myquote

# Understanding Parents’ Perceptions and Practices
Toward Children’s Security and Privacy in Virtual Reality

Jiaxun Cao  Duke University
<EMAIL_ADDRESS>Abhinaya S B  North Carolina State University
<EMAIL_ADDRESS>Anupam Das  North Carolina State University
<EMAIL_ADDRESS>Pardis Emami-Naeini  Duke University
<EMAIL_ADDRESS>
###### Abstract

Recent years have seen a sharp increase in underage users of virtual reality
(VR), where security and privacy (S&P) risks such as data surveillance and
self-disclosure in social interaction have been increasingly prominent. Prior
work shows children largely rely on parents to mitigate S&P risks in their
technology use. Therefore, understanding parents’ S&P knowledge, perceptions,
and practices is critical for identifying the gaps for parents, technology
designers, and policymakers to enhance children’s S&P. While such empirical
knowledge is substantial in other consumer technologies, it remains largely
unknown in the context of VR. To address the gap, we conducted in-depth semi-
structured interviews with 20 parents of children under the age of 18 who use
VR at home. Our findings highlight parents generally lack S&P awareness due to
the perception that VR is still in its infancy. To protect their children’s
interaction with VR, parents currently primarily rely on active strategies
such as verbal education about S&P. Passive strategies such as parental
controls in VR are not commonly used among our interviewees, mainly due to
their perceived technical constraints. Parents also highlight that a multi-
stakeholder ecosystem must be established towards more S&P support for
children in VR. Based on the findings, we propose actionable S&P
recommendations for critical stakeholders, including parents, educators, VR
companies, and governments.

##  1 Introduction

The growing popularity of consumer-facing virtual reality (VR) in recent years
has attracted a significant number of users [1, 2], including children under
the age of 18 [3, 4, 5]. While immersive and realistic experiences provide
great user engagement, more risks have been emerging in VR, including safety,
well-being, security, and privacy (S&P) issues [6]. Specifically, VR devices
collect a variety of sensitive data [7], including eye- and motion-tracking
data that are indispensable for immersion yet pose risks of data surveillance
[7, 8, 9]. Worse yet, S&P experts have been warning people of the scarce,
unspecific, and under-enforced privacy policies in VR [10, 11, 12, 7].

Furthermore, users including children have flooded social VR applications
(e.g., Horizon Worlds, Rec Room, and VRChat) [5, 3, 4], posing more S&P risks.
In internet-enabled social VR applications, besides data surveillance, users
also face S&P risks in social interaction, including self-disclosure [13].
Prior work has suggested that social VR users easily disclose a wide range of
privacy to strangers, including emotions, life experiences, voices, and even
real-life appearances [13].

In particular, these S&P risks in VR can be heightened for children,
especially considering the largely age-mixed environment in VR [4, 3, 5].
Prior work has investigated common risks that children encounter in social VR,
including virtual harassment, cyberbullying, and inappropriate content from
both peers and adults [4, 3, 5]. However, one important limitation of the
existing literature is that while general safety risks have been widely
documented, S&P-specific risks in VR have been largely overlooked.

In mitigating S&P risks in technologies, children heavily rely on parents’ S&P
knowledge and decision-making [14, 15, 16]. Researchers have suggested that
children trust parents’ S&P rules and tend to seek help from parents when
risks emerge [16]. Moreover, parents’ S&P perceptions might influence how
children conceptualize and perceive S&P [17, 18, 19]. In addition, parents
also adopt a variety of strategies when mediating children’s technology use,
including passive strategies (e.g., parental controls) and active strategies
(e.g., verbal education) [16, 20, 21, 22]. When adopting different strategies,
parents might also face different challenges in mitigating risks, such as low
familiarity with technology [23, 24]. Therefore, understanding parents’ S&P
perceptions and practices is crucial for researchers and other important
stakeholders to support parents’ risk mitigation strategies. While such
knowledge regarding other technologies (e.g., smartphones [25, 26], Internet-
enabled applications [16, 27]) has been fully investigated, it remains unknown
in the context of VR. Hence, this work aims to answer three research questions
(RQs):

  * •

RQ1: What are parents’ perceptions of children’s S&P in VR?

  * •

RQ2: What are parents’ risk mitigation strategies for their children’s S&P in
VR?

  * •

RQ3: What are parents’ expectations toward perceived critical stakeholders and
future S&P-enhancing features in VR?

To address the RQs, we recruited 20 parents whose children use VR applications
at home. We conducted semi-structured interviews to surface their perceptions
of S&P risks for children in VR. We then asked parents how they addressed
their concerns, if at all. Last, we asked them to propose critical
stakeholders and desired features in protecting children’s S&P in VR.

Our qualitative analysis reveals three main points. (1) First, although
parents typically do not have immediate S&P concerns for their own children,
they do express concerns for underage VR users in general and anticipate more
pressing risks for their own children in the future. (2) Second, parents adopt
a limited range of strategies when mediating children’s VR usage.
Specifically, parents rely on active strategies such as verbal education more
than passive ones, including parental controls. While acknowledging the
potential effectiveness of passive strategies, parents face significant
technical constraints in practice. (3) Finally, parents agree on four critical
stakeholders – parents, educators, VR companies, and governments. They also
propose a series of potential features to enhance existing S&P controls in VR,
with a few reservations about using them.

Based on parents’ rich insights, we provide actionable recommendations for the
critical stakeholders. In brief, we urge parents, educators, and governments
to enhance their nuanced understanding of VR technologies, as their current
S&P practices are overgeneralized across all digital devices. We also
encourage parents and educators to set physical references when educating
children about S&P risks in VR. In addition, we propose that VR companies
should involve engagement, granularity, and modality-specific considerations
in their designs of S&P controls. Finally, we call for VR companies to enhance
their user guidance on S&P risks in VR, along with regulators’ enhanced
supervision over VR companies’ S&P practices.

##  2 Related Work

Children’s S&P risks in VR. VR technologies collect a vast amount of sensitive
data that has been categorized by Dick [7] into four types – (1) observable
data that generate users’ virtual presence, e.g., avatars and real-time in-
world interactions [28, 29]; (2) observed data that enhance immersive
experiences, e.g., motion/eye-tracking [8, 9, 29, 30, 31]; (3) computed data
that improve user services, e.g., user profiles for advertisements; and (4)
associated data that allow Internet-enabled functions, e.g., IP addresses,
usernames, and friend lists [32]. Unlike many other consumer technologies, VR
collects these sensitive data that are indispensable for its core utility–
immersive experiences [33]. Specifically, users have to trade their motion-
tracking data for the full-body tracking experience; the data collected via
external-facing cameras for detecting obstacles around; and voice data for
social experiences [7]; just to name a few. Due to the unique immersive nature
of VR technologies, researchers have been calling for policymakers to reform
existing privacy laws and policies such as COPPA [34] and HIPAA [35] that
would unnecessarily limit users’ experiences of VR technologies [7]. In
addition, a 2018 study has revealed that VR developers considered VR privacy
policies problematic for providing developers with few standards and
guidelines regarding S&P [6].

In the context of social interaction, more S&P risks have emerged as VR
evolves to become a popular form of social technology [13, 36, 37]. Mainstream
social VR platforms, including VRChat, Horizon Worlds, Rec Room, and more,
allow users to socialize with others through head-mounted displays (HMDs) [38,
39]. In this vein, a volume of social VR work has identified numerous privacy
and safety risks. Maloney et al. [13] have found that social VR users tend to
feel comfortable and safe to share emotions and life experiences due to the
anonymity afforded by social VR. In addition, users’ physical traits, such as
their voices and real-life appearances, can also be disclosed since (1) voice
chats are ubiquitous in social VR and (2) some users prefer to represent
themselves with a virtual avatar close to their appearance in real life. More
recently, with the increasing popularity of social VR streaming, users’
privacy has been violated by streamers who broadcast in public VR spaces [36].

