Avatars vs. Natural Persons

First, some discussion about how the GDPR applies to avatars in SL.

- see https://gdpr-info.eu/art-4-gdpr/

“Personal data” means any information relating to an identified or identifiable natural person. A natural person in general means a human being. Think of a natural person as someone with rights, such as those granted by the US constitution. Avatars obviously don’t have constitutional rights. Unfortunately the GDPR rules do not address the issue of avatars vs. natural persons, so it's left up to various people to give their opinions on the matter, which to me are simply not definitive.

Your avatar ID (legacy name, account name, UUID) could maybe be considered personal data, but can it be linked to any specific natural person? In general, with rare exceptions, no. The general consensus today seems to be that avatar data is not personal data. It just can’t be linked to you in any reasonable way.

SL is designed to make identifiable information about avatars easily and readily available. Any script (and most viewers if not all) can easily get your name and UUID. Those items are by design very public. You don’t need to opt-in to give that data out. It’s public data. Unsolicited spamming of such visitor lists, however, has always been against the TOS, but that’s a different subject.

All that being said, it's just not clear to me that the GDPR rules apply to avatars at all or whether any kind of data that can identify an avatar can be used to then identify a natural person.