The metaverse—an immersive, persistent and networked virtual environment first conceptualized in Neal Stephenson’s Snow Crash (1992)—integrates Virtual Reality (VR), Augmented Reality (AR), and Extended Reality (XR) to enable users to “live” within a digital universe through avatars. Unlike traditional Web 2.0, the metaverse creates a powerful sense of “being there” through immersion, embodiment, and decentralization. Avatars act as psychological extensions of users, aligning the virtual character with the physical self—meaning virtual violations are perceived as personally degrading and traumatizing. This frontier has simultaneously enabled sophisticated new forms of criminality, academically termed “metacrime,” which exploit sensory realism and anonymity to inflict psychological trauma similar to real-world abuse.
The acute danger posed by metacrime was recently evident in the first reported metaverse sexual assault case in India. A 32-year-old woman, while exploring a popular VR platform, had her avatar suddenly approached, subjected to sexually explicit gestures, and inappropriately touched in the virtual space. She reported feeling frozen and violated, experiencing a profound sensory response where the movements felt “vivid, close-up, and in sync with her immersive headset’s sensory feedback”. Her psychiatrist noted that her resulting acute anxiety disorder and intrusive flashbacks closely mirrored symptoms seen in survivors of real-world sexual harassment and assault.
A survey found 49% of female and 30% of male VR users had experienced sexual harassment, and every seven minutes, one incident of sexual harassment has been reported on VRChat. Case studies from Meta’s Horizon Worlds and the 2024 UK case involving a minor demonstrate that the psychological distress caused by avatar-based assault is profound and deeply disturbing—akin to actual sexual assault.
Thus, given the importance of the topic, this article attempts to analyse how existing criminal law frameworks struggle to respond to sexual violations committed through avatars in immersive environments. It first explains why virtual reality experiences produce real, embodied harm, then analyses the limitations of Indian penal law in addressing such violations. Finally, it draws from comparative international approaches to propose effect-based reforms over rigid notions of physical contact.
What Makes Virtual Reality a ‘Reality’?
Technologically, the metaverse relies on a combination of sophisticated components to create sensorial realism. VRs, for instance, provide a hyper-real, 3D view, convincing the user they are physically present, or experiencing a sense of “presence”. A major factor intensifying this experience is the development of Haptic Feedback/Sensors, which simulate the sense of touch, as illustrated by the incident involving Maria DeGrazia in Population One who felt the abuse through her haptic vest. The evolution toward highly advanced interfaces, such as Elon Musk’s Neuralink, in which the human nervous system directly interacts with the technology “just by thinking.” This illustrates how deeply merged the virtual and physical experiences are becoming.
The emphasis on psychological harm stems directly from this sensory depth and the principle of embodiment. Under Psychological Ownership Theory, users internalise their avatars as representations of their own personal identities; therefore, an avatar-based violation is perceived as personally degrading, not merely an action happening “in code”. This deep integration causes the human nervous system to react to virtual experiences with emotional, psychological, and nervous system responses very similar to those in the real world.
Beyond direct assault, the technology functions to enable pervasive surveillance through, what Brittan Heller called “Biometric Psychography”. Metaverse hardware, such as head-mounted displays, continuously collects vast quantities of biometric and physiological data, including gaze patterns, facial movements, gestures, and spatial orientation. Advanced systems, exemplified by Meta’s Codec Avatars, require intensive biometric mapping. This deep data extraction allows corporations to derive insights into users’ emotional states, personality traits, and susceptibilities. This shift from identifying who a user is to revealing how a user thinks and feels provides the fuel for Surveillance Capitalism, where subconscious reactions are commodified for targeted manipulation, significantly enhancing psychological vulnerability and privacy risks. Yet while the technology to inflict such harm advances rapidly, legal frameworks remain anchored to outdated assumptions about the nature of sexual violation.
Laws in India
The Indian legal framework confronts substantial difficulties in addressing metaverse offenses, primarily due to its foundation in territorial, corporeal, and identifiable constructs, which clashes directly with the virtual nature of metacrime. The reliance on physicality for defining criminal acts renders much of the existing legislation inadequate.
The Bhartiya Nyaya Sanhita, 2023 (BNS, 2023), fundamentally fails in direct applicability to virtual rape. S. 63 is constrained by the corporeality doctrine, as it requires physical penetration of the body or insertion of an object, an element which is not present in avatar-mediated sexual assault. However, the judiciary has displayed capacity for liberal interpretation; the JMFC in Animesh Boxi held that psychological harm resulting from the victim suffering “virtual rape” every time the uploaded video was viewed squarely fits under the definition of “injury” (the then S. 44). This precedent for recognizing psychological injury is critical for future metaverse cases. Further, S. 78 of the BNS, 2023 (Stalking) criminalizes cyber stalking. However, a further liberal interpretation is required to criminalize stalking via VR, where ‘avatars’ of men and women may engage in non-consensual proximity or follow a user persistently. S. 79 of the BNS, 2023 (Insulting Modesty) punishes insulting the modesty of a woman. However, the word “gesture” is positively interpreted in MM Haries to encompass any such mode that the accused may use to convey his intentions. Hence, this becomes a proposed avenue for prosecuting virtual acts like groping.
