A Safe Metaverse Cannot Be Built on “Good Users” Alone

The metaverse has long been described as the future of technology.

In virtual environments, people work through avatars, meet friends, enjoy performances, shop, and conduct economic activities. The prospect that social, cultural, and economic experiences once confined to physical spaces could move into digital worlds elevated the metaverse beyond games and online communities into a major industrial frontier.

But as technology becomes more closely aligned with reality, its risks begin to resemble reality as well.

Abusive language, defamation, sexual harassment, stalking, privacy violations, and financial harm are already occurring inside metaverse platforms. As technologies such as extended reality, motion tracking, and haptic interfaces expand beyond sight and sound to include movement and touch, actions in virtual space may create more direct and serious harms for real users.

In his paper, Ethics and Administrative Regulations for the Safe Metaverse Society, Kang Sungyong does not approach this issue simply by arguing that offenders should be punished after harm occurs. Instead, the study focuses on prevention. It asks how metaverse-related harms can be anticipated, reduced, and structurally prevented before they escalate.

Kang divides the actors responsible for metaverse safety into three categories.

The first is the individual who directly operates an avatar. The second is the individual or legal entity that employs, supervises, or controls that avatar operator in a work-related setting. The third is the metaverse platform provider that designs and operates the space, rules, and technical environment in which users interact.

The study’s central argument is clear: a safe metaverse cannot depend solely on well-behaved users. It requires organizations that shape user conduct, platform structures that enable or deter risky behavior, and laws and regulations that govern both.

An Avatar May Appear to Act, but It Is Not the Responsible Actor

In the metaverse, harm often appears through the conduct of an avatar.

An avatar may follow another avatar persistently, simulate sexual behavior, direct abusive language at another user, attempt to steal virtual assets, or engage in fraudulent transactions. Yet the paper argues that the avatar itself cannot be treated as a moral or legal subject of responsibility.

An avatar does not independently reason, make ethical judgments, or understand the consequences of its behavior. It does not possess its own intention or free will. Its actions are the actions of the real person controlling it.

For that reason, the first party responsible for harm in the metaverse is the avatar operator.

Users have a duty to understand that the actions their avatars perform in a virtual environment may produce consequences for real people. In immersive environments, even behavior that begins as a virtual gesture may cause discomfort, fear, psychological pressure, or, in more advanced technological settings, physical harm.

The paper expands this issue beyond basic manners or online etiquette. It frames it as a “duty to learn.”

If users do not understand the technical features and potential risks of the platforms they use, they may fail to recognize the connection between a virtual act and real-world harm. Metaverse ethics, therefore, cannot end with the instruction not to hurt others. Users must also learn what technological environment they are entering and how avatar-based conduct can affect real people outside the screen.

Metaverse Harm Cannot Be Explained as Individual Misconduct Alone

The paper does not interpret metaverse harm only as the conduct of individual users.

It raises a broader question: when a person uses an avatar as part of corporate or organizational work, can the employer or organization remain free from responsibility?

Consider a company using a metaverse platform for customer service, training, marketing, sales, exhibitions, or virtual events. Employees may use avatars to engage with customers, visitors, or other users. If an employee harms another person in that virtual environment, should responsibility rest only with the individual employee?

Kang argues that employers and corporations that supervise avatar operators can also become ethical subjects of responsibility.

A corporation is not merely a legal entity on paper. It shapes employee behavior through organizational culture, education, performance incentives, work targets, internal controls, monitoring systems, and reporting procedures.

A company that imposes excessive sales targets, encourages aggressive conduct, or fails to establish and teach standards for behavior in virtual spaces may create conditions that encourage harmful actions. Conversely, a company can reduce risk by implementing ethical guidelines, preventive training, internal monitoring systems, reporting channels, and clear sanctions for misconduct.

The paper connects this argument to the logic of internal controls already used in industries such as finance, medicine, accounting, and insurance. In areas where the likelihood and impact of harm are high, society has not relied solely on individual goodwill. It has imposed legal duties on organizations to supervise their personnel and manage risk.

As the metaverse becomes a space for corporate activity, organizational responsibility must be discussed in the same way it is discussed in physical workplaces.

Platforms Are Not Mere Intermediaries. They Design the Environment of Risk.

The paper’s most important concern lies in the role of platform providers.

A metaverse company is not simply a business that offers a place for users to log in. It determines who can join, what kinds of actions are possible, which expressions are permitted, how reports are handled, and how repeat offenders are blocked.

Even when platforms do not directly control individual users, they design and govern the environment in which user behavior takes place.

Kang describes platform providers as actors that control the environment in which harm can occur.

Platform operators are often in the best position to understand their own service structure and technical characteristics. They can observe how users interact, which features may be exploited for harassment, stalking, fraud, or privacy violations, and what kinds of data may help identify high-risk behavior.

For this reason, the study argues that platforms should not limit their role to suspending accounts after an incident occurs. They should also identify and reduce structural conditions that make harm more likely.

The paper outlines a range of potential obligations for platform providers.

At the most basic level, platforms should clearly inform users about how the service works, what types of behavior are prohibited, what sanctions may follow violations, and how users can report dangerous situations.

As risk increases, so should platform responsibilities. Providers may need to establish reporting and monitoring systems, detect repeated or high-risk conduct early, and intervene quickly to prevent further harm. In environments where severe harm is foreseeable, platform design itself may need to change so that certain harmful actions become technically difficult or impossible.

“Personal Space” Can Become a Principle of Safety-by-Design

The paper discusses the example of QuiVr, a virtual reality game.

In the game, a user reportedly caused sexual discomfort by extending a virtual hand toward another user’s avatar in a way that simulated inappropriate physical contact. In response, the developer expanded a “personal space” feature so that other users’ virtual hands would disappear when they moved too close to a player’s body.

The significance of this response was that it did not depend solely on punishing the offender after the fact. It changed the design of the interaction itself.

Identifying and sanctioning offenders remains necessary. But changing interfaces and interaction rules so that certain harms are less likely to occur in the first place may offer a more fundamental solution.

This approach reflects the principle now often described as safety by design. Rather than waiting for a service to grow and then responding to harm, risks are anticipated during the planning and development stages, and safeguards are built into the platform from the beginning.

Yet the paper also warns that technical restrictions are not always the answer.

The value of the metaverse lies partly in realism, free interaction, and creative activity. If every potentially harmful action is blocked through rigid restrictions on avatar movement and interaction, the very experience the metaverse is intended to provide may be weakened.

Regulation, therefore, should be proportionate to both the severity and likelihood of harm. Lower-risk environments may require information disclosure and user education. Medium-risk environments may require reporting, monitoring, and sanction systems. High-risk environments may require technical restrictions and stronger legal obligations.

Not Every Ethical Duty Should Become a Legal Duty

Although the paper argues for stronger safety measures, it also warns against treating regulation as a universal solution.

Turning every ethical duty into a legal obligation may strengthen safety. But excessive regulation can inhibit technological development, industrial innovation, free expression, and spontaneous interaction among users.

The metaverse remains a rapidly evolving technological and industrial space. Overly detailed or rigid rules may prevent new forms of services, experimentation, and creative engagement from emerging.

For this reason, Kang argues that only core ethical duties should become enforceable legal obligations through administrative regulation.

Where potential harm is limited and unlikely, self-regulation by platform providers and market choice may play a meaningful role. Users may leave unsafe platforms and prefer services with stronger safety features, giving the market some capacity to discipline providers.

But cases involving child sexual exploitation, serious privacy violations, or the possibility of physical harm require a different approach. In those areas, voluntary action and market choice may not be enough. Once harm occurs, the damage may be severe and difficult—or impossible—to reverse.

The central policy question, then, is not simply how much to regulate. It is what level of obligation should be imposed for which level of risk.

Metaverse Regulation Stops at National Borders

Another challenge is the metaverse’s cross-border nature.

A user may be harmed in one country while the platform operator is headquartered abroad. The servers may be located elsewhere, the alleged offender may be in a third country, and the platform’s policies may be set by a global headquarters.

If one country imposes strong safety obligations only on domestic platforms, a paradox can emerge. Local companies may bear regulatory costs that overseas competitors do not. Users may then migrate to foreign platforms, weakening domestic competitiveness while expanding the influence of less regulated services.

The paper describes this as a “tilted playing field.”

It presents two possible responses.

One is extraterritorial regulation: applying domestic safety standards to foreign platforms under certain conditions. The other is the development of international norms and agreements that encourage multiple countries to adopt common safety standards.

However, extraterritorial regulation is difficult in practice. Foreign platforms may limit access to a market rather than comply with local requirements. Legal conflicts between jurisdictions may also arise.

Over the long term, the paper suggests that international cooperation will be necessary around shared values such as child protection, prevention of sexual exploitation, privacy protection, and digital safety.

Who Is Responsible in a DAO-Based Metaverse?

The study also points to a new regulatory blind spot: decentralized autonomous organization, or DAO-based, metaverse platforms.

Traditional platforms usually have a clear operating company and identifiable leadership. When a problem occurs, regulators can impose obligations on the company, and users can demand reports, protection, and corrective action.

In a DAO-based metaverse, however, governance and authority to change platform code may be distributed among token holders and participants rather than concentrated in a single company or executive team.

This raises difficult questions.

Who counts as the platform operator?
Who must comply with safety obligations?
Who can be held accountable for regulatory violations?

The people able to change platform rules may number in the thousands, live in different countries, and change constantly over time. It is not realistic for a government to impose the same administrative obligations on every participant.

The paper considers whether DAO-based metaverse platforms could be given legal personality and treated as regulated entities. But such a framework may work only when a DAO seeks legal recognition. A decentralized platform that does not seek corporate status may remain difficult to regulate.

As a result, preventive regulation may be limited in metaverse environments where no identifiable operator exists. In those situations, authorities may have to rely more heavily on ex post criminal enforcement against the individual avatar operator who directly caused harm.

Metaverse Safety Is a Governance Question, Not Merely a Technical One

Kang’s paper does not treat metaverse safety as a narrow matter of content moderation or banned-word filters.

Instead, it begins with a set of governance questions:

Who acts?
Who controls the actor?
Who designed the risky environment?
Who could have predicted the harm?
Who had the capacity to prevent it?

These questions form the foundation of metaverse governance.

Users must act so that their avatars do not harm others. Companies and organizations must educate and supervise their employees so they do not engage in harmful conduct in virtual spaces. Platform providers must analyze risky service structures and reduce harm through reporting systems, monitoring, sanctions, and safety-oriented design.

Government, meanwhile, should not attempt to replace every ethical responsibility with law. It must instead design obligations that match the severity and likelihood of risk.

If the metaverse expands reality, responsibility within it cannot be lighter than responsibility in reality.

Technology that expands freedom in virtual space can be sustainable only when it also protects real people. A safe metaverse will not be defined by the platform with the most features. It will be defined by the platform capable of balancing freedom and protection, innovation and responsibility.