Metaverse law & XR: lawyer for platforms

Metaverse law at a glance

Definition: The law of virtual worlds concerns digital spaces in which people act and communicate with each other via applications, smart glasses or digital figures. It covers contracts, digital content, identity protection, data protection and platform obligations. The technical design and the business model determine the applicable rules.
Date of review: We recommend clarifying rights to content, terms of use and data processing before launch. A data protection impact assessment is required before processing if it is likely to result in a high risk (Art. 35 GDPR). It assesses risks and safeguards.
Legal basis: There is no single law for virtual worlds. Depending on the offering, the Bürgerliches Gesetzbuch (German Civil Code), the Urheberrechtsgesetz (German Copyright Act), the GDPR and Regulation (EU) 2022/2065 on digital services apply. Where artificial intelligence is involved, the AI Act is added.
Next step: We review your offering, the content used and the data collected. Send us the product description, target groups and information on payments and the devices used.
Costs: The first contact is free of charge. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

Practice area metaverse law

Setting up metaverse projects for companies on a sound legal footing

ITMR Rechtsanwälte advises companies on MR, AR, VR and XR projects regarding contracts, chains of title, XR data protection and platform regulation.

Anyone setting up virtual product worlds, immersive training, digital twins, avatar-based communities or XR-supported sales and service processes needs a robust legal structure rather than a slide about the future. What matters are clean contracts, clear chains of title, a viable data model and a realistic assessment of platform, AI and liability risks.

Projects become particularly demanding as soon as several building blocks come together: XR hardware, user accounts, 3D assets, AI functions, user-generated content, licence chains, data access and platform-like operation. This is precisely where it is decided whether a project remains scalable or runs into conflicts with data protection, IP, regulation or contract logic early on.

This page is aimed at companies, entrepreneurs, founders, start-ups, agencies, platform operators, investors, decision-makers, executives, specialists, rights holders and other professional market participants. General consumers are not the target of this page.

Typical reasons for a mandate: a virtual showroom before launch, an unclear chain of title for 3D assets and avatars, XR data protection with sensitive usage data, platform-like operation with UGC and moderation, AI functions in an immersive environment or international collaborations with agencies, studios and technology partners.

Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)

Discuss a metaverse mandate with ITMR To the go-live check

Quick start: what is your matter about?

Contracts

Roles and scopes of services

Clearly regulate development, integration, acceptance and support.

To the contracts

Chains of title

Avatars and 3D assets

Secure rights to assets, avatars and brands.

To the chains of title

XR data protection

Sensitive usage data

Properly classify motion, gaze and voice data.

To data protection

Regulation

DSA, AI Act, Data Act

Check platform and AI obligations early.

To regulation

Your contact: Jean Paul P. Bohne, LL.M., MM

Partner, certified specialist lawyer for IT law and for copyright and media law (Fachanwalt für IT-Recht, Fachanwalt für Urheber- und Medienrecht).

Send metaverse enquiry

What happens after your enquiry?

After your enquiry, we get back to you within 24 hours on working days. The first contact is free of charge. Before any costs arise, we point this out to you explicitly.

A short description is enough. Describe the project, roles and data flows. Helpful are existing contracts, T&Cs, policies or design and asset documentation.
Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

Practice

Typical cases from our practice

The following scenarios are abstracted and simplified. Which solution holds up always depends on the specific facts and the contractual situation.

Chain of title for 3D assets

Starting point: An agency supplies avatars and 3D assets.
Key difficulty: Scope of licence and onward transfer are unclear.
Our work: We organise the chain of title and licence agreements.
Work result: Clear rights of use for operation.

Simplified example.

Data protection

Headset data in training

Starting point: A provider processes motion and gaze data.
Key difficulty: Purpose, legal basis and DPIA are missing.
Our work: We structure the data protection concept and documentation.
Work result: A viable XR data model.

Simplified example.

Typical constellation from practice

Virtual showroom before go-live

A typical scenario:: A company plans a virtual showroom with user accounts.
The critical point:: Roles, acceptance and data flows are open.
Our work:: We review contracts, data model and platform obligations.
Result for the business:: A prioritised go-live plan.

Typified for illustration – not a report on an actual mandate.

What you will have at the end

Services
Service	Concrete result	Next step
Contracts	Development, integration, support	Send draft contracts
Chains of title	Avatars, 3D assets, brands	Submit asset documentation
XR data protection	Motion, gaze and voice data	Outline data flows
Platform operation	UGC, moderation, advertising	Send policies
Regulation	DSA, AI Act, Data Act	Describe operating model

Legal guardrails for immersive business models

Metaverse law is not a body of legislation of its own. In practice, the interplay of contract law, data protection, intellectual property law, platform regulation, competition law and international enforcement decides whether an XR project can scale robustly or runs into conflicts early.

