wonders, and cultivating data — tides, distances, and stars — as assigned to him by his master. One day, he comes across a message left by some other person that leaves him with a question: can he muster the courage to confront the reality that there is another world, another way, with more freedom?

In the same way, we are confronted with an internet that is becoming more fragmented — not only by China’s Great Firewall and the increasing walls between jurisdictions, but also by corporations that enclose some part of the internet inside of an app and run that portion as a fiefdom.

Like Piranesi’s labyrinth, such walled gardens have a genuine allure. But, in the end, they limit the imagination, the agency, and the creative potential of their protagonists — we, the digital citizens.

On Extended Reality

One way to think about this issue is through extended reality (XR), which is a group of new technologies that will blend reality with the virtual. No longer the domain of science fiction, XR includes virtual reality (VR) and augmented reality (AR). Tech giants like Meta, Apple, and Microsoft view XR as a cornerstone of the next digital revolution. Meta (formerly Facebook) has gone so far as to rename itself after the world of the virtual — the Metaverse. (While Meta is heavily investing in the Metaverse, it owns neither the word “Metaverse” nor the virtual world.)

XR raises profound governance challenges that could reshape everything from intellectual property and money to who has the right to exercise power. A recent report from the UCLA Information Policy Lab examines these governance issues, highlighting the tremendous potential of XR. It also raises a host of privacy and governance challenges that governments around the world have been slow to grapple with. (As this post pulls heavily from that report, the authors of each section are linked in each section.)

The risks are clear: if left unchecked, XR could fortify corporate walled gardens, expand digital surveillance, and undermine democratic engagement. The UCLA report suggests ways to counteract these risks. Are governments prepared to act?

From Open Internet to Enclosure of the Commons?

Users of music streaming services like Spotify or Apple Music will be familiar with a particular problem. They want to move to another streaming service, but they will lose all of their years of playlists, “favorited” songs, and discoveries if they do so. Facebook users, too, know that they can bring along their contacts and friends to Instagram, but they must start over if they wish to move to non-Meta platforms. This phenomenon is called “lock-in.”

Lock-in, in extended reality, can be even worse. What if you work all day to create something beautiful — art, relationships, music — but, because you created it on a particular platform, you may not be able to claim ownership. This means you may not be able to bring it with you or control its sale or distribution, even though you made it. This isn’t a concern in the real world, where for the most part we own our labor and can choose where to sell it. If I rent a studio space to paint, the studio owner does not get to decide what gallery I show my work in. The paintbrush manufacturer does not get to set the price I charge for my painting, and the easel manufacturer cannot charge a percentage cut in perpetuity for my creation. Will that be true in the virtual world?

As it stands, that is entirely up to the private companies that are building the metaverse. They may create walled gardens where your work belongs to them. Indeed, this is already the case in many corners of the internet, from app stores and streaming services to social networks and media companies.

But it doesn’t have to be this way. The early internet was built on openness — interoperable systems, open standards, and public research funding helped ensure that no single entity controlled the entire ecosystem. XR, however, is being developed differently. Private companies are shaping technical standards, privacy rules, and platform governance in ways that prioritize their business interests. They choose when interoperability is useful, not the public.

Open government can help ensure that XR is not captured by private interests. As a starting point, governments can advance reform related to governance rules, public participation in virtual spaces, and surveillance and privacy protections.

Governance Rules for the Metaverse

Right now, XR governance is mostly set by industry-led bodies, such as the Metaverse Standards Forum, which includes Meta, Microsoft, and Google. While these groups develop interoperability frameworks, they risk cementing corporate dominance rather than fostering open, participatory rule-setting.

If democratic governments continue to delegate rulemaking responsibility to major companies, this could, through no particular ill intent, lock out smaller companies and reduce the amount of “public commons” available. If the Metaverse replaces the internet, as Mark Zuckerberg has postulated, who will have access? Will there be rules of affordability? Will it be safe? Will we have rights to assemble, protest, hide secrets, or hold and sell private property? On the other hand, will regulations be so onerous that only pre-existing behemoths can throw their weight around?

The lessons from hardware and from social media should be clear: if we leave platform governance in corporate hands, we can end up with monopolistic practices. These monopolistic practices, in turn, can become authoritarian practices when combined with surveillance, the silencing of critics, and lock-in. In the physical world, many of these practices would be intolerable or outright illegal.

What can governments do about it? A lot.

Governments have a long and successful history of shepherding such major developments. This ranges from encouraging protocols to supporting public governance structures and providing open source alternatives, as the list below illustrates.

