Based on research findings regarding privacy deficits in the metaverse and our testing of privacy-friendly design elements, we have developed evaluation criteria and specific recommendations to support developers in designing privacy-friendly virtual environments. These metrics are primarily intended for the design of B2C environments in virtual worlds, such as gaming environments or virtual online shops. Some aspects of the metrics can also be applied to B2B applications, such as in the industrial metaverse, particularly with regard to data protection issues. Other aspects, such as measures to prevent harassment and assault, may be less relevant in practical terms in B2B contexts.

pURPOSE AND HANDLING

These metrics are designed to assist you in systematically incorporating privacy and personal rights considerations throughout the development of applications in the metaverse. They provide a structured framework for identifying typical risks at an early stage and making privacy-friendly design decisions. The metrics can be viewed via the drop-down menus for the topic areas „Data Protection“ and „Personal Rights“. For each thematic area, you will find key questions that will assist you in critically evaluating your application – for example, with regard to data collection, consent or protection against abusive behaviour.

When you click on a key question, you will find various points to consider regarding that question on the next level. Legally binding statements are shown in red, whilst recommended points are shown in green. On the next level, legal explanations are provided for each point, and in some cases implementation recommendations or design proposals are presented.

You can use the metrics flexibly:

  • for an initial assessment during the development phase
  • to review specific functions during development
  • or to evaluate existing applications

You can also work through the individual points step by step, or search directly for implementation guidance on specific issues.

 

Topics

Data Protection

New data protection risks arise in virtual worlds as a particularly large amount of very precise data is collected and linked together – for example, on movements, behaviour or interactions. Such data can reveal a lot about a person. In addition, there is often data processing that is difficult to understand, complex consent procedures and extensive disclosure to third parties. The metrics show ways in which data can be collected and passed on as minimized as possible and in which users can be informed in an understandable way and make their own decisions.

Personality Rights

In the area of personality rights, new risks are emerging in virtual worlds in the form of harassment, manipulation or social pressuring. Furthermore, the boundaries between public and private spaces are becoming blurred, meaning that personal statements or behavior can be more easily observed, assessed and ultimately exploited. Added to this is the use of social bots, through which users can be specifically influenced, misled or manipulated in the formation of their opinions. This is where the metrics come into play, by defining criteria for respectful interactions, effective protection mechanisms (e.g., blocking and opt-out functions) and transparent and fair design practices.

Data Protection

Pursuant to Article 6(1) of the GDPR, the processing of personal data is lawful only if there is a legal basis for it. The possible legal bases are listed in letter (a) to (f) of Article 6(1) of the GDPR: consent, contract, compliance with a legal obligation, vital interests, public interest and legitimate interests.

Personal data must not be processed in a manner that deviates from pre-determined, explicit and legitimate purposes (see Article 5(1)(b) of the GDPR – the principle of purpose limitation). Furthermore, processing must be limited to what is necessary for the purposes of the processing (see Article 5(1)(c) of the GDPR – data minimisation principle). To this end, the controller must implement appropriate technical and organisational measures in accordance with Article 25(2) of the GDPR. Technical and organisational measures (TOMs) include, in particular, physical and IT-related implementations, as well as (organisational) instructions and guidelines for the protection of personal data.
The recommendation outlines a specific approach to implementing ‘privacy by design’ in accordance with Article 25 of the GDPR. Pursuant to Article 25(2), sentence 1 of the GDPR, the controller must ensure that, by default, only personal data necessary for the specific purpose of the processing is processed. This is intended to ensure, on a risk-based basis, that the data protection principles set out in Article 5(1) of the GDPR are complied with, both during the planning and the execution of processing.
Platforms offer users setting options for physical and virtual sensors (e.g. microphone, camera, body movement, eye tracking). This allows users to independently determine which sensors are activated or deactivated for functionality and data collection, thereby enabling them to specifically control the data collection themselves.
The disclosure of data constitutes a processing operation, meaning that there must be a justification for this (see Item 1). A ‘third party’ under Article 4(10) of the GDPR is a natural or legal person, public authority, agency or other body, other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data. The transfer of data to authorised third parties means that they automatically become joint controllers and must coordinate their rights and obligations with the data exporter.

The recommendation aims to increase the level of protection when data is transferred outside of the EU.
Legally, there are three different options for permissible data transfers outside the EU:

    • the prior explicit consent of the data subject (Art. 49(1)(a) GDPR),
    • an adequacy decision by the European Commission regarding the level of data protection in the third country (Art. 45 GDPR)
    • appropriate safeguards have been provided by the controller (Art. 46 GDPR).

As the (country-specific) adequacy decisions and conditions for safeguards are often insufficient, it is recommended that data be transferred only on the basis of the data subject’s explicit consent.

If data is transferred outside the EU, explicit consent should be obtained for this purpose, e.g. via a separate pop-up window or a separate query by the system.
The recommendation aims to ensure the fair and predictable handling of personal data. The practice of data trading results in personal data circulating within an extensive ecosystem of data brokers and advertisers, without controllers or data subjects being able to trace who holds the data and for what purpose it is being used. Consequently, controllers are often no longer able to ensure integrity and confidentiality (Art. 5(1)(f) GDPR). Purpose limitation and data minimisation (see item 3, Article 5(1)(a) of the GDPR) are also difficult to reconcile with the mass resale of data for new purposes (advertising, profiling). Data controllers are therefore advised against selling personal data.
Companies that do not resell data could explicitly state this, for example in their privacy policy, in a cookie banner or via a data protection assistant.
Advertising tracking refers to the collection and analysis of user data for the purpose of displaying personalised advertising.
Under the GDPR, the data subject’s consent is generally required for this (Art. 6(1)(a) in conjunction with Art. 7 GDPR). This applies without exception where cookies are used for tracking (Section 25 TDDDG).
Basing advertising tracking on other legal grounds, such as the necessity of advertising tracking within the context of a contractual relationship or economic interests, has not yet been recognised by ECJ.
Context-based advertising is a form of online advertising in which adverts are tailored to the content of the page currently being viewed. Thus, advertising is displayed here without personal user data being analysed. Consequently, this form of advertising is very data-efficient and is therefore recommended. As there is no processing of personal data, the GDPR does not apply (Art. 2(1) GDPR).
Companies that use only context-based advertising could explicitly highlight this, for example in their privacy policy, in a cookie banner or via a privacy assistant. A short text or an icon could also be used for this purpose (e.g. a ‘no personalised ads, only context ads’ label).
Data controllers must delete personal data immediately at the request of the data subject if the data subject withdraws their consent legitimising the processing (Art. 17(1)(a) GDPR) or objects to the processing (Art. 17(1)(c) in conjunction with Art. 21(1) GDPR). Furthermore, the data subject may assert their right to erasure if the controller is obliged to erase the data for other reasons, e.g. because the purpose of the data processing has been achieved (Art. 17(1)(a) GDPR).
Article 32 of the GDPR requires controllers to ensure an appropriate level of security for personal data through technical and organisational measures. In accordance with the risk-based approach, the more sensitive the data, the higher the level of security must be. Suitable technical and organisational measures include, for example, data pseudonymisation, local processing, or ensuring the technical integrity of the system.

The recommendation aims to ensure low-risk data storage on the local device. From a legal perspective, the storage of data in the cloud is subject to a number of additional conditions. This is because, in the case of sensitive data such as health data, cloud computing cannot be justified on the grounds of a legitimate interest within the meaning of Article 6(1)(f) of the GDPR, as is otherwise customary for cloud computing. This generally requires consent in accordance with Article 9(1)(a) of the GDPR. However, numerous other reasons may also necessitate local processing (e.g. lack of control over processors, security risks, or the principles of data minimisation and privacy by design). The controller would have to justify why transmission to the cloud is specifically necessary.

Organisations that store sensitive data, such as biometric data, on local devices could explicitly state this, for example in their privacy policy, in a cookie banner or via a privacy assistant (e.g. ‘biometric data stored on device’).
The recommendation aims to increase the level of protection by storing data within the EU.
Companies that store data within the EU could explicitly state this, for example in their privacy policy, in a cookie banner or via a privacy assistant (e.g. “Stored in EU”).
The recommendation aims to ensure a high level of protection for consumers through privacy-friendly design and thus represents a concrete way of implementing ‘privacy by design’ in accordance with Article 25 of the GDPR. Pursuant to Article 25(2), sentence 1 of the GDPR, the controller shall ensure that, by default, only personal data necessary for the specific purpose of the processing is processed. This is intended to provide a risk-based guarantee, both during the planning and execution of processing, that the data protection principles set out in Article 5(1) of the GDPR are complied with.
From a legal perspective, users must be informed as to whether personal data is being collected and, if so, which data is being collected. The design proposal represents a possible, concrete option for the user-friendly presentation of data processing notices.
Users can activate real-time notifications that indicate which personal data is being processed by which physical and virtual sensors, depending on the situation in the virtual environment and user actions.

Under Article 20 of the GDPR and Article 5(1) of the Data Act, a data subject has the right to have their (personal) data transferred. This must be done in a structured, commonly used and machine-readable format (CSV, JSON, XML, PDF, XLSX, etc.). The aim is to grant data subjects control over their data and to ensure that the method of portability is transparent and verifiable. Additionally, this prevents so-called lock-in effects, which result in users remaining on a single platform. It remains legally unclear whether, in addition to the right to data export, there is also a right to data import.

In addition to data export, platforms should also enable the import of data from other platforms. Whilst it is not clear whether there is a legal right to this, interoperability is crucial for an open, consumer-friendly metaverse.
Controllers of online services must ensure that consent to the processing of personal data is not given solely by children and young people under the age of 16 themselves, as children and young people under the age of 16 are not legally capable of giving consent (see Section 25(1) sentence 2 of the German Telemedia Act (TDDDG) in conjunction with Article 8 of the GDPR). If data is processed on the basis of consent given by children or young people under the age of 16, the data processing is unlawful because there is no valid legal basis. Consent with effect for children and young people under the age of 16 can only be validly given by legal representatives, usually the parents.

Insofar as platforms must expect their services to be used by under-16s and insofar as consent is required for such use, proof of age should be introduced by means of ID and photo verification or other recognised mechanisms (in some cases via parts of bank details). Age verification should then be carried out by reliable, state-certified external verification service providers. The data should not be stored in the Metaverse account; only the age should be verified.

In accordance with Article 4 no. 11 of the GDPR, consent must be given in an informed manner. This is the case if, prior to giving consent, the data subject has been provided with all the information necessary to understand the implications of their consent. This includes, in part, the information set out in Articles 13 and 14 of the GDPR, but also specific requirements of the individual case, such as the duration of individual cookies or the specific data being collected. Consent must be understandable within the meaning of Article 7(2) of the GDPR, so that the average recipient (e.g. children) can understand it.

For users to make an informed decision, it is particularly important that they actually understand the information regarding the data collection covered by the consent. To ensure comprehensibility, it is advisable to conduct user tests on consent forms to assess their informativeness, clarity and comprehensibility, as well as to ensure that the consent texts are tailored to the target audience. Furthermore, consent should be obtained at the appropriate time and within the relevant usage context. In addition, a brief interactive element, such as a quiz as part of the consent process, can be used to verify whether users have actually read and understood the content.

According to Recital 42 sentence 5 of the GDPR, the data subject must have a genuine and free choice in order to give valid consent. The choice must not be linked to other services and must not result in any de facto disadvantages. Furthermore, manipulative practices (dark patterns) are prohibited, such as ‘information overload’ or leading designs (through colour, size, positioning of cookie banners).
For particularly sensitive personal data, Article 9 of the GDPR sets out stricter requirements regarding the authorization of data processing. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation. In such cases, processing can only be justified, amongst other things, if the data subject has given their explicit consent. When determining the specific requirements for explicit consent, it should be noted that implied actions are not sufficient for consent to be validly given. Consent must be clearly highlighted.

Consent to the collection of sensitive categories of data should not be integrated into general consent, but should be obtained separately and explicitly (e.g. via a separate window or a separate verbal query by a data protection assistant).

The aim of the recommendation is to ensure user-friendly consent procedures. The recommendation has a legal basis in Article 12(1) sentence 1 of the GDPR. According to this provision, the information must be easily accessible; in other words, the data subject must be able to retrieve the information using the means available to them or to access it without significant effort. This includes a certain degree of freedom from interruption.
The metaverse enables interactive consent processes, for example through the use of consent assistants that can explain content clearly and answer any questions users may have. The options presented for decisions (consent or no consent to data collection) should be designed to be as neutral as possible, without any influence from nudges, so that users can make informed decisions independently and autonomously. The decision regarding consent can be communicated in various ways, e.g. through a natural conversation or by performing a specific movement. Consent assistants can be designed to be context-sensitive, so that they blend seamlessly into the respective environment and do not stand out in a distracting manner (e.g. in the form of a dumbbell in a virtual sports context or in the form of a mobile phone in a virtual electronics shop).
Platforms can support the consent process through an advanced overall setup using so-called PIMS (Personal Information Management Systems). When users first access the platform, they are requested to configure their privacy settings in advance. This includes, amongst other things, specifying which data may be collected, how it may be processed, with which (including foreign) companies data may be shared, and for what purposes it may be disclosed. This initial, comprehensive configuration facilitates subsequent, context-specific decisions regarding individual consents and spares users the need to deal with a multitude of individual consents when interacting with different providers in the metaverse. Provided that the privacy settings chosen at the outset are compatible with the respective usage context, the user can use the platform without restriction for the relevant purpose. Otherwise, access or use is restricted, and options are displayed to adjust the privacy settings accordingly.

Protection of Personality Rights

Under the German Youth Protection Act (Jugendschutzgesetz – JuSchG) certain games and game-like content without an age rating may not be distributed to children and adolescents or may only be distributed to them with restrictions. This may indirectly result in an obligation to obtain and display a corresponding age rating if the platform offers games or comparable content that fall within the scope of the JuSchG. In practice, age ratings are regularly issued by the USK (Unterhaltungssoftware Selbstkontrolle) as a recognized self-regulation body. However, there is no explicit statutory obligation to undergo a USK review. Nevertheless, if an age rating is used, it must be clearly visible to users in order to comply with statutory youth protection requirements.

The platform should implement a reliable content moderation system that combines both AI-based procedures and human review to assess (user-)generated content for its suitability for different age groups and subsequently assign an age rating. Every piece of content on the platform should include a corresponding age label as well as additional information that transparently justifies the classification and explains why the content was rated accordingly.

Providers are required to put appropriate and proportionate measures in place to ensure a high level of protection of minors (Art. 28 DSA). However, the Regulation does not prescribe specific technical solutions. Age-dependent content filters or automaitc restrictions represent potential measures. The decisive factor is that the means deployed are suitable and proportionate, taking into account the specifics and risks of the content provided as well as the target audience.

To ensure that users can only perceive age-appropriate content, the age of the user should be provided in a reliable form within their user accounts. Similarly, for all available content it should be indicated which age group can access it. By default, only content with a USK 0 age rating should be accessible. Users should only be able to unlock further content by achieving a higher age level through a verification process.

A general obligation to conduct age verification does not exist for all services but only arises in certain contexts. In particular, it may be required if content is unsuitable or harmful to children and adolescents or if the service is specifically directed at them. Whether and to what extent an age verification is necessary therefore depends on the nature of the service, the target audience and the chosen legal basis for data processing.

For platforms offering USK 6, 12, 16, and 18 content, age verification should be carried out by means of ID and photo verification. The age should be verified by reliable, state-certified external verification service providers. For this process, personal information should not be comprehensively collected or stored. Instead, only the age should be verified.

Platform operators are required to set out clearly in their terms and conditions how they handle harassment, abuse and other unwanted behavior (Art. 14 DSA). This gives rise to a general obligation to inform users. A specific obligation to explicitly inform parents or legal guardians of minor users or to provide separate educational material is not expressly provided for by law. Nonetheless, such offerings can be useful even while going beyond the minimum statutory requirements.

Platforms should provide easily accessible and understandable educational materials that are, for instance, available on websites and contain clear and practical examples. These materials should be aimed specifically at parents and legal guardians and intended to provide a comprehensive understanding of which activities can take place on the platform, what potential risks children and adolescents may be exposed to, how guardians can recognize whether their children and adolescents are at risk and what measures can be taken to protect them effectively.

Very large online platforms shall identify, analyze and assess any systemic risks stemming from the design or operation of their service and its use and they shall take reasonable and proportionate mitigating measures to address these risks (Arts. 34 and 35 DSA). Union law does not explicitly prescribe any specific feature (such as a blocking function). The direct opportunity for affected individuals to protect themselves can constitute a reasonable and proportionate measure to mitigate risks of harassment and abuse of users. This is complemented by the possibility for users to notify problematic content (Art. 16 DSA). From a data protection perspective, it can be inferred that protective mechanisms should, at best, already be integrated into the design of the platform (data protection by design, Art. 25 GDPR).

Platform providers should continuously monitor (user-generated) content as well as the types of user interactions on the platform, for instance, through socio-demographic methods or the analysis of user interaction and do so in a data protection-compliant manner. On this basis, platforms shall be capable of keeping track of platform activity, identifying new forms of harassment, exploits and policy violations at an early stage and promptly providing appropriate measures to reduce risks.

The recommendation concerns the specific design of measures for risk mitigation (Arts. 34 and 35 DSA). Features for self-protection against acute harassment or intent to abuse represent an obvious and suitable measure to effectively implement the statutory requirements (Arts. 34 and 35 DSA).

Platforms should provide users with protective measures that enable them to reliably protect themselves from threats posed by other users at any time. By means of corresponding features, users must be capable of effectively stopping acute and harmful interactions (via text, voice, avatar movements or system exploits) by other users.

The recommendation concerns the specific design of measures for risk mitigation (Arts. 34 and 35 DSA). Features for systematic and preventive self-defense against harassment or intent to abuse represent an obvious and suitable measure to effectively implement these statutory requirements (Arts. 34 and 35 DSA).

Platforms should provide users with protective measures that enable them to protect themselves preventively against potential harassment, for instance, through the possibility of restricting interactions with unknown users.

An obligation to establish so-called ‚Safe Zones‘ is not explicitly provided for by law. However, the protection of users‘ personality and privacy rights may give rise to an obligation for platforms to take precautions against unwanted surveillance, approach or harassment. Particularly in the case of minors, there is an explicit obligation to implement effective protective measures (Art. 28 DSA). While not legally mandated as a specific technical solution, retreat or protected areas can be a suitable way to fulfill said requirements.

In addition to publicly accessible areas, platforms should also feature private rooms and spaces where users can remain undisturbed by others. Within these areas, the user should have full control over who is granted access and permitted to enter the space.

Providers of online platforms are obligated to outline in their terms and conditions, in a transparent manner, which content and conduct are permissible, what restrictions apply and how these rules are enforced (Art. 14(1) DSA). It follows that platforms must prescribe binding and comprehensible rules of conduct that align with the nature of the service and the intended interaction. This is therefore not a voluntary design feature but rather a legally prescribed minimum requirement.

Involving users in the development of rules of conduct and codes is recommended to increase the acceptance and comprehensibility of the rules. It goes beyond the existing statutory requirements and is to be understood as a voluntary measure. Platforms are obligated to establish and make rules of conduct transparent within their terms and conditions (Art. 14 DSA). However, this does not give rise to an obligation to involve users in the development of these rules. Similarly, the GDPR does not impose any general obligation for user participation in the design of such codes.

It must be ensured that the rules of conduct are appropriate for the intended interactions on the platform (distinguishing between e.g., “shooter games” and spaces dedicated to social interaction and trusted exchange). In designing rules of conduct and codes, the voices of users should be involved to regulate social behavior within the community. Users can either actively participate in drafting new rules or contribute through voting procedures on frameworks proposed by the platform. In this process, the weight of a user’s voice may be increased based on the duration and intensity of their platform usage. Furthermore, the rules of conduct and codes should be reviewed and updated at regular intervals, for example, quarterly, semi-annually or annually, to maintain relevance and accuracy and to account for the shifting interests of the user base.

Providers of online platforms must establish a notice and action mechanism for illegal content (Art. 16 DSA). This mechanism must be easy to access and user-friendly and must allow for the submission of notices by electronic means. Content moderation decisions must be accompanied by a statement of reasons (Art. 17 DSA). Furthermore, if the platform becomes aware of potential criminal offenses, specific reporting obligations apply (Art. 18 DSA). In addition, an internal complaint system must be established, enabling users to contest moderation decisions (Art. 20 DSA). A moderation function is therefore not a voluntary, additional feature but is legally mandated to effectively process violations of rules and applicable law.

The platform provider should provide a reporting system that enables the reporting of violations of the rules of conduct at any time. Such violations may concern (user-generated) content as well as user interactions (including text, speech, avatar movements and system usage). The incoming reports must subsequently be reviewed through human moderation or an efficient and effective AI-supported system.

Platform provider must define which conduct is impermissible and how rule violations are enforced (Art. 14 DSA). Furthermore, they are obligated to review illegal content and take appropriate moderation measures (Arts. 16 and 17 DSA). In particular, platforms must provide for measures to react to serious or repeated violations of their rules (Art. 23 DSA). This may specifically include the temporary or permanent suspension of usage. This is supplemented by the obligation to implement effective and proportionate measures for risk mitigation (Arts. 33 and 34 DSA). The law does not prescribe a specific technology or method but it does require that non-compliant or harmful behavior is actually and effectively prevented.

If a violation of the rules is determined within the scope of a report, the platform should remove the content in question. Depending on the severity of the violation, the user should receive a warning for minor offenses, a temporary ban for repeated and serious violations, or a permanent exclusion. If the violation constitutes a criimnal offense, the platform is obligated to report the incident to the local authorities, provide relevant evidence and support law enforcement to the extent required

There is an obligation to provide a statement of reasons for content moderation decisions to the affected person whose content or account is restricted (the perpetrator) (Art. 17 DSA). Art. 17 DSA does not provide for an obligation to also inform the injured parties of the reasons or the nature and scope of the measures taken. However, Art. 16(4) and (5) DSA contain the obligation to automatically acknowledge receipt of the notice to the notifying individual or entity without undue delay and to communicate the decision (not the specific measures) regarding the reported content as well as the available legal remedies against it.

Users who have submitted a report regarding a rule violation should receive detailed feedback within a specified maximum review period following the completion of the investigation by the platform. This feedback shall include the outcome of the review, the decision made and a statement of reasons for that decision. Furthermore, options will be presented to the users outlining how they can initiate further measures if applicable.

Measures to promote positive behavior can be a suitable means of supporting systemic risk assessment and mitigation obligations (Arts. 34 and 35 DSA) and are recommended accordingly.

.

To prevent potentially dangerous interactions on platforms and to reduce risks that may emanate from other users, the platform should provide suitable measures that make it easier for users to identify potentially risky actors. This can be achieved, for example, by providing aggregated metadata on user behavior such as in the form of a trust or reputation system, where a trust level is calculated based on factors including account age, activity, reported incidents or determined violations. In addition, an identity management system can be deployed in which verified and authenticated users are labeled and highlighted accordingly. In automated matchmaking, i.e., the assignment of users to servers, the classification can be based, for instance on a trust or reputation system or an identity management system.

Comprehensible guidelines on risks and protective measures are recommended to effectively protect the users. This recommendation is, at the same time, an effective measure for practically implementing statutory transparency and protection requirements. Platforms must provide information about their rules and their handling of (problematic) content in their terms and conditions in a transparent and comprehensible manner (Art. 14 DSA). A complementary obligation is also found in data protection law regarding personal data, according to which information must be provided to users in a concise, transparent, intelligible and easily accessible form, using clear and plain language (Art. 12 GDPR). An explicit obligation to generally inform users about all usage risks is not regulated in detail by law.

The platform should inform users in advance, particularly new users, for instance, by means of an interactive tutorial, on how to detect common violations and problematic content (such as how the reporting system functions or how blocking and the safety bubble work), what risks are associated with the use of the platform and how existing protective measures can be deployed to prevent or deter such violations.

There is no explicit obligation to offer psychological care directly or to provide external support. Insofar as platforms must take measures to mitigate risks such as harassment or abuse (Arts. 34 and 35 DSA), the provision of information and references to support can be a suitable measure to support affected users and at least mitigate the consequences of such risks.

Within the settings options or the support section, the platform should offer help and counseling to affected individuals alongside the reporting of violations, for example via telephone or text message. Furthermore, clear information should be provided on where and how affected individuals can obtain suitable support, such as through local or national reporting centers, support organizations and their corresponding hotlines.

AI systems that interact with users and are capable of conveying the impression of a human identity shall be identified as such by providers, unless it is obvious to the user that they are interacting with an AI system (Art. 50(1) AI Act). In addition, under German law, there is a labeling requirement for users who deploy social bots on social networks, regardless of whether AI systems are used (Sec. 18(3) MStV). The providers of such networks are not directly bound by this obligation, but must technically provide the possibility for labeling and implement such labels (Sec. 93(4) MStV). Finally, competition law may give rise to a labeling requirement for entrepreneurs who deploy social bots if, without such labeling, consumers would be induced to make a transactional decision due to the false assumption of a human identity (Secs. 3, 5, 5a UWG) – for instance, when supposedly personal and independent purchase recommendations or product reviews are given.

However, not every automated or script-controlled character is subject to a labeling requirement: purely fictional NPCs („non-player characters“), for instance in single-player game worlds, are generally not subject to any labeling obligation, provided that they are recognizably part of a game world and do not appear as real human communication.

If social bots are deployed on platforms, they should be clearly labeled so that it is readily apparent to users that these are computer-controlled avatars rather than human beings. The bots should be labeled prior to any interaction, ensuring that users are informed in advance that they are interacting with a bot. Furthermore, transparent information regarding data processing shall be provided, particularly concerning data collection, data storage and the data processors involved, as well as the AI systems used, including their functionality and deployment objectives.

To protect users, it is recommended to label social bots regardless of the use of AI systems. The labeling of social bots is mandatory only if they involve AI systems or when used on social networks.

AI systems that interact with humans must be identified aus such, if the use of AI sytems is not obvious to the user (Art. 50(1) AI Act). In addition, under state law, there is a labeling requirement for users who deploy social bots on social networks (Sec. 18(3) MStV). Platform operators are not directly bound by this obligation, but must technically provide the possibility for labeling (Sec. 93(4) MStV). This results in an obligation to enable labeling and to establish transparency regarding automated communication.

 

If social bots are deployed on platforms, they should be clearly labeled so that it is readily apparent to users that these are computer-controlled avatars rather than human beings. The bots should be labeled prior to any interaction, ensuring that users are informed in advance that they are interacting with a bot. Furthermore, transparent information regarding data processing shall be provided, particularly concerning data collection, data storage and the data processors involved, as well as the AI systems used, including their functionality and deployment objectives.

To protect users, establishing bot-free zones is highly sensible; however, there is no corresponding legal obligation to do so.

Where social bots are used on platforms, areas should be created to which bots do not have access. These should also be clearly labelled so that they can be recognised. This ensures that genuine user interactions are preserved and that users do not have to worry that these will be compromised by bots.