Commercially relevant constellations

virtual showrooms, product demos and digital sales rooms
MR/AR-supported service, maintenance and training environments
virtual events, experience platforms and brand spaces
internal collaboration spaces, simulations and digital twins
platform-based ecosystems with community, trade or creator models

The questions that must be clarified early

Who develops, delivers, hosts, operates and moderates?
Which rights exist to 3D assets, avatars, audio, UI, code and data?
Which rights of use do customers, partners, creators or platform users receive?
Who is liable for infringements, outages, blocks or incorrect moderation?
Which rules apply to AI functions, data access and platform obligations?

When you need us

Mandates rarely revolve only around “the metaverse”. Usually it is about a specific business model in which technical, commercial and regulatory questions must be set up properly at the same time.

Product & sales

Virtual product and brand worlds

Companies build digital showrooms, AR-supported sales experiences or virtual product demos. Legally relevant are above all brand management, rights to assets, contract architecture, platform integration and robust rules for advertising and labelling.

Platform & community

Immersive platform models

Anyone providing user accounts, creator content, uploads, interaction, trade or community functions needs robust terms of use, moderation processes, reporting channels, complaint logic and governance for blocks and infringements.

B2B & operations

XR in business operations

In training, maintenance, remote support, simulation or digital twin projects, the focus is on scope of services, acceptance, availability, data interfaces, security requirements, confidentiality and supply chain issues.

Contracts, roles and scopes of services must be clear before launch

In XR projects, legal problems often arise less from the code than from unclear roles, open acceptance criteria, incomplete chains of title and imprecise data or support obligations.

Scope of services, acceptance and change requests

In MR, AR and VR projects in particular, much is quickly “taken into account” but described too loosely: 3D modelling, motion design, backend, hosting, moderation, analytics, AI functions, interfaces, hardware compatibility or app store issues end up in the project without sharp definition. This takes its toll in the case of supplements, deadlines, warranty and acceptance.

Useful are precise service descriptions, defined milestones, clear acceptance criteria, documented change processes and a clean allocation of duties to cooperate, operation, support and exit.

Allocation of rights to code, 3D assets, audio, UI and content

Technical development and ownership of rights often diverge. Anyone working with external studios, agencies, freelancers, stock assets, voice elements or AI-generated components must not simply assume that every desired use is automatically cleared.

Contracts should therefore regulate precisely who receives which rights of use, whether sublicensing is permitted, whether adaptations are allowed and how updates, re-use, white-label models and international roll-outs are to be handled.

As soon as user accounts, interaction, uploads or trade are planned, the project needs more than general terms and conditions. Regularly required are terms of use, community rules, reporting processes, blocking logic, complaint channels, IP policies, advertising rules and a clear interlocking of contract, moderation and enforcement.

It is important that these documents are not created in isolation. They must fit the product, the UI, the actual roles in platform operation and internal escalation paths.

Useful for further depth: IT contract / software contract, IT law, start-up advice and, for ongoing product maintenance, the outsourced legal department.

Chains of title, avatars, 3D assets and brand spaces

Not every technical availability is a right of use. Anyone working with avatars, skins, virtual items, 3D environments, brand spaces, music, voice, code or tokenised structures should distinguish clearly between platform access, licensing situation, technical control and commercial exploitability.

Relevant in practice: The real weak point rarely lies in the individual asset, but in the chain of title. If it is missing, problems arise in roll-out, campaigns, collaborations, IP enforcement, due diligence and exit.

What must be clarified for avatars, skins, 3D assets and virtual items

Who is the original rights holder of the model, texture, animation, audio and code?
Which types of use are granted: internal, external, advertising, platform-related, international?
Are adaptations, reskins, ports or white-label models permitted?
Are there restrictions from platform terms, stock licences or open source components?
Who bears the risk of claims, takedowns, blocks or third-party claims?

Trade mark, design and copyright interlock in the XR context

Digital goods and experience spaces rarely raise just one IP question. Trade marks protect signs and virtual indications of origin, design law can protect GUI, icon, interface or 3D design, and copyright concerns creative content, audiovisual elements, music, texts, designs and software components.

Anyone relying on a single property right often gives away scope for enforcement. For strong models, the combination of IP strategy, contract management and a documented chain of title is therefore decisive.

Obvious deep dives: copyright law, trade mark law, design law, industrial property protection and, for tokenised special models, blockchain / crypto law.

XR data protection and data governance need more than standard texts

MR, AR and VR projects often generate considerably more granular data than classic web applications. Relevant may be motion data, gaze direction, interaction profiles, voice data, device identifiers, location reference, room capture or biometric references. Copied privacy notices and general consent banners are therefore usually not sufficient.

Typical sensitive data situations

eye tracking, gaze data and attention signals
voices, gestures, movement and interaction patterns
behavioural profiles for personalisation, recommendations or advertising
linking XR use with CRM, shop, community or HR data
data flows between hardware, app, cloud, analytics and third-party tools

What should be in place before launch

clarification of roles between controllers, joint controllers and processors
definition of purposes, legal bases and robust deletion logic
review of third-country transfers and the service provider chain
early assessment of whether a data protection impact assessment is required
alignment with security, incident and authorisation concepts

Also important: data protection law, cybersecurity, IT compliance and, for data-driven product and access topics, implementing the Data Act.

DSA, AI Act, Data Act and official starting points

Not every XR project falls fully under every EU regime. But immersive platforms and data-rich products today regularly touch several regulatory fields at the same time: platform obligations, AI regulation, data protection, data access, advertising law and intellectual property law. A trigger review is therefore more useful than sweeping vocabulary about the future.

When platform regulation becomes particularly relevant

when third-party content is hosted, distributed or moderated
when user accounts, creator content or trading functions are integrated
when notice-and-action, transparency or complaint mechanisms are needed
when advertising or recommender logic runs in a platform-like environment

Social media law, media law and implementing the DSA are the obvious follow-on pages here.

When the AI Act and Data Act also apply

for AI avatars, generation functions, recommendation systems or moderation AI
for AI-supported analysis of interaction, behaviour or user profiles
for connected products and related services with questions of data access or data sharing
in supply chains in which provider, deployer and integrator roles diverge

Deep dive: AI law, implementing the AI Act and implementing the Data Act.

Official texts and classification

GDPR / Regulation (EU) 2016/679 (opens in a new tab) – decisive for XR data, roles, transparency, transfers and special categories of data.
Digital Services Act / Regulation (EU) 2022/2065 (opens in a new tab) – relevant for hosting, platform operation, notice-and-action, advertising and recommender systems.
AI Act / Regulation (EU) 2024/1689 (opens in a new tab) – relevant for AI systems and AI functions in immersive products.
Data Act / Regulation (EU) 2023/2854 (opens in a new tab) – relevant for data access, data use and connected product/service ecosystems.
DSM Directive / Directive (EU) 2019/790 (opens in a new tab) – important for platforms, uploads, use of content and copyright interfaces.
EU classification of virtual worlds (opens in a new tab) – useful for the political and regulatory positioning of the topic.

Platform operation, moderation, advertising and liability

As soon as an XR project provides for ongoing operation with accounts, communication, uploads, trade or community elements in addition to the experience, the focus shifts. Then, besides development and IP, it is also about platform operation, complaints, blocks, advertising and clean internal responsibilities.

Moderation, reporting systems and complaint channels

Companies should determine early which content is permitted, how reports are received, how quickly decisions must be made, who documents them and how escalations proceed. This concerns unlawful content as well as spam, identity misuse, fraud, deepfakes, fake profiles, IP infringements and community conflicts.

Advertising, creator collaborations and in-world communication

Virtual product placements, branded avatars, experience collaborations, in-world sponsoring or AI-supported personalisation must be measured against the same core questions as other digital campaigns: labelling, misleading statements, data basis, use of rights and documented approvals.

It becomes particularly error-prone when marketing, product, the platform team and legal work with different assumptions about reach, rights and data use.

International enforcement and conflicts during ongoing operation

Metaverse and XR projects are often cross-border from the outset. Place of jurisdiction, choice of law, escalation paths, account blocking logic, takedown processes, provision of proof and preservation of evidence should therefore not only be considered after the conflict. With a platform connection in particular, operational preparation often decides commercial ability to act.

Useful deep dives: social media law, media law, advertising law, e-commerce and litigation & litigation PR.

Go-live check for companies

Before launch, prioritisation is needed rather than a folder of theory. What matters is which points must be finished before go-live, where documented interim solutions suffice and which risks must not remain in blind flight.

Clarify before go-live

roles, scope of services and acceptance logic
chain of title for assets, code, audio, UI and brand spaces
terms of use, community rules and moderation set-up
data protection architecture, service provider chain and deletion logic
review of DSA, AI Act and Data Act triggers
advertising and labelling issues in creator and experience models

Manage cleanly during ongoing operation

claim and takedown processes
incident and escalation paths
documentation of approvals, sources of rights and changes
regular review of partners, platform rules and product updates
versioning of policies and records
clear responsibilities between product, marketing, security, compliance and legal

Practical follow-ups are the AI Act roadmap, The Digital Services Act, Applying the DSA, Contract drafting in IT law and, for ongoing operational support, the outsourced legal department.

Contact person and next steps

In metaverse, MR, AR and VR projects, setting the course early is almost always cheaper than later repair. This applies in particular when product development, marketing, platform operation, rights clearance and data issues run at the same time.

Obvious contact person at ITMR

Jean Paul P. Bohne, LL.M., MM Rechtsanwalt (lawyer) | Partner | Wirtschaftsmediator (business mediator)

Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law)
AI Officer | KI-Beauftragter (AI officer) [DEKRA]
CIPP/E, CIPM, external data protection officer [TÜV], data protection auditor [TÜV]
particularly relevant at the interfaces of platforms, IP, AI, data protection and commercial structuring

bohne@itmr-legal.de +49 211 737547-70 Jean Paul P. Bohne

Helpful for the initial assessment

short description of the business model
your company's role in the project
planned launch date
platforms, agencies, studios or technology partners involved
existing contracts, T&Cs, policies or design/asset documentation
questions about AI, data, UGC, trade, advertising or international roll-out

Continue to Get in touch and View ongoing support.

Glossary

Key terms

XR: Umbrella term for mixed, augmented and virtual reality.
Digital twin: Virtual representation of a real object or process.
Chain of rights: Unbroken sequence of rights to assets and content.
UGC: Content created by users.
DPIA: Data protection impact assessment (Datenschutz-Folgenabschätzung).

These terms explain the language used on this page. What matters is always the specific individual case.

Provisions

Provisions and reliable sources

The following statutory provisions and regulations are cited on this page.

Basics
Provision	Content	Practical significance
DSA	Digital Services Act	Hosting and moderation of third-party content.
AI Act	Regulation (EU) 2024/1689	AI functions in immersive products.
Data Act	EU Data Regulation	Data access for connected products.

FAQ

FAQ on metaverse, MR, AR and VR projects

The following questions are asked particularly frequently by companies, platform operators, agencies, brand owners and investors when immersive business models move from the idea into operation.

Is the metaverse a legal space of its own?

No. For German and EU-related projects there is no separate “metaverse law”. The relevant rules on contracts, data protection, intellectual property, platform operation, advertising, liability and international civil procedure are decisive. Especially in cross-border platform models, the specific product and contract architecture therefore decides; the buzzword alone does not carry the case.

Do avatars, skins, 3D assets or virtual items automatically belong to the buyer?

No. Whether and to what extent rights of use, exploitation or onward transfer exist regularly follows from platform terms, licence agreements, technical design and the respective business model. Anyone wanting to work commercially with digital assets should always check the chain of title and the contractual grant, not just the interface or a technical allocation.

When does XR data protection become particularly critical?

Particularly sensitive are projects that process motion data, gaze direction, voice, facial expressions, interaction profiles or biometric references or combine them with other data sources. Standard texts are then usually not sufficient. Purpose limitation, legal bases, allocation of roles, storage logic, deletion concept, processing on behalf, third-country transfers and a data protection impact assessment often have to be examined early.

When do the DSA, AI Act or Data Act apply in MR, AR and VR projects?

That depends on the operating model. The DSA becomes relevant when a service hosts, distributes or moderates third-party content. The AI Act must be examined when AI systems or AI-supported functions are integrated, such as avatars, recommendation systems, moderation or generation functions. The Data Act can become important when connected products or related services raise questions of data access and data sharing. Not every XR project falls fully under all regimes, but the review should take place early.

Which contracts are almost always business-critical in metaverse projects?

In practice, development and integration contracts, licence agreements for 3D assets and content, platform terms and conditions, community rules, data protection documents, data processing agreements, trade mark and cooperation agreements as well as provisions on support, moderation, SLA and exit are decisive. Anyone tackling these documents only shortly before launch often produces costly rework on rights, liability and data flows.

How can the risk realistically be reduced before go-live?

A structured preliminary check along the business model, roles, data flows, IP rights, user-generated content, advertising logic, platform obligations, security requirements and dispute resolution mechanisms is useful. The aim is robust prioritisation rather than theoretical completeness: what must be finished before launch, what needs documented interim solutions and what may only be expanded after market feedback?

Next step

Setting up immersive projects on a robust legal footing

We support MR, AR, VR and XR projects from contract structure to go-live.

Request metaverse advice Jean Paul P. Bohne Why ITMR

Note on the legal status

Legal status: 23 October 2026. This overview provides initial orientation and does not replace a review of the specific case.

Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)