Immersive clients expand the attack surface
A headset update may add a runtime plugin, camera permission or analytics package without changing the visible game. Each can alter data flows and attack surface for identity, payments and outcomes. Follow releases from device to platform, including incident responders and connected services.
Threat modelling should cover account access, wager acceptance, outcome generation and client data. Include device compromise, replay, stolen tokens, injected overlays, fake support, vendor breach, stream manipulation and service denial.
Keep outcome and ledger authority on controlled services. The headset may request and display, but cannot settle. Use unique IDs, expiring tokens, server validation and auditable updates. Animation does not prove a transaction.
New Zealand's online casino regime is in transition
The Online Casino Gambling Act 2026 is in force, with phased implementation described by DIA. On 26 October 2026, the provider page says advertising is prohibited, restrictions begin 1 December 2026 and the full licensed system is expected in 2027. Read Act, regulations and minimum standards together; dates may change.
New Zealand's online sports and racing betting rules differ. DIA identifies TAB NZ as the sole currently permitted domestic provider. Do not apply casino licensing assumptions to sports betting. Classification depends on service, game, audience, payments and promotion.
Assign a compliance owner and release calendar per market. Control availability and promotion server-side. A static client that cannot be switched off quickly does not suit changing regulatory dates.
Apply account and payment controls at the platform layer
DIA's 2026 standards require unique customer accounts, authentication at login, auditable events and multi-factor option for sensitive tasks. They also cap inactivity before timeout. A headset profile cannot replace account authentication or recovery.
Payment providers must meet the PCI DSS version named in the minimum standards. Keep payment tokens out of 3D client state and never store card numbers in a scene. Use approved providers, restrict payment logs and separate test from live credentials.
Separate roles for support, operations, developers and privacy teams. Reverify before changing withdrawal details or resetting credentials. Log every privileged action with actor, time, reason and account.
Location and network controls need visible outcomes
New Zealand 2026 location rules require blocking access if the platform cannot confirm the user is in-country and reasonable checks against VPN or proxy evasion. Device GPS and IP are incomplete; combine them into a service decision and explain failure clearly.
Return a reason code, confidence and recovery route from location checks. Explain next steps without disclosing evasion logic. Retain records for compliance. Re-test after network changes, mobile handoff and privacy relay use.
A headset's room anchor describes local geometry, not the jurisdiction where a user is located. Keep location enforcement separate from scene placement.
Preserve game integrity and account history
Regulated outcomes must follow published rules and specified RNG integrity. The platform needs a cryptographically secure generator, monitoring and a way to disable a game if output fails. Visual animation does not establish the draw.
Realistic graphics do not prove fairness. Keep RNG, logic, versions, configuration and settlement on auditable services. Vision may monitor a physical table or stream but cannot set or change a digital outcome. Deny rendering clients permission to edit game configuration.
Retain the records needed for complaints: account, round, version, accepted input, outcome, time, interruption and review. Where possible, use append-only history. Corrections should preserve the original and identify the editor.
Biometric data needs a separate privacy threat model
Biometric features such as face, voice, gait or typing can identify, verify or categorise. New Zealand's Code governs specified automated processing and requires lawful purpose, necessity, safeguards and proportionality. Basic tracking may differ in scope, while personal information can still fall under the Privacy Act.
Assess video, templates, voice, gaze and derived features separately. Encrypt, restrict and log access; set retention and verify vendor deletion. Keep camera data local when adequate, and offer non-biometric account access when it serves the same goal.
Do not infer vulnerability from gaze, expression or movement to target money offers. Security signals should identify technical threats, not become hidden marketing. Include staff and others visible in video in privacy assessments.
Secure software updates and XR dependencies
Headsets depend on OS, runtime, engine, plugins and stores. Maintain a dependency inventory with version, vulnerability, owner and update date. Remove unused access, disable dev endpoints, sign builds and secure the update path.
Review SDKs for analytics, voice moderation, avatars, crashes and cloud rendering. They may collect more than the feature needs. Require security evidence, incident notice, subcontractor details and deletion terms before adoption.
Roll out in stages with rollback. Watch errors, failed logins, duplicate transactions and device crashes. Old clients must not bypass new account rules; server-side checks need to remain current even before every headset updates.
Incident response must preserve customer outcomes
Prepare named owners for takeover, exposed payment data, compromised SDK, location failure, RNG alert, stream tampering and biometric breach. Define evidence preservation without keeping unrelated footage indefinitely.
Interruption rules call for timely recovery and customer-protective outcomes when games cannot continue. Support should see the same authoritative state as players. Do not decide refunds from local animation or incomplete footage.
Security release evidence
- Account security
- Evidence:Authentication, MFA option, recovery tests and privileged-access logs.· Owner:Identity and security teams.
- Payments
- Evidence:PCI scope, provider confirmation and token-handling diagram.· Owner:Payments and compliance.
- Game integrity
- Evidence:RNG monitoring, game-version log and settlement replay.· Owner:Game operations.
- Privacy
- Evidence:Sensor data map, impact assessment, retention and vendor review.· Owner:Privacy owner.
- Market access
- Evidence:Current New Zealand licence and geolocation decision test.· Owner:Legal and regulatory owner.
Keep regulatory facts under active review
Regulatory details change. Before publication and release, recheck DIA and legislation. The 1 December 2026 step and 2027 regime are future milestones as of this review; assign a timeline owner. Verify the separate sports-betting restriction against current racing law.
- Check the legislation and regulator pages against the article’s review date.
- Assign a named owner to each dated transition milestone.
- Refresh player-facing copy when a status, licence or restriction changes.
Bring the dependency list, control tests, payment scope, incident runbook and New Zealand market decision to release review. Give each open item an owner and set the next regulatory check date.