Metaverse law in the Netherlands: which Dutch and EU rules apply?

There is no separate metaverse law in the Netherlands. Virtual worlds are governed by ordinary Dutch contract, property, criminal and copyright law, together with directly applicable EU regulations such as the Digital Services Act (DSA), the AI Act and the General Data Protection Regulation (GDPR, in Dutch AVG).

The key point for users and businesses: you do not own virtual land or items as property under Dutch civil law; you hold a contractual right against the platform. What you can do with it depends on the terms of service, and those terms must survive Dutch rules on general terms and consumer protection.

Which EU rules already apply to virtual worlds?

Every platform that can be reached from the Netherlands is already regulated, even if no instrument uses the word “metaverse”. The DSA (Regulation (EU) 2022/2065) has applied to all intermediary services since 17 February 2024.

Under the DSA a platform must have a point of contact, explain its content moderation in its terms, run a notice-and-action mechanism for illegal content and give reasons when it removes content or suspends an account. In the Netherlands the Authority for Consumers and Markets (ACM) is the Digital Services Coordinator. Our overview of the Digital Services Act and Digital Markets Act sets out these duties.

The AI Act (Regulation (EU) 2024/1689) applies in stages. The bans on prohibited AI practices apply since February 2025 and the rules for general-purpose AI models since August 2025. The transparency duties of Article 50 apply since 2 August 2026: users must be told when they deal with an AI-driven avatar, and synthetic images, audio or video must be marked as such. The AI Omnibus (Regulation (EU) 2026/1744) moved the high-risk rules to 2 December 2027 for stand-alone systems and to 2 August 2028 for AI in regulated products.

Two more instruments are easy to overlook. The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025 and gives users of connected products, such as a VR or AR headset, a right to access and share the data the device generates. Where a world issues or trades tokens, the Markets in Crypto-Assets Regulation (MiCA) has applied to crypto-asset service providers since 30 December 2024, with the Dutch Authority for the Financial Markets (AFM) responsible for licensing; truly unique NFTs fall outside it.

Do you own virtual land, avatars and digital items?

Not under Dutch property law. Article 3:2 of the Dutch Civil Code (BW) only treats tangible objects as things (zaken) capable of ownership, so a virtual plot gives you a licence under the platform’s terms, not title.

If the world closes, the rules change or your account is terminated, your remedy lies in contract. Criminal law takes a wider view: in the RuneScape case (ECLI:NL:HR:2012:BQ9251, 31 January 2012) the Supreme Court (Hoge Raad) held that virtual items can be goods capable of theft under Article 310 of the Criminal Code (Sr).

An NFT rarely changes this. It is a ledger entry pointing to an asset; what you may do with the underlying image or model depends on the licence. Buying an NFT of an artwork almost never transfers copyright, because Article 2 of the Dutch Copyright Act (Auteurswet) requires a deed for a transfer.

Consumers get extra protection. The rules on digital content and digital services in Book 7 BW require a paid virtual item or service to conform to what was promised and to receive updates for as long as a consumer may reasonably expect. Business deals fall outside that regime, so negotiate service levels, continuity and exit terms.

How are trade marks and copyright protected in virtual worlds?

A trade mark only covers the goods and services listed in its registration, so a mark for real clothing does not automatically cover virtual clothing. File virtual goods specifically, with the Benelux Office for Intellectual Property (BOIP) for a Benelux mark or with the EUIPO for an EU trade mark.

Copyright protects any work with its own original character, including 3D models, textures and world design. Copying a protected design onto an avatar skin is a reproduction, whatever the platform terms say. Most platforms take a broad licence over uploaded content; that is a licence, not a transfer, and an unreasonably onerous clause can be set aside under Articles 6:231 to 6:247 BW.

Rights holders can use the DSA notice-and-action route, apply for an ex parte injunction under Article 1019e of the Code of Civil Procedure (Rv) and ask the platform to disclose an infringer’s identity. Copyright in works made by employees in the course of their duties vests in the employer (Article 7 Auteurswet); a freelance developer keeps it unless a deed transfers it. More on enforcement in our article on intellectual property enforcement in the Netherlands.

When is an agreement made through avatars binding?

