Virtual reality lets kids play 3D games with their friends as avatars, go back in time, even journey to outer space, all without leaving their living rooms.

But while children are immersed in the metaverse, they also face privacy risks that their parents might not recognize, suggests new research posted to the arXiv preprint server.

A survey led by researchers at Duke University and North Carolina State University suggests that when it comes to kids and virtual reality, U.S. parents aren't as concerned as they should be—especially about handing over their kids' personal data to advertisers and big tech.

The researchers polled 20 parents with children between the ages of six and 17 who use VR at home.

When setting ground rules for digital technology, most parents treat VR like other tech such as social media and smartphones, the researchers found. But VR differs from other forms of screen time in important ways, said Duke assistant professor of computer science Pardis Emami-Naeini.

For one, VR devices learn more about their users than websites and apps.

While your child battles virtual dragons or plays simulated mini golf, for example, the cameras and sensors in their VR headset also collect data such as where their eyes are looking, the layout of the room they're playing in, recordings of their voice and other sounds in the home, and their head and hand movements—all of which can be used to infer dozens of other characteristics, including their age, gender, location, ethnicity and disability status.

"Prior research has shown that you can infer a lot of information from people's eye movements, even their political orientation and sexual preferences," Emami-Naeini said.

What's more, VR headsets share the information they collect with third parties such as advertisers for profit, she added.

And yet, most parents surveyed were generally unconcerned about threats to their children's privacy in the virtual world. Indeed, about half said they had never thought about these issues with respect to VR before, arguing that the technology hasn't taken off yet and doesn't have the billions of users that other technologies have.

Instead, other concerns were more top of mind. Because VR goggles work inches from your eyes and block out real-world sights and noises, parents worry their kids could experience eye strain if they wear them for too long, or could hurt themselves because they can't see where they're swinging their arms and legs.

Parents were also wary of the fact that behind the computer graphics is a real-life person their children may not know, and who could potentially be dangerous.

Because they can't easily see what's happening on the screen like they can with other video games or control who their kids interact with, parents said they worried their child might be exposed to harassment, cyberbullying, or inappropriate content as a result of VR gaming.

"When they get on VR, in their head, they're in a safe video game space," one parent said. "They're not thinking, 'oh, that cartoon character could actually be a person who has ulterior motives like a stranger on a street.'"

Few parents in the survey had actually read the privacy policies of the VR devices their children used. And while they could name privacy risks when specifically asked, most parents were more worried about their child sharing too much about themselves with strangers than companies collecting and profiting from their children's data.

"What we saw in this research is many of the parents did not really know how VR works," Emami-Naeini said. "The kids were using VR, but not the parents."

Nearly 1 in 3 American teens has a VR headset of their own. While most VR headsets aren't recommended for children under 13, the families in the study weren't waiting until the 13 age mark. Children as young as 6 were using the devices.

To better protect kids, the researchers say parents should try VR devices for themselves and familiarize themselves with the parental supervision features they offer.

"Designers of VR platforms definitely need to be more transparent about their security and privacy practices too," Emami-Naeini said. "And this information should be presented in a more usable format so that parents understand."