• Ensure public participation in XR governance: Governments should engage in standard-setting bodies to ensure technical interoperability, public access, and non-discriminatory digital environments.
• Enforce interoperability laws: The EU Digital Markets Act (DMA) rules require major tech platforms to allow third-party interoperability. These standards should be applied to include XR.
• Fund open-source alternatives: Just as governments invest in open AI and cybersecurity, they should support public XR infrastructure to prevent monopolization. This could be maintained as public trust corporations with citizens and public ombudsman offices guiding their mission.
• Non-discrimination: If governments (or companies or non-profits acting in the place of the government) plan to deliver services in XR, they must ensure equity, accessibility, and transparency.

[See Megan Bradley and Maria Fernanda Muñoz here for their summary. For full policy recommendations, see Megan Bradley, Maria Fernanda Muñoz, Elizabeth Mzungu, Chen Yan here.]

Public Participation in Virtual Spaces

“This new technology will enhance democracy by enabling immersive citizen engagement and exchange of ideas.”

“People will engage their elected officials in virtual town halls, deliberative assemblies, and participatory budgeting.”

“Face-to-face interactions with strangers from different walks of life will help people get along better.”

These are the — paraphrased — lofty promises made by social media moguls in the mid-2000s. Yet these partially fulfilled promises have also come along with rampant misinformation and disinformation, surveillance, bias, and polarization.

There remain numerous open governance questions that will continue to evolve as more and more work moves into these spaces.

• Physical access: Access to XR–just like physical meetings space–remains highly inequitable — it requires expensive hardware, stable internet, and digital literacy. Governments need to be intentional about accessibility and inclusion when services go “metaverse” only.
• Decisional accountability: Platform governance remains opaque, limiting citizens’ ability to shape virtual spaces or challenge platform decisions. De-regulated does not mean free. It can, in practice, translate into an archipelago of unaccountable private tyrannies. In the real world, we have created limits on private tyranny (such as child abuse prevention laws, labor laws, and anti-slavery laws). In the real world, we have also created alternatives to private property — parks, public lands, and free internet access — that create a refuge for those that cannot afford to buy their freedom.
• Official speech and participation: When governments become dependent on private platforms for communication, especially official communication, rules on participation and speech become blurry.
• Citizen speech: There needs to be limits on government requests for surveillance or bans on certain online assemblies. This is true not just domestically, but beyond borders, as there is some history of ignoring due process across borders. If a government has certain types of speech bans, is there an independent agency with the ability to review those requests?
• Civic XR public spaces: Just as governments in the physical world create parks, civic centers, universities, and public theaters, they will need to fund and protect non-commercial, citizen-led XR spaces where people can exchange ideas and organize free from surveillance.

[See Elizabeth Mzungu and Chen Yan here for their summary. For full policy recommendations, see Megan Bradley, Maria Fernanda Muñoz, Elizabeth Mzungu, Chen Yan here.]

Surveillance and Privacy in the Metaverse

XR devices collect extraordinarily intimate data — tracking eye movements, facial expressions, gestures, and even emotional responses. Traditional online surveillance records what you type and how long you stay on a page. By contrast, XR often analyzes how your body reacts to what you’re experiencing.

This level of biometric surveillance has serious implications. XR data can be hijacked for manipulative advertising, authoritarian control, or discrimination. The UCLA report warns that existing data protection frameworks — like the GDPR — are as yet ill-equipped to handle XR’s real-time, hyper-personalized data tracking.

• Expand privacy regulations: Governments must ensure XR data falls under strict data protection laws — including limitations on biometric tracking and requiring user consent.
• Enforce algorithmic transparency: XR platforms should be required to disclose how they track and manipulate user experiences. Citizens should be able to request information on privacy practices and appeal for violations of their rights.
• Protect bystander rights: XR devices capture data from entire environments, meaning bystanders may be unknowingly surveilled. New rules must prevent non-consensual data capture. Governments can ensure that protocols include end-to-end encryption, jammers, or blurring images. For too long, data has been harvested without clear and conscious consent, and the business model of many of the world’s largest companies has been built on stripping agency from people.

[See Gabriela Gura, Md Abdul Malek, Walter Musgrave, Mahmut Ormanci for full policy recommendations here.]

Conclusion

XR is not just another bundle of tech. It is a space of interaction, raising profound questions about democracy, privacy, and corporate control. If governments fail to act, XR could repeat the governance failures of social media, with even greater risks. XR needs clearly spelled out rights, including data protection, speech norms, and public access rules.

We began with the story of Piranesi. There is one more fold to how he was trapped in the labyrinth: he cannot remember his past. He cannot remember who he was, that there was a different world before, or that there is a different world available to him. This curse befalls anyone who is trapped in the labyrinth for too long.

People are born today who do not remember the Wild Internet. When it comes to the Metaverse, it’s not too late to create a place full of teeming ecosystems, free thought, and colorful characters. Or it could be a series of shopping malls. The choice is up to us.