As soon as the ordinary requirements of Dutch contract law are met: offer and acceptance (Article 6:217 BW) and a will matching a declaration, or a declaration the other party could reasonably rely on (Articles 3:33 and 3:35 BW). Most contracts need no particular form, so a click or chat message in a virtual world can bind you.

The usual problem is evidence: who was behind the avatar and what exactly was agreed. Platform terms are general terms (Article 6:231 BW) and must be made available before or at the conclusion of the contract. Against consumers, Articles 6:236 and 6:237 BW make clauses such as broad liability exclusions or unilateral service changes void or presumed unreasonable. Smart contracts are only a means of performance; a transfer can still be annulled for mistake (Article 6:228 BW).

What criminal and liability risks arise from conduct in virtual worlds?

Conduct in a virtual world is judged under ordinary Dutch criminal law. Persistent pursuit of another user can be stalking (belaging, Article 285b Sr), and the Sexual Offences Act (Wet seksuele misdrijven), in force since 1 July 2024, also covers sexual harassment and image-based abuse online.

A platform is in principle not liable for its users’ conduct if it plays a neutral role and acts quickly once it knows of illegal content (Article 6 DSA). If it ignores a well-founded notice, it can be liable for a wrongful act under Article 6:162 BW.

What do VR and AR data mean under the GDPR?

Headsets record movement, gaze, voice and room geometry; all of that is personal data if it can be linked to a person. Biometric data is special category data under Article 9 GDPR only when processed to uniquely identify someone, for example gaze data used as a login.

Large-scale monitoring of behaviour usually requires a data protection impact assessment (Article 35 GDPR). For children under 16, the Netherlands requires parental consent for consent-based processing of information society services. Transfers to cloud services outside the EU need an adequacy decision or standard contractual clauses under Chapter V GDPR. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises.

Which court decides and which law applies?

For contracts, the parties may choose the law, but under Article 6 of the Rome I Regulation a consumer keeps the mandatory protection of the law of their habitual residence. Under Articles 17 to 19 of the Brussels I bis Regulation, a consumer can sue a trader that directs activities at their Member State in their home courts and can only be sued there.

For non-contractual claims, such as infringement or harassment, the Rome II Regulation generally points to the law of the country where the damage occurs. If the other party is outside the EU, enforcement becomes the real obstacle. See our article on how to avoid jurisdiction and enforcement issues.

What should you check as a business launching in a virtual world?

• Do your trade mark registrations cover virtual goods and services?
• Do you hold a clean chain of title to all models, code and designs, with deeds for freelancers?
• Do your terms state that users acquire a licence, how the world may change and what happens to purchased items if the service ends?
• Do you have a DSA point of contact, a notice-and-action channel and a moderation log?
• Does your privacy statement name a legal basis for each type of sensor data, and is a DPIA done?
• If you use AI-driven avatars, do you meet the Article 50 AI Act disclosure duty?

What should you check as a user or creator?

• Do the platform terms give you a licence only, and what happens to your items if your account is closed?
• Which licence does the platform take over your uploads, and is it compatible with your other clients?
• Does the NFT you buy come with any rights to the underlying work?
• Which law and court does the platform claim, and are you a consumer protected by Rome I and Brussels I bis?

What can we do for you with metaverse law?

Our IT lawyers advise businesses and creators on virtual worlds and digital assets.

• We draft and review terms of service, licences and creator agreements against Articles 6:231-6:247 BW.
• We check your trade mark and copyright position and close gaps in the chain of title.
• We set up DSA notice-and-action procedures and AI Act transparency notices.
• We review privacy statements and DPIAs for VR and AR data.
• We act in disputes over digital assets, takedowns and infringements.

Summary

• No metaverse statute exists; Dutch private, criminal and IP law apply, together with the DSA, AI Act, Data Act, MiCA and GDPR.
• Virtual land and items are not property under Article 3:2 BW; your rights are contractual, although virtual items can be stolen under criminal law.
• Agreements through avatars are binding under ordinary contract law; platform terms are tested as general terms.
• AI Act transparency duties apply since 2 August 2026; high-risk rules follow in December 2027 and August 2028.
• Consumers keep their home-country protection and courts under Rome I and Brussels I bis.

Frequently asked questions