The Information Technology Act, 2000 (IT Act, 2000), remains the primary, albeit outdated, statutory recourse. However, even the IT Act, 2000 does not have any explicit provision that criminalizes what might be termed “rape without bodies”. Ss. 67, 67A, and 67B penalise the publication or transmission of obscene material. For children, the Protection of Children from Sexual Offences Act, 2012 (POCSO, 2012) addresses the use of a child in “any electronic form” for sexual gratification (child pornography). However, presently, it does not have sufficient application over the avatars of children. Furthermore, the Digital Personal Data Protection Act, 2023 (DPDPA, 2023), and the rules thereof are a welcome step. However, the DPDPA is awaiting enforcement and so the question of jurisdiction between DPDPA, 2023 and IT Act, 2000 remains unsettled.
Thus, India presently lacks any such law that specifically addresses the avatar-based digital rape.
Recommendations
Globally, many jurisdictions, including India, the UK, Canada, Australia, and the US, now criminalize non-consensual intimate images (NCII) and mandate rapid takedown, and thus acknowledged the severe effect of harm caused by image-based sexual abuse. India’s 2025 MeitY SOP mandates intermediary to remove NCII within 24 hours. However, despite this improvement, takedown laws offer post-facto relief after psychological harm has already occurred. In cases of avatar-based rape, the psychological harm can extend to a lifetime “trauma”. Thus, there is a want of more stringent, deterrence based law/amendments.
As recognised in Animesh Boxi, Indian criminal law must move beyond a purely corporeal understanding of harm. Immersive digital environments are capable of producing real psychological injury and violations of sexual autonomy. Where technology generates sensory realism, harm is no longer abstract or speculative. Thus, the definition of “injury” under S. 2(20) of the BNS, 2023 includes harm to body and mind. However, the provision remains silent on digitally embodied harm. The legislature must expressly provide that the psychological injury caused through immersive or virtual technologies falls within this definition. Furthermore, “live virtual harassment” occurring on-screen can also be construed as “transmission” of a visual image under Ss. 67 and 67A of the IT Act, 2000.
Indian criminal law currently links sexual offenses to physical contact or penetration. This framework fails to capture non-consensual sexual acts committed through avatars in immersive environments. A distinct offence must be introduced under the BNS, 2023 to criminalize non-consensual sexual conduct facilitated through virtual or immersive technologies, independent of physical touch, like recently proposed in South Korea. South Korea has expressly proposed to criminalise “avatar-based sexual misconduct”. Art 44 of the Information and Communications Network Act penalises acts causing sexual shame, stalking, or obstruction through avatars in three-dimensional virtual spaces, as the existing legal frameworks were inadequate to address rights violations occurring in immersive environments. Thus, India may also similarly criminalize avatar-based criminal offenses in the virtual spaces.
Furthermore, until a specific offense is enacted, courts should recognize avatar-based sexual assaults as attempts under S. 62 of the BNS, 2023. Where intent to sexually violate is evident and the actus reus is executed through an avatar in an immersive environment, the absence of physical penetration should not preclude criminal liability.
Lessons from Comparative Jurisprudence
India must also consider jurisprudence from other countries while developing its own. S. 177(2) of the German Criminal Code, 1998 criminalizes sexual assault by exploiting a victim’s defenselessness or inability to resist. In virtual environments, offenders exploit anonymity, inability to resist in the sensory immersion, and cognitive disorientation, particularly of children and first-time users. Such exploitation must be treated as a core element of the offence. Further, in the United States, New Jersey Statute S. 2C:14-1(c), 2024 redefines sexual assault to include penetration induced by coercion, solely on the direction of the perpetrator, without his physical presence. In State v. Maxwell, verbal manipulation that caused a child to self-penetrate was sufficient to establish liability. Similarly, California Penal Code S. 261 and S. 289 criminalize non-consensual insertion achieved through deception or remote coercion. Both the laws do not require physical presence of the perpetrator, but rather the direction or coercion by the accused. These laws acknowledge that sexual offenses are grounded in coercion, absence of consent, and exploitation of vulnerability, not in the physical presence of the perpetrator. Indian law must therefore recognise that sexual violation can occur where the accused exercises control or influence over the victim’s actions within an immersive digital environment. Where an offender, through an avatar or virtual interface, induces, coerces, or manipulates a victim into sexually intrusive conduct, the harm suffered is functionally equivalent to physical sexual assault. The law must focus on the effect on the victim and the intent and direction of the accused, rather than the mode through which the act is executed. This approach aligns with substance-over-form principles applied under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, where the effect of the harassment is relevant more than the mens rea of the accused, and with taxation statutes that impose penal liability based on economic substance over form (Post 2012, GAAR Jurisprudence).
Thus, India must enact the proposed Digital India Act (DIA) to replace the outdated IT Act, 2000. The DIA should incorporate platform obligations inspired by the Australian Online Safety Act, 2021 and the EU Digital Services Act. Platforms hosting immersive environments must be placed under a statutory duty to implement safety-by-design and ethics-by-design. Such duties must include default personal boundary systems, safe zones, proximity restrictions, and real-time intervention tools. The burden of preventing virtual sexual harm must lie on platforms that design and monetise these environments, not on users.
Finally, Sexual autonomy does not end at the limits of physical space. As immersive technologies collapse the boundary between the virtual and the real, Indian criminal law must recognize digitally embodied sexual harm and respond with coherent offencss, purposive interpretation and platform accountability.
Tatva Hemal Damania is a fourth-year law student at Maharashtra National Law University, Mumbai. Shrushti Mahesh Taori is a fifth-year law student at Maharashtra National Law University, Nagpur.