Additionally, due to the age-mixed environment [4, 3, 40], children who are
considered part of the marginalized community in social VR often face more
tailored risks, such as predators, harassment, cyberbullying, inappropriate
adult content [5, 41, 42, 43, 44], etc. However, compared to such safety
threats that have been widely studied, children’s S&P in social VR have been
much more marginalized in scholarly work. Previous studies have collectively
pointed out that bystanders and parents have concerns for children’s privacy
as they interact with strangers in VR [4, 3]. Notably, one study has suggested
VR privacy guidelines be made more straightforward to align with children’s
reading and literacy levels [5]. To further provide actionable S&P-enhancing
recommendations, more research centered around children’s S&P is needed. Since
children heavily rely on parents’ decision-making of their online S&P [14, 45,
15, 46, 16], a critical gap exists in terms of parents’ attitudes and
knowledge around children’s S&P in VR. Our work fills this gap by identifying
and bridging parents’ knowledge gap in children’s S&P in VR.

Parents’ risk mitigation strategies toward technologies at home. Nissenbaum
defines privacy as “neither a right to secrecy nor a right to control, but a
right to appropriate flow of personal information.” [47]. This definition is
especially applicable to online social contexts where privacy risks arise from
self-disclosure [48, 47, 49, 50, 51, 52]. When self-disclosure occurs online,
privacy is about the appropriate flow of information [53]. With children’s
significantly increased online activities [54, 55, 56], more unexpected
information flows have raised new privacy concerns [16, 57]. For instance,
information disclosed via email can be retained longer than face-to-face
communications [16]. It is critical to protect children’s privacy online since
(1) privacy is an important space for children to practice making decisions,
create boundaries, and foster independence [48, 53]; (2) privacy can benefit
children’s experience in identity play, relationship building, and peer
communications [58, 16].

Security is another important aspect of children’s interactions with
technology. Prior work suggests three goals of information security [16, 59]:
(1) maintaining personal information integrity when stored and transmitted
through networks, (2) authenticating users with access to personal
information, and (3) preserving personal information confidentiality. This
work uses the above-mentioned definitions of S&P to unpack parents’ risk
perceptions and mitigation strategies.

Given the importance of S&P for children’s use of technology, parents have the
responsibility of protecting children’s digital S&P at home [60, 61]. Kumar et
al. [16] found that children aged 9 years old or younger were most likely to
seek help from parents when confronted with unknown risks online and largely
relied on parents’ explicit rules to deal with their digital S&P risks. Other
research in this vein has suggested that children of different ages trust
their parents’ S&P protections and guidance such as on data sharing [62, 63,
60]. Additionally, another line of research suggests that parents’ S&P
attitudes and practices may shape that of children [60, 64, 21, 65, 17, 18,
19]. For example, Shin et al. [17] reported that parents who self-identified
as more S&P-focused also tended to better direct children’s S&P behavior
online.

Parents adopt a variety of strategies to mitigate the risks of children’s
technology use [16], including talking to children, viewing children’s
accounts, using parental controls, being around their children when using
technology, setting rules and boundaries for usage, etc. [66, 67, 20, 21].
Having examined different parental strategies, Wisniewski et al. [22]
summarized three types of strategies in the Teen Online Safety Strategies
(TOSS) framework: (1) passive monitoring, (2) rules and restrictions in usage,
and (3) active mediation such as through having conversations with children.
However, when mitigating the risks, parents face a number of challenges, such
as underestimating the potential risks faced by children [68, 69, 23],
undermining parent-child trust [23, 70, 71, 72], and an incomplete
understanding of technologies compared to their children [23, 73, 24].
Therefore, it is crucial to investigate parents’ S&P practices around
children’s technology use at home and identify the tradeoffs in their
decision-making to help parents and technology designers work together towards
safer and more inclusive technologies for children. Unfortunately, while such
knowledge is substantial in other consumer technologies such as smartphones
[25, 26] and Internet-enabled applications [16, 27], it is largely unknown in
the VR space. Therefore, we aim to bridge this gap by providing both empirical
findings and S&P implications for critical stakeholders at play.

##  3 Methods

Recruitment. In July 2023, we advertised our study on VR-related Discord
servers, sub-Reddits, LinkedIn, and Facebook groups. Prior to the
advertisement, we obtained permission from all the channels’ moderators,
admins, or owners. In addition, one of the researchers reached out to a local
school via personal connections. After we obtained the approval from the
school, we advertised through the school’s official email communications. When
advertising our study, we did not specify our S&P focus because we did not
want to prompt our participants prior to the interview. We were interested in
what concerns would first occur to parents in a natural response without
preparation beforehand. Similar to Kumar et al.’s [16] approach, we framed it
as an investigation into parents’ perceptions and practices of children’s VR
usage. In our advertisement posts and emails, we attached a link to the pre-
screening survey and asked all interested candidates to fill out the survey.

Eligibility and pre-screening. To qualify for our study, participants must be
(1) adult residents of the US, (2) a parent or legal guardian of a child, and
(3) in possession of a VR headset in their household. The remainder of the
pre-screening survey consisted of questions about parents’ and their
children’s VR usage, including purposes of usage, VR headsets, and apps that
they use. We then asked them basic demographic questions, including parents’
and their children’s age ranges, genders, ethnicities, and parents’ highest
degrees. We closed the pre-screening survey with email collection for further
contact.

Based on the responses, we sent out interview invitations to qualified
candidates on a rolling basis until we finished 20 valid interviews. In
particular, we excluded candidates who or whose children had never used VR,
e.g., only the candidate’s partner had used it. In doing so, we attempted to
interview participants with more experience in VR and mediation of children’s
VR usage.

Interview procedure. We emailed each participant one day before their
scheduled interview to confirm their consent to participation. To verify the
authenticity of participants, we began our interview by asking participants to
show their VR headsets on camera. As a result, there were nine no-shows or
withdrawals from participation. After each no-show or withdrawal, we emailed
them to confirm if they would like to reschedule. Meanwhile, we sent out new
invitations to other qualified candidates from our survey.

From July to September 2023, we conducted one-hour remote interviews via Zoom.
To address our RQs, each interview consisted of four major sections (see the
full list of interview questions in Appendix A).

First, to have a better context building on their pre-screening responses, we
asked parents to have a more detailed account of their children’s and their VR
usage. Then, we asked them about their perceptions of the general risks and
benefits of children’s VR usage. We did not ask participants about their
S&P-specific perceptions and practices until the next section, because we
wanted to see if they would raise any S&P risks on their own initiative. If
not, we were curious about their primary concerns.

Following this section, we explicitly informed parents of our S&P focus and
asked them to specify any S&P concerns they had. Additionally, we asked
parents about their perceived stakeholders and each stakeholder’s
responsibilities in addressing their concerns.

Last, we asked parents what strategies they had adopted to address the
concerns, if at all. We also asked them about their satisfaction with the
existing S&P controls in VR and their desired features in future VR platforms.
We closed the interviews with a live survey about parents’ awareness and
perceived (or anticipated) effectiveness of the existing parental controls in
VR. The live survey questions are in Appendix A. Before parents filled out the
survey, we encouraged them to express their thoughts as they looked at the
questions. For all the participants who completed the interviews, we provided
one 20 USD Amazon gift card.

Pilot interviews. Prior to the formal interviews, we conducted two pilot
interviews with external researchers with expertise in social VR moderation,
privacy, and security. We made sure our interview could be completed within
one hour and asked them for advice on our interview protocol. In the pilot
interviews, our live survey was a post-interview survey that two participants
completed after the interviews ended. However, we found that a live survey
using the quiz function in Zoom could be more useful in prompting
participants’ holistic and nuanced thoughts on the features. Therefore,
instead of using a post-interview survey, we switched to a live survey as a
think-aloud protocol [74].

Data collection and analysis. We hosted the screening and compensation surveys
using Qualtrics [75]. All the interviews were audio-recorded and transcribed
in English using the auto-transcription service provided by Zoom. One
researcher carefully checked the accuracy of each transcript prior to the
start of the analysis.

Following Saldaña’s [76] coding approach, we conducted an in-depth thematic
analysis of our interview transcripts. First, two researchers coded three
transcripts independently. After discussing and incorporating the codes, we
created an initial codebook that the two researchers agreed on. Using the
initial codebook, one of the researchers coded ten of the remaining
transcripts, while the other coded the other seven. The two researchers
discussed their codes and resolved any conflicts through several weekly
meetings. Since the codebook was generated after multiple discussions, inter-
rater reliability was not necessary to be checked [77].

We created codes about parents’ concerns for children’s VR activity (e.g.,
privacy-related, physical health), parents’ mitigation strategies (e.g.,
proactive verbal education), and parents’ perceived responsible stakeholders
(e.g., VR companies, parents). Then, we merged similar codes and categorized
them into emerging themes and sub-themes. Eventually, our codebook consisted
of 13 themes, 95 sub-themes, and 613 codes.

Ethical considerations. This study was approved by the Institutional Review
Boards (IRB) of all participating institutions. No personally identifying
information was collected from participants. All audio recordings were
transcribed and further de-identified immediately after the interviews. We
also confirmed participants’ consent to participation prior to the interviews
and reserved their rights to withdraw at any time. During all stages of data
collection, including the pre-screening surveys, interviews, and compensation
surveys, participants had the right to withhold any information.

Limitations. Given our focus on parents’ role in children’s S&P in VR, we only
interviewed parents. We must admit that parents’ opinions could be skewed
without children’s input. However, prior work with a similar scope on parents’
technology mediation also adopted this approach out of ethical considerations
[23, 4]. Interviewing children and parents from the same family might lead to
problems such as intruding on children’s privacy from parents, embarrassment
and conflicts between children and parents, etc. [4]. Considering the ethical
conflicts and our focus, we chose to interview only parents and call for
future work to investigate children’s S&P perceptions and practices in VR.

As is typical with qualitative studies, our recruited sample size was
relatively small. The study relied on participants’ self-reported information,
which may be subject to social desirability bias. As a consequence, our
findings may not be generalizable to all parents of children who use VR. To
mitigate this issue, our recruitment was on a rolling basis as mentioned
earlier. We summarized the key insights after each interview and believed that
after the sixteenth interview, participants’ insights reached the thematic
saturation [78], i.e., no more new concepts or themes emerged. We then stopped
inviting more candidates other than the already scheduled ones. In doing so,
we attempted to cover as many diversified perspectives as possible for an
interview study.

##  4 Findings

We begin this section by reporting the demographics and VR usage of our
participants. Then, we report on parents’ perceptions of children’s S&P in VR
(RQ1). We then elucidate parents’ different mitigation strategies for
children’s S&P in VR (RQ2). Lastly, we show parents’ desired S&P-enhancing
features and actions in VR from different stakeholders (RQ3).

Parents’ demographics. Among the 20 participants (see Table I), six
participants were female and 14 participants were male. The age ranges of
participants included 25-34 years old (2), 35-44 years old (3), 45-54 years
old (13), and 55-64 years old (2). Participants self-identified as White (11),
Black or African American (4), Asian (4), and one participant preferred not to
say. In general, parents were highly educated with a bachelor’s (6),
professional degree beyond bachelor’s (1), master’s (9), or doctorate degree
(1). One participant had an associate’s degree and two participants had no
college-level degrees.

Although we did not require participants to specify their occupations, many of
them disclosed the industries where they worked during the interviews,
especially those working with VR/AR technologies and valuing S&P of
technologies in use. Among the 15 participants who disclosed their
professions, seven participants worked in technology companies, many of which
focused on VR/AR technology and/or valued the S&P of their products. Two
participants worked in finance and also had some expertise in S&P. Three
participants were K12 educators who had used VR as teaching materials or
worked in education technology companies. One participant was a game streamer
with a lot of experience with VR in general and social VR in particular. The
varied experiences of our participants provided us with rich and diversified
insights into how parents from different industries and backgrounds approached
their children’s S&P in VR. The VR usage details of our study participants and
their children are included in Tables II and III in Appendix B. The full
demographic details are specified in Table IV in Appendix C.

TABLE I: Parent participants’ and their child(ren)’s demographics. (*/: Prefer not to say.) ID | Age | Gender | Race | Child Ages | Child Genders
---|---|---|---|---|---
P1 | 55-64 | M | White | / | F
P2 | 35-44 | M | White | 6-7,8-9 | M,F
P3 | 45-54 | M | Asian | 14-15 | M
P4 | 25-34 | F | Black | 6-7,12-13 | M,F
P5 | 35-44 | M | White | 12-13 | M
P6 | 45-54 | M | / | 12-13 | /
P7 | 45-54 | M | White | 8-9,10-11 | M
P8 | 55-64 | M | White | 16-17 | M
P9 | 45-54 | F | White | 10-11,12-13 | M,F
P10 | 45-54 | M | Asian | 10-11,14-15 | M,F
P11 | 45-54 | M | Black | 10-11 | M
P12 | 45-54 | M | Asian | / | M
P13 | 45-54 | F | White | 12-13,14-15 | F
P14 | 45-54 | F | Black | 12-13,14-15 | M,F
P15 | 25-34 | F | White | 8-9 | M,F
P16 | 45-54 | F | White | 16-17 | M
P17 | 45-54 | M | Asian | 8-9 | F
P18 | 35-44 | M | White | 16-17 | M
P19 | 45-54 | M | Black | 16-17 | F
P20 | 45-54 | M | White | 12-13 | M

In-home VR ownership and parents’ usage. We only interviewed parents who had
VR devices in the household. We asked participants to self-describe the VR
devices they own in the screening survey and verified the ownership at the
beginning of the interview (see Table II in Appendix B). Almost all
participants (17) only owned one VR headset shared with other family members,
including children.

In the screening survey, parents chose their purposes of usage as gaming (16),
creativity (8), socialization (8), education (8), streaming and films (7),
health (6), and productivity/work (4). During the interviews, we also asked
participants how frequently they used VR. Seven participants reported their
frequency to be on a daily basis, eight participants were on a weekly basis,
three participants were on a quarter basis, and two participants were not
actively using VR at the time of the interview but indicated their children
were more active users.

Children’s demographics. Considering children’s privacy and the focus of this
study, we only asked parents to report the basic demographics of their
children and information relating to their S&P concerns in VR. As shown in
Table I, 10 children were female and 15 children were male. The age ranges of
children included 6-9 years old (6), 10-13 years old (11), and 14-17 years old
(8). Therefore, while most VR products are designed for users aged above 13
[79, 80, 81], most children in our sample (17) were below the recommended
minimum age for VR usage.

Children’s VR access and usage. Regarding children’s VR usage, we first asked
participants if they gave their children access to VR headsets. All
participants said their children had used VR headsets, with varying
frequencies. 10 children used VR on a weekly basis, 13 children used VR on a
monthly basis, and two children were no longer interested due to the weight of
the headset or motion sickness. While most parents (18) said they shared VR
headsets with their children, two parents with children aged 14-17 years old
said their children had their own headsets.

As shown in Table III in Appendix B, according to the parents, their
children’s purposes of VR usage included gaming (15), creativity (3),
education (4), socialization (2), health (2), streaming and watching movies
(1), others or unspecified (5).

Parents’ and children’s socialization in VR Particularly, since many S&P risks
in VR currently take place during social interaction [13, 36, 37], we also
asked participants to specify their socialization experiences in VR. 16
participants had at least tried social VR applications or connected with
others in VR. Ten participants only met people they already knew in real life,
including friends and family members. Six participants socialized with
strangers in VR. Notably, one participant was a VR streamer who regularly met
many new people in social VR.

By contrast, children’s access to social VR was greatly restricted by parents,
particularly for younger children. Only three participants whose children were
aged 16-17 or 8-9 years old said their children used VR for socialization. One
participant whose child was aged 12-13 years old planned to introduce his
child to social VR soon. Although most participants said their children had
not used VR for socialization, they had observed children’s conversations with
strangers in VR, mostly during gaming sessions. For children who had access to
social or multi-user applications in VR, their parents believed they
predominantly or exclusively interacted with children of similar ages or
people in their offline connections, e.g., family members, friends, etc.

These details about parents’ and children’s VR usage are crucial to
understanding parents’ awareness, attitudes, and coping strategies toward
children’s S&P risks in VR, which will be detailed in the remainder of this
paper.

###  4.1 Parents’ Perceptions of Children’s S&P Risks in VR (RQ1)

Due to our interview study’s small sample size in qualitative nature and our
goal to highlight emerging insights as opposed to generalizability, we adopt a
reporting method from a similar interview-based S&P study [82] and use their
frequency terminology throughout the remainder of the paper. Instead of using
exact numbers of participants, we use “none” (0%), “a few” (0%-25%), “some”
(25%-45%), “about half” (45%-55%), “most” (55%-75%), “almost all” (75%-100%),
and “all” (100%), when appropriate.

In response to RQ1, our findings highlight: (1) Parents generally lacked S&P
awareness in VR, largely due to the belief that VR is still in nascent
development and therefore risks are a “future thing.” (2) S&P risks were
regarded as potential risks, whereas the influence of VR on children’s
physical health was defined as real-life risks by parents. (3) Among the
identified S&P risks, parents generally had greater concerns in social
interaction contexts than data surveillance by companies. Although they could
still name a few risks from VR companies, they generally discarded such
concerns in practice.

####  4.1.1 Non-S&P Concerns as Parents’ Primary or Only Concern for
Children’s VR Usage

We asked parents about their concerns toward children’s VR usage without
priming them with our S&P focus. As a result, almost no parents brought up
concerns for S&P on their own initiative. Instead, they primarily mentioned
concerns for children’s physical health issues, online safety, and “bad
influences.”

Defining eye-sight and physical injuries as real-life risks. When answering
the question about general concerns for VR, most participants illustrated both
risk-life risks they had perceived or experienced from their own children and
potential risks they could imagine for other children or in future settings.
For real-life risks, most parents mentioned concerns about the influence of VR
on children’s eyesight. As P15 mentioned, “The only risk so far that we’ve had
is my son needs glasses now, but we don’t know if there’s a direct correlation
between the Oculus and his eyesight.”

Similarly, another participant P2 directly pointed out his “real-life”
concerns as opposed to “potential“ concerns:

  * “There’s the real-life risk of running into stuff or breaking things as kids get carried away within a particular environment. I don’t know if there are long-term risks. There are potential risks like data collection. Ideally, people are collecting data [in VR], but I just don’t know if they are.”

According to P15 and P2, physical injuries were defined as parents’ real-life
concerns. However, parents also recognized some “potential risks” like data
collection that they just had no way to directly confirm.

Stranger danger in a child-adult co-existing ecosystem. Similar to what prior
work has pointed out [4, 3, 40], the child-adult co-existence in VR was a
major safety concern of parents. P1 mentioned:

  * “The gameplay is high-action and fun. So it really appeals to all age groups. So the kids are in there playing with both adults and other kids…I don’t think that the companies are doing a good job of limiting it to just kids. They have a financial reason for wanting everybody to use their software.”

Some parents echoed P1, indicating their doubt about VR companies’ motive and
capability to separate children from adult users. According to participants,
the child-adult co-existence in the VR ecosystem could lead to many other
potential problems, including predators and cyberbullying.

P6, an active social VR user, said, “I suppose there could be a way you could
track where they (children) were actually if the person was a potential
predator. I’m sure there’s a way to track the IP of a VR device.” P6 had heard
of predators collecting IP addresses in social VR, and like some other parents
also mentioned, they would be afraid of children being lured to meet online
strangers in person, either voluntarily or involuntarily.

Besides predators, participants also mentioned that in an anonymous and
immersive environment, cyberbullying could be common and more viscerally
realistic. As P2 noted, “My largest concern would be, the potential for
bullying within open environments where you can encounter cyberbullying,
particularly with the potential lack of supervision.” Like P2, some
participants were well aware of the anonymity afforded by avatar-mediated
communication [83, 43, 84]. They perceived anonymous environments like VR to
be a place where cyberbullying was more likely. Worse yet, as P11 stated,
“[c]yberbullying becomes more visceral in VR (compared to text-based
cyberbullying).”.

Vigilance toward “bad influences.” Besides safety concerns, another frequently
mentioned concern was some bad influences from other VR users and the
environment designed chiefly for adults.

The first major type of bad influence was bad language in VR observed by
participants. A few participants said they had witnessed their children and
other children use a lot of bad language, e.g., curse words, racial terms,
etc. For instance, participant P16 stated:

  * “I don’t like a lot of foul language when they’re playing. So that’s the one thing I’ve monitored. If they’re playing with people who are using foul language, I tell them to get off.”

Besides the under-regulated bad language, the age-mixed environment in VR also
brought in the problem of inappropriate content, which has been documented in
existing literature [3]. Participants, especially those with social VR
experiences, said that the user-generated worlds were a big issue. Similar to
the perception that VR companies did a bad job limiting the age group of
users, participants also thought the mechanism of allowing users to upload
their own worlds could potentially introduce children to content that was not
designed for them.

Importantly, however, parents also noted that bad influences were not only
from adults but also from other children who used VR without parents’
monitoring. P14, who did not have much social VR experience, said she could
imagine “kids in VR might have families who have a different or opposite
thought process from us.” Therefore, P14 was very concerned about the “bad
influences” from other kids in VR.

P14’s concerns could be testified by prior work that reported children’s
bullying behavior in VR [3]. Toxic behaviors by children were also spotted by
other participants with social VR experience. According to P1, “For a few
times in public worlds, I’ve seen that it is obviously fairly young children
turned loose in this environment and not being monitored.” Echoing P1, P19
even blocked some children in VR. “I’ve learned how to kind of block some
children, because it was just, you know, so freewheeling that some children
feel like they’re uninhibited enough to do anything because you can’t see
them.”

In summary, parents were concerned about different types of bad influences
from a variety of actors in VR, including adults, children, and user-generated
environments.

####  4.1.2 S&P Concerns in Social Interaction Outweighed Data Surveillance

After asking participants about their general concerns, we specified our focus
on children’s S&P in VR. About half of the participants said that they had
never thought about the S&P issues in VR before. After being prompted,
participants were able to name some S&P risks given their prior experience
with other technologies. However, some participants would emphasize such
concerns hardly occurred to them during children’s use of VR. In comparison,
while some participants working in technology or S&P-related industries were
more concerned about data surveillance from companies than self-disclosure in
social interaction, most of the other participants were more concerned about
children’s self-disclosure in VR.

Parents showed awareness of headsets’ and apps’ data collection risks but
discarded the concerns in practice. For data S&P in VR, most parents mentioned
their concerns for biometric data collection and analyses for user profiling
and advertising purposes. Intriguingly, many children and family studies on
S&P-related issues with technology have found that families easily neglect
commercial data mining and surveillance in their S&P mental models [60, 16].
Our findings, however, show some progress that families have made in the
awareness of surveillance capitalism, as our participants covered the four
sensitive data types according to Dick [7], including observable data,
observed data, computed data, and associated data in VR (see Section 2). For
example, P20 said:

  * “[E]ye-tracking would be a big concern of mine. From an advertising and psychology perspective. How people think and what they’re looking at are correlated. We would only use products that use eye-tracking internally for system software purposes only.”

For participants like P20, cutting-edge technology such as eye-tracking could
collect physiological and behavioral signals, which could be more invasive
compared to their smartphone activity. Echoing P20, P18 mentioned, “I would
imagine there’s a lot more data that comes in when somebody’s interacting with
VR, so I think that’s the biggest privacy risk is how much neural information
you are giving up.” Besides “neural information”, participants were also
concerned about their voice data being collected by companies, due to the
expansion of AI that could be used to fabricate and manipulate voices.

Importantly, even though parents had an awareness of potential data collection
by VR companies, they generally discarded such concerns in their parenting
practices. As P1 highlighted,

  * “I’m more worried about their interactions with strangers than I am worried about advertisers…There are all kinds of people talking about how eye- and face-tracking can allow companies to know more about you…But I don’t know what they are going to do with it that we’re worried about. I have never found an answer.”

Although P1 acknowledged the risks of data collection by companies, he
believed that those risks were still very abstract and theoretical to
laypeople. He added, “A lot of people are doing a good job of presenting these
pieces are scary but not doing a good job of telling me why they’re scary…But
you know the risk of someone knowing your information.” We also noticed that a
lot of what other participants described as VR data S&P risks testified to
P1’s opinion. Participants knew that VR users gave out their biometric data
but could not describe the consequences. However, they were able to accurately
demonstrate example consequences (detailed below) of children’s self-
disclosure in VR.

Children’s self-disclosure in immersive environments was much more alarming.
Participants considered self-disclosure a huge risk for two main reasons: (1)
It is hard for children to understand the publicity of having conversations in
VR. (2) The nature of immersive environments and “cute avatars” might trick
children into giving out information as naturally as talking with friends in
person.

Participants with multiplayer or social VR experience reported their
experience encountering children voluntarily giving out information in public
worlds. P1 said, “If you were playing a game with a kid who knows a credit
card number, they would probably just tell you the number. That’s hypothetical
but I’ve seen many kids volunteer that sensitive information in VR.” P5
mentioned:

  * “In my experience, it doesn’t take much to know a kid’s private information. Sometimes when I go into rooms, I see kids share all the information publicly and voluntarily…Kids don’t understand that it’s just like standing on the street corner and shouting it.”

For P5, the publicity of conversations in VR is hard to be perceived as risky
by children as personal information disclosure is too common in VR.

In addition, some participants attributed children’s self-disclosure to the
immersion and avatars. P20 said, “Feeling immersed in VR might make it a more
likely scenario where children might disclose something to someone behind an
avatar.” Compared to data collection by companies, participants could describe
self-disclosure risks in VR in a much more vivid and specific way. They also
considered such risks much more “direct”, despite acknowledging the subtle and
potentially long-term risks of data surveillance in VR.

####  4.1.3 Reasons for Lack of Concerns: Being “Cutting-Edge” and “Harmless”

Interestingly, most participants said that they were not concerned about their
own children’s S&P in VR at the current stage because VR was still a
“privilege” and there were not many users in it to worry about, especially
compared to other more mature technologies like social media. Most parents of
teenagers (aged 13-17) also expressed their trust in their children’s maturity
in using technology. As a result, participants generally lacked S&P concerns
in practice, and therefore did not enforce many mitigation practices.

Parents lacked the motivation to fight a future thing. Some participants
mentioned that VR was still a privilege in its infancy. For this reason,
participants considered VR much less risky than some other social technologies
that are being used by a majority of people. As P20 explained,

  * “I’m way more concerned about social media…There’s not a whole lot of critical mass yet in VR, so things will probably change when everybody piles in.”

Similarly, a large portion of participants mentioned that the risks they
identified would not be concerning until some point in the future when VR
technology becomes much more advanced and popular than its current state.
Risks of VR are not “well-defined” at this point, as P1 said:

  * “The privacy problem in VR is more of a big future thing as they’re getting more and more information sometime in the future. It’s still a problem that’s very nebulous and not well-defined. So I have a hard time being motivated to fight it.”

P1 showed a state of mind inconsistent with his VR parenting practice,
demonstrating the existence of privacy paradox [85, 86]. Privacy paradox
refers to the discrepancies between users’ expressed privacy concerns and
their actual behavior. In our context, even though P1 knew the risks existed,
he still had little motivation to mitigate them in practice.

As a result, parents usually focused more on their children’s use of daily
technologies like social media, neglecting the harms of “future technology” –
VR.

Trust in children’s maturity in technology use. In addition to defining VR
risks as a future thing, some participants, most of whom were parents of
teenagers (aged 13-17), said that they were not concerned because their
children were tech-savvy and mature in their decision-making. As P14 said, “I
think at this point for him. He’s kind of on his path to becoming an adult. So
I’ve given him advice, and I’m kind of trusting that he’s gonna follow it.
He’s fairly mature for 16.” Similarly, other parents of children at a similar
age echoed P14 and believed their children’s familiarity with VR to have
surpassed theirs.

Some participants who were experienced in VR said that they suspected most
other parents would have bought VR just for babysitting their children without
having any knowledge of VR. As P1 said, “I don’t think parents understand that
there’s a shift there. It goes from being something that’s happening on a
screen in front of you to something that is happening to you.” P1 assumed that
many parents would consider VR the same as many other technologies like
phones, TVs, and tablets.

Indeed, when other participants discussed some risks of VR, they would
reference other daily technologies, like what P14 argued, “the risks are
pretty much the same in any type of technology.”

Some participants not only neglected the nuances between different
technologies, but they also regarded VR as a kind of video game that was just
the same as being played on a PC. Interestingly, participants were generally
much less concerned about their S&P when in gaming contexts. As P16 explained
why she did not worry about her son’s privacy in VR, “I am not concerned
because they’re just in this game mode. There’s nothing personal involved.”
For some participants like P16, gaming sessions were mostly about play and
involved very few privacy risks, hence lacking concerns.

Such an imbalanced understanding of technology between parents and children
has also been widely documented in existing literature [23, 24], impeding
parents’ ability to engage in teens’ technology use.

###  4.2 Parents’ S&P Risk Mitigation Strategies (RQ2)

Following Wisniewski et al.’s TOSS framework [22], our findings highlight: (1)
Parents primarily relied on active mediation, rules, and restrictions in
usage. (2) Parents generally considered parental controls in VR important but
faced significant technical constraints. (3) In mitigating S&P risks, parents
had to navigate complex tradeoffs between autonomy and safety.

####  4.2.1 Active Strategies as the Primary Strategy: Proactively Mitigating
Risks via Conversations and Rules

We asked participants what steps they had taken to address the concerns they
had, and almost all parents mentioned proactively educating children through
conversations and setting rules. However, most of them also emphasized that
these conversations and rules were not exclusive to their VR usage, hence
neglecting their ineffectiveness in certain contexts.

Parents emphasized online S&P issues to children, but not specific to VR. For
most families we interviewed, participants claimed that they valued online S&P
education for their children. Having enough conversations about online S&P was
also one of the reasons why participants were not concerned. For instance, P14
said:

  * “I put some rules down for my kids, and they’ve been pretty good about it. We’ve had discussions like, we don’t put any of your personal information out there. We don’t share real names, ages, birthdays.”

Participants like P14 who said they had strict rules and open conversations
with their children all claimed their children followed their guidance well.
However, P14 also emphasized that their rules were “pretty much the same
across any kind of electronic communication that can go outwards.”

While participants seemed to be generally confident and satisfied with their
approach, P7, who had more VR expertise was opposed to this approach and
believed that some physical references should be in place when educating
children about S&P in VR:

  * “We’ve had those conversations in the context of physical interactions. That makes more sense to kids. When they get on VR, in their head, they’re in a safe video game space. They’re not thinking, oh, that cartoon character could actually be a person who has ulterior motives like a stranger on a street.”

According to P7, although parents might have had sufficient privacy education
in general digital communications, the proximity between VR and real-life
interactions makes it more reasonable to set physical references in their VR
privacy education, as opposed to other digital communications in general.

Managing children’s app access and S&P information flows in VR through shared
and associated accounts. Unlike social media usage where children have
separate accounts from parents [87], most participants shared VR headsets and
accounts with their children. While this practice was not out of mitigation
considerations, some participants indicated that sharing headsets and accounts
helped them better manage children’s VR activity, including their access to
certain apps. For example, P14 mentioned:

  * “My kids’ accounts are linked to my email, so they have to go through us to buy an app. I can also see any kind of activity. Everything comes to me via email. So I still have a little bit of insight.”

In some cases, participants made sure to be present when their children tried
to create accounts, in case of providing excessive information for platforms.
As P10 noted, “I’m concerned about the phone number and other family
information going out. That’s why I keep my kids away from creating accounts
on their own without having us know.”

Hence, sharing accounts or creating ones under parents’ supervision was a
proactive strategy for parents to not only manage children’s app access but
also their information flows in the VR ecosystem.

####  4.2.2 Challenges in Passive Strategies: Technical Issues & Parents’
Frustrations

According to the TOSS framework [22], monitoring and parental controls fall
under passive mediation. Our study uncovered that parents faced a range of
challenges in their passive strategies, including parents’ technical
frustrations and children’s workarounds.

Maintaining ambient awareness 111Referencing [16], we use this term to
indicate parents’ casual monitoring when they are nearby their children when
using technology. as the most common monitoring strategy. Almost all
participants said they would occasionally check in with children when playing
VR, making sure to be able to hear the conversations. In addition, for
physical safety considerations, most participants would ask their children to
play in open areas like the living room. For example, P11 said:

  * “They basically play in the living room and I’d make sure the volume is loud enough to hear some of the stuff that’s being said.”

However, unless casting VR on a screen, parents would not be able to see what
their children do. While paying attention to the video sounds is also a more
common option for parents who monitor children using 2D media [16], VR was
much less flexible for our participants who would like to visually check out
their children. This constraint influenced parents’ practices and attitudes
toward different parental controls in VR, as we discuss below.

Parental controls in VR were important but posed technical constraints. In the
last section of our interviews, we asked participants to first indicate if
they know the feature, and then rate their anticipated effectiveness of each
parental control that we found in mainstream VR products.

Figure 1: Participants’ ratings for the anticipated effectiveness of each
parental control feature in VR.

As a result, 75% of participants had heard of setting passwords, 70% had heard
of blocking apps, 65% had heard of headset mirroring and playtime
restrictions, 60% had heard of social communication restrictions, and 55% had
heard of blocking specific content. While this result shows that most
participants had heard of these parental controls, their qualitative feedback
demonstrates that they had very little experience setting up these controls in
practice. For example, P20 said, “I don’t think I’ve used parental controls,
although I would kind of assume they exist.”

Some participants like P20 also said that they had never tried setting up
parental controls, but given their experience with other technology mediation,
they assumed they would be able to set them up.

For the anticipated effectiveness (see Figure 1), overall, headset mirroring
was rated as the most effective feature. As mentioned, without casting VR on a
screen (i.e., headset mirroring), parents would not be able to visually check
out their children’s VR activity. Consequently, headset mirroring was rated as
the most effective. However, participants who tried headset mirroring
highlighted its major drawbacks, including technical issues (e.g., high
latency and connection issues) and low engagement for parents. Specifically,
two participants said they discontinued the use of headset mirroring because
of the unstable connection. For engagement, some participants questioned
headset mirroring because they believed it would be unrealistic and not
engaging for parents to keep watching children for a long time. As P8 said,

  * “I’m not participating in anything (when looking at the headset mirroring). I’m simply there observing and spectating. So it’s of course, not an engaging experience for me. I would rather be doing something where we could do it together. But we don’t have a second headset.”

Besides headset mirroring, blocking apps and content were also highly rated,
due to their preventive nature favored by our participants. However, a few
participants also pointed out the limitation. As P17 mentioned, “Blocking is
not going to be effective. There’s always going to be something that you don’t
know about.”

To our surprise, while social communication was the most concerning privacy
risk to participants, restricting it was not the most effective feature for
participants. As P18 explained, “I mean, it’s a question that, if you want
your child to be able to communicate socially, it’ll be a kind of an all-or-
nothing thing.” While restricting social communication could prevent children
from interacting with strangers, it was also perceived as too limiting and
could not “help them learn to do things in the correct way.” (P18). Indeed,
passive mediation means stopping children from doing certain things while
hindering their chances of learning in practice. Navigating such tradeoffs
between children’s S&P and their autonomy was a hard process for our
participants (more detailed in 4.2.3).

For passwords and playtime restrictions, while participants found them
effective in directly stopping children from accessing VR, they also noted two
main drawbacks that discouraged them from using the two controls: (1) By
experience, children are likely to work them around and (2) these two controls
are too passive while increasing parents’ workload, e.g., having to unlock the
headset whenever children want to play.

####  4.2.3 Complex Tradeoffs Between Autonomy vs. S&P

One major discussion we had with our participants was how they weighed and
balanced their S&P mitigation practices and children’s autonomy in VR.
Participants held two different stances: 1) Some participants would rather
trade autonomy for children’s S&P in VR, while 2) most participants advocated
for more active approaches to support children’s autonomy, even at the cost of
potential safety and S&P risks.

Participants who preferred to trade autonomy for children’s S&P in VR
considered the latter more important mainly for two reasons. First, the
current VR ecosystem is largely designed for adults and children are more
likely to get into inappropriate situations at this point than later when VR
gets more mature. Hence, it is still too early to give children too much
autonomy. Second, VR is still a very minor part of most children’s lives, and
therefore they have plenty of opportunities to maintain their social autonomy
elsewhere, e.g., physical interaction contexts, smartphone usage, etc. As P1
noted:

  * “Today we’ve gotten to the point where having a phone and a tablet is necessary for you to be on par with your peers…VR is not that way right now…Kids have plenty of other places where they can have autonomy in social experiences…Today, I don’t see any problem with VR being completely restricted.”

On the other hand, participants who advocated for children’s autonomy even at
the cost of safety and S&P risks believed it would be more important for
children to gradually learn to tackle harmful situations with parents’
guidance. Using passive strategies would hinder children’s chances of learning
in the real world where parents cannot always keep them company.

Consequently, some participants advocating for the second stance claimed that
parents could only help them understand and prepare for potential risks
beforehand, whereas when real risks took place, they had to count on
themselves with more effective moderation or defensive mechanisms to be in
place – a gap that VR companies have the responsibilities to fill (detailed in
4.3). Importantly, most participants also emphasized that the balance between
autonomy and children’s S&P and safety in VR would be a dynamic process where
the significance of one and the other might be constantly changing in the long
run.

Overall, parents of children using VR might have to deal with a series of
complex and dynamic tradeoffs when trying to mitigate S&P risks in VR. This
finding echoes prior work that suggests managing children’s technology is like
other daily activities where parents’ strategies might be changing in a
“complex, contextual, and dialectic process.” [16, 88].

###  4.3 Responsible Stakeholders and Desired S&P-Enhancing Features (RQ3)

We asked participants to describe the responsibilities of different
stakeholders and features that they desired to enhance children’s S&P in VR.
Our findings suggest: (1) Participants generally agreed a multi-stakeholder
ecosystem must be established to make concerted efforts towards more S&P
support for children using VR, with parents being the most accountable
stakeholder. (2) While participants desired several features including real-
time feedback and alerts with regard to children’s S&P in VR, they also had
reservations about VR companies’ data surveillance.

A multisided VR ecosystem towards more S&P support for children. When naming
perceived stakeholders and their responsibilities in mitigating S&P risks for
children’s VR usage, all participants suggested more than one stakeholder.
Taking all participants’ opinions together, we summarized four main
stakeholders – parents, VR companies (including headsets and apps),
governments, and schools/educators.

Among the four parties, parents were identified as the most accountable. Some
participants expressed their concerns for adults’ lack of S&P understanding in
VR. For instance, P1 mentioned, “From what I’ve seen online, there are a lot
of parents handing their kids the VR without even trying VR for a few times.
As long as the kid is being quiet and entertained the parents aren’t paying
attention.” To understand the potential risks in VR, participants with more VR
experience highly suggested other parents also experience VR, preferably with
their children together. For example, P14 demonstrated how she tried VR with
her children for the first time:

  * “Let’s do it together the first time, so we can see, like what kind of experience and things we need to look out for…Just so we know some potential bad experiences.”

P14 said it would be essential for parents to go over the first-time VR
experience, gaining some firsthand insights into the potential risks. In doing
so, children would be more prepared when harmful situations take place.

Besides better knowing VR technology, another gap exists in parents’
understanding of the S&P practices across different VR products. We asked our
participants if they had ever read any privacy policies in VR platforms, and
almost all of them answered no, including those with more relevant expertise.
This was in part due to the low readability of the policies, but also because
of the inaccessibility of reading them through the headsets.

VR headset manufacturers and app companies (we combine them as “VR companies”
in this paper) were also considered largely responsible for mitigating the S&P
risks. In our interviews, a few participants expressed their concerns about
the conflicts between users’ privacy and companies’ business models. In
general, they believed that most of the existing S&P-enhancing efforts were
primarily for promoting their public image. Correspondingly, prior work has
also documented the trade-off that companies face between protecting
children’s privacy and sustaining their business models [89, 90, 91]. To
mitigate this concern, our participants suggested making S&P guidance part of
a mandatory step before the use. As P18 suggested, “I’d prefer if it was in
plain language with some short mandatory steps like watching a video… These
steps should be very upfront.” Making privacy guidance shorter, clearer,
mandatory, and upfront would be parents’ preferred practice, showing the
company’s real effort in making the products more S&P-centered.

Nevertheless, as participants noted, it would be hard for companies to
implement such practices as they might conflict with their business models. It
would be unrealistic to only count on companies and expect them to be all
moral without regulations. Hence, our participants believed that legal
regulations must be in place by government bodies to enhance supervision over
VR companies’ S&P practices.

Last, as a few participants pointed out, as VR becomes more and more
prevalent, schools and educators also have the responsibility of teaching
children about the nuances of data surveillance and self-disclosure in VR,
compared to other technologies.

Parents’ desired features and S&P considerations. The desired features
mentioned by participants included (1) real-time S&P alerts and feedback when
harmful interactions take place, (2) AI-based harm detection, (3) a secondary
app in place of headset mirroring, and (4) a general usage report sent
regularly, e.g., weekly reports, summarizing children’s basic VR activity.

As noted by participants, most of the existing moderation and defensive
mechanisms in VR are reactive, e.g., blocking and reporting. However, going
through the process of blocking and reporting was perceived as “worthless”, as
it would not make up for the damage and would take too much time to receive
feedback. As parents, our participants preferred to know immediately if
harmful interactions were taking place. Participants who were concerned about
bad influences also hoped to have red flags or alerts sent to them, e.g., an
indicator of bad language. However, these ideas also raised some participants’
concerns, mainly for companies’ data surveillance. As P18 explained:

  * “While that (real-time alerts) sounds like a really good idea, that would pretty much just be automatically consenting to a hundred percent monitoring of everything that’s being said.”

According to participants, the same concern also applied to AI-based harm
detection and secondary apps – all sounding helpful for parents to manage
risks more effectively at the price of volunteering more sensitive data to
companies.

A few participants proposed an alternative – sending parents reports with only
basic but essential information. In doing so, participants were still able to
get an insight into their children’s usage while not risking too much of their
privacy. Since participants did not reach an agreement on how this “basic but
essential” report mechanism should be designed in the interview, we will
propose our recommendations in Section 5.

##  5 Discussion

In summary, our work has found an alarming status quo where parents of
underage VR users generally demonstrate a lack of awareness regarding their
children’s S&P in VR due to their conceptions of VR as still being “cutting-
edge” and therefore “harmless” (RQ1). Despite parents’ lack of S&P awareness
in VR, they still carry out a series of general rules toward at-home
technology usage. Notably, when it comes to VR, parents primarily rely on
active strategies as opposed to passive ones that pose significant technical
constraints (RQ2). Finally, by prompting our participants in the interviews,
they collectively demonstrate a need for a multisided VR S&P-enhancing
ecosystem, with an emphasis on parents’ responsibilities and expectations
toward a series of S&P-enhancing features (RQ3). In the remainder of this
section, we first discuss how our work extends or contradicts prior work. With
the takeaways, we then discuss our recommendations for the critical
stakeholders, including parents, educators, VR companies, and governments.

Parents’ knowledge gap in VR led to their overgeneralization of S&P rules for
children in diverse contexts. While prior work on children in social VR has
collectively pointed out that parents have some S&P concerns for children in
VR [3, 4, 5], they did not specify parents’ reasons behind the (lacked)
concerns and risk mitigation strategies. Interestingly, one 2018 study on VR
users’ and developers’ perceptions of S&P in VR shows some similar findings,
including prioritizing health concerns over privacy and security [6]. This
shows consumers’ general S&P perceptions may not have evolved drastically over
the course of the past five years, urging a need to investigate more effective
S&P education, features, and policies regarding VR. Our work builds on this
stream of work by first revealing parents’ knowledge gap in VR and how it
raised S&P concerns for children, including blurring S&P rules across a broad
range of contexts.

Prior work has pointed out that parents’ incomplete understanding of
technology compared to children might impede parents’ ability to engage in
children’s technology use [23, 24]. As a result, parents might underestimate
the amount and type of technology use and online interaction by their
children, hence putting them at risk [92, 69, 68]. Similarly, while bystanders
in social VR have witnessed great risks for underage users [4], we noticed
that parents in our study, especially those with fewer VR experiences, claimed
that their perceived S&P risks would not apply to their own children at the
current stage (Section 4.1.1). Therefore, it is worth suspecting whether the
parents had underestimated children’s VR activity and S&P risks. Considering
our focus on parents’ S&P implications in VR, we did not interview the
children of our participants. This observation should be further studied by
involving child participants in future work.

Parents’ overgeneralization of S&P rules in all digital devices defer
addressing concerns to the future. An important finding of our work is that
parents overgeneralize their S&P rules across diverse contexts, including
sharing the same set of rules for all forms of digital communications (Section
4.2.1). Despite the fact that parents understand the potential of extensive
biometric data being collected in VR compared to other technologies [37, 13],
most of them still discard the differences in practice, especially those who
seldom or never use internet-enabled VR applications. We believe this
phenomenon may be attributed to parents’ lack of experience in using VR and
their knowledge gap in the nuances between VR and other technologies. We will
propose relevant recommendations for parents and educators later in this
section.

Another reason for this type of overgeneralization is that parents prioritize
children’s S&P in other everyday technologies such as social media (Section
4.1.1). For this reason, parents deferred addressing their S&P concerns in VR.
Interestingly, in a study of children’s S&P online in general (e.g., social
media) [16], parents still consider S&P risks as a future concern. Therefore,
we suggest that in addition to enhancing parents’ understanding of VR
technologies, there should be other measures to enhance S&P education itself
more effectively, such as setting physical references as accounted below.

Parents’ perceived differences in S&P risks between offline and VR settings
impede effective S&P education in VR. Prior work regarding other consumer
technologies has pointed out that parents blur S&P rules in offline and online
settings [23]. However, despite overgeneralizing S&P rules across different
technologies, most parents in our study understand the shift between S&P risks
in offline and VR settings, mainly due to the anonymity afforded by avatars
(Section 4.1.1). Parents are concerned about children being tricked by the
predators behind the attractive avatars.

Problematically, while most parents understand the differences between S&P
risks in offline settings and VR, the proximity in social interaction between
VR and face-to-face settings has been overlooked. Only P5 and P7 who have
substantial VR experiences educate their children about S&P risks in VR by
setting physical references or metaphors (Section 4.2.1). All the other
parents in our study primarily rely on their rules for other technologies,
e.g., not disclosing privacy when chatting with people online. However, text-
based communication is drastically different from voice chat in VR [43], which
resembles talking to friends in face-to-face scenarios. This shows a need to
set physical references or metaphors when educating children about S&P in VR.
As suggested by prior work [93, 94, 95, 96], physical metaphors are important
in improving S&P awareness and protective strategies. For example, food
nutrition labels serve as a physical metaphor for “privacy nutrition labels”,
better informing users of S&P-related information [82, 97, 98].

Parents’ complex tradeoffs between passive and active strategies raised
questions toward S&P controls in VR. Our work extends prior work that
discussed children’s autonomy and S&P in their technology use [92, 22, 99,
16], suggesting that parents navigate complex tradeoffs between children’s
autonomy and S&P in VR (Section 4.2.3). For example, even though parents are
largely concerned about children’s self-disclosure in social interaction, they
consider parental controls that restrict social communications to be less
useful because such an “all-or-nothing” approach would not help children learn
the correct tactics in practice (Section 4.2.2).

Notably, one difference between VR and other everyday technologies lies in the
fact that VR has not yet “gotten to the point where having a phone and a
tablet is necessary for you to be on par with your peers,” as highlighted by
P1. Due to this perceived difference, some parents consider maintaining
children’s S&P to be much more important than their autonomy in VR.

However, even if parents would prefer protecting children’s S&P over autonomy
in VR, they are still largely constrained by the existing S&P controls in VR,
due to their low usability, engagement, and granularity (Section 4.2.2). For
this issue, we will propose recommendations for VR companies later in this
section.

Recommendation 1: Parents and educators can enhance awareness of technological
nuances and physical metaphors in their S&P education. As mentioned earlier,
parents tend to overgeneralize their S&P rules in all digital devices (Section
4.2.1). Therefore, the first recommendation for both parents and educators
(public education for all and educators at school) is to enhance their
awareness of the nuances between VR and other technologies that they are
familiar with.

For parents, in particular, it is recommended to experience VR themselves as
much as possible. It would be even better if parents could maintain their
knowledge level about VR close to or even beyond their children’s. Since VR is
an immersive technology, the social experience and data collection might be
completely different from what they know about smartphones, trying out VR
themselves would be the best way for parents to understand the nuances. The
significance of parents’ firsthand experience is also obvious in our findings,
as participants with more VR experiences demonstrated better awareness and
richer insights.

The same recommendation also applies to educators. As school education has
already incorporated S&P risks in social media as part of the curriculum [23],
it is also crucial to list VR S&P risks in the agenda, especially for those
who utilize VR as an education technology [100, 101, 102, 12].

When educating children about S&P risks in VR, both parents and educators
should consider leveraging physical metaphors, as opposed to referencing other
digital devices. Prior work has suggested that children might perceive
physical contexts S&P riskier than online contexts [23]. It is therefore
highly recommended that parents and educators set more physical references
when informing children of the S&P risks in VR. For example, parents and
educators can compare talking in a public social VR world to shouting out loud
on a street, as P5 suggested in Section 4.1.2.

Figure 2: The recommendations for the main stakeholders in the multisided VR
ecosystem for children’s S&P.

Recommendation 2: VR companies should improve the S&P controls and guidance
for children and parents. Our findings also highlight that parents generally
find S&P controls unusable for parents and children themselves (Section 4.2.2
& 4.3). Parents also find it hard to read the privacy policies in VR (Section
4.3). Hence, we call for VR companies to re-design their S&P controls for both
children and parents, involving more engagement, granularity, and modality-
specific considerations. Drawing on our participants’ desired features
(Section 4.3), we also urge VR companies to provide better S&P guidance as a
part of the mandatory onboarding process.

To improve the usability of S&P controls in VR, two main problems must be
addressed – (1) technical constraints such as connection issues and high
latency, and (2) low engagement. Among a series of controls, parents find
headset mirroring most effective (Section 4.2.2). However, due to technical
issues, they also refrain from using this feature. In place of headset
mirroring, parents hope to use secondary apps accompanied by the VR product
(Section 4.3). The secondary app can not only just replace the functionality
of headset mirroring, but also provide real-time alerts and other features to
help parents gain more engagement while protecting their children in a more
timely manner.

Considering parents’ S&P concerns about these desired features, we are
proposing to also increase the granularity of S&P controls. Specifically,
since parents all have very different considerations when facing the tradeoffs
between children’s S&P from the company and strangers, S&P controls should
enable parents to set what exactly information they allow companies to
collect, analyze, and send real-time or periodic S&P alerts to parents.

In addition, almost all the parents in our study have never read the privacy
policies of VR products, showing an urgent need to improve the S&P guidance
for parents and children in VR. In short, S&P guidance in VR should be
modality-adapted, mandatory, and engaging. Indeed, reading lengthy policies in
VR can be difficult [103], and parents seldom search the S&P practices of VR
products using mobile phones or PCs. Therefore, it is necessary to adapt the
design of texts to best align with users’ reading preferences in VR,
considering text lengths, sizes, color contrasts, etc. [103].

Besides valuing users’ reading experiences in VR, other mechanisms include
having an interactive onboarding tutorial to introduce potential S&P-risky
scenarios and protective mechanisms. In particular, as prior work suggests
[5], a “straightforward and well-explained guideline” in line with minors’
literacy levels is important.

Recommendation 3: Governments should verify VR companies’ S&P promises without
overly hindering immersive experiences. Even though VR companies demonstrate
good S&P promises through updating their policies, parents still have concerns
about whether companies would fulfill the promises (Section 4.3). Therefore,
it is important for governments or law enforcement sectors to enhance auditing
over VR companies’ S&P practices.

On top of enforcing privacy laws to VR [11, 10], prior work has called for
policymakers to reform existing privacy laws such as COPPA [34] and HIPAA [35]
based on the unique affordances of VR such as immersion. While these policies
may be generalized to other technologies, they could overly hinder user
experiences in VR. Hence, our recommendation is also for the law sectors to
enhance their knowledge of VR and iterate privacy laws for VR while
supervising VR companies’ S&P practices.

##  6 Conclusion

This study presents an in-depth qualitative analysis of parents’ perceptions
and practices toward children’s S&P in VR. Our results highlight that parents
generally lack or discard S&P awareness in children’s use of VR. In mediating
children’s use of VR, parents currently primarily rely on active strategies
such as verbal education. Passive strategies, however, have been less
effective due to technical constraints. Parents also agree that multiple
stakeholders are responsible for mitigating S&P risks for children, with
parents being the most accountable stakeholders. To conclude, we propose
specific and actionable recommendations for the critical stakeholders.

## Acknowledgments

We thank Sparsha Perupalli and anonymous reviewers for their constructive
feedback. We also thank Iffat Anjum and Nazanin Sabri for helping with our
pilot interviews. We further thank our participants for their insightful
input. This material is based upon work supported in parts by a Meta Research
gift award. Any opinions, findings, conclusions, or recommendations expressed
in this material are those of the authors and do not necessarily reflect the
views of Meta Inc.

## References

  * [1] R. Bagheri, “Virtual reality: The real life consequences,” _UC Davis Bus. LJ_ , vol. 17, p. 101, 2016.
  * [2] R. Epp, D. Lin, and C.-P. Bezemer, “An empirical study of trends of popular virtual reality games and their complaints,” _IEEE Transactions on Games_ , vol. 13, no. 3, pp. 275–286, 2021.
  * [3] D. Maloney, G. Freeman, and A. Robb, “It is complicated: Interacting with children in social virtual reality,” in _2020 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW)_. IEEE, 2020, pp. 343–347.
  * [4] E. Deldari, D. Freed, J. Poveda, and Y. Yao, “An investigation of teenager experiences in social virtual reality from teenagers’, parents’, and bystanders’ perspectives,” in _Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023)_ , 2023, pp. 1–17.
  * [5] D. Maloney, G. Freeman, and A. Robb, “A virtual space for all: Exploring children’s experience in social virtual reality,” in _Proceedings of the Annual Symposium on Computer-Human Interaction in Play_ , 2020, pp. 472–483.
  * [6] D. Adams, A. Bah, C. Barwulor, N. