Digital identity in virtual worlds

Traditionally, identity has been defined as “one’s personal characteristics, or the sense of who one is, as perceived by ourselves or by others.” Identity is what we identify ourselves with and what others identify us with. 

Digital identities have specific challenges compared to real life identities as they may extend beyond identifying ourselves. As such we may want to ensure that the identity of others is what they claim to be.  For example, in the real world, one can alter one’s appearance to some extent. In virtual worlds, users can use 3D avatars that are completely different to their physical aspect. Especially, artificial intelligence (AI) technologies can be used to modify someone’s look and voice. These are called “deep fakes” where users can virtually appear as avatars of well-known fiction and non-fiction characters. These “deep fake” identities can appear very convincing at impersonating others, leading to troublesome consequences if used with malicious intent.

Virtual avatars, highly customisable in appearance, speech, animations and behaviour, pose challenges when two users meet in the virtual world and exchange money and private data. This raises concerns about trust because it may become difficult to identify who the other person is in real life. This is why certification and verification of digital identities are essential in the online landscape. They add an element of trust, for example confirming someone’s real identity and connecting their digital identity wallet to their real identity for trust assurance. Not all certifications are equal in value or level of trust. There are digital identities with different levels of certification. For example, in the real world a passport serves a different purpose when compared to a university student card, library card or a driver’s license. While these cards identify an aspect of someone’s identity, not all of them serve as a legal verification and some are more susceptible to forgery than others.

The European Commission is currently building a trustworthy digital future by implementing reliable systems around virtual worlds. These are some of the initiatives carried out to protect the identity of the general public in virtual environments:

Preventing the misuse of digital identities

Some individuals exploit online anonymity by creating fake profiles with false information that cannot be traced back to their real-life identity. They remain anonymous by fabricating their own fake profile or stealing someone else´s identity. Thus, digital anonymity may lead sometimes to disinformation and cybercrime issues. The EU recently adopted Digital Services Act (DSA) Regulation ((EU) 2022/2065), to combat problems that arise through multiple, bot and fake trolling accounts in social media by introducing obligations for platforms to put in place stronger protections for people targeted by online harassment and bullying. Mechanisms and procedures developed in this context may be adapted for virtual worlds.

While efforts are being made to make digital identities more secure and protect users online, complete identification and verification of other users’ avatars in all virtual worlds may not always be possible for you. That is why it is important for you to be careful and remain vigilant when navigating through virtual worlds and interacting with other avatars.

The European Digital Identity Wallet

Authentication to virtual worlds may become a use case for the European Digital Identity Wallet.  The new European Digital Identity Framework Regulation (EU) N°2024/1183 will oblige Member States to issue Wallets that enable citizens to securely authenticate for accessing public and private online services. Virtual worlds can make use of these features to provide the necessary protection of user profiles. It could also anchor a user’s avatars in several virtual worlds in a common digital identity.

The Wallet will also enable people to add further “attestations” (like one’s diplomas, driving licence or banking account information) and share them with third parties to “prove” statements about themselves. The standards for the European Digital Identity Wallet will allow better user control, for instance the user controls the data stored within the Wallet and personal data can be shared only as much as needed for a particular use. These functionalities could be employed to manage avatar traits or even digital assets. The European Digital Identity Wallet would in this way help keep data in control of the user and avoid handing them to a central system.

Identity management is complex, bringing in further questions regarding “true representation” (e.g. as regards professional qualifications or gender). While exploring different identities and roles may be part of the attractiveness of virtual worlds, there may be occasions in which users of virtual worlds find out that other users are “really” not what they appeared to be. Overuse of digital identification may also lead to cut back anonymity. Should then anonymity itself be protected? The possibility of “pseudonymous authentication” is already a guaranteed feature in the EU Digital Identity Wallet, wherever user identification is not necessary. An avatar can be controlled by more than one people. For example, avatars owned by legal entities like companies or associations can be used by different people over the course of a day. Can this be treated as a case of “organisational” digital identity (as currently tested in the Large Scale Pilots for EU Digital Identity)? Can an avatar be left in the custody of somebody else than its creator or “owner”?

It appears as if we are only at the beginning to understand the technical and legal challenges of identity in virtual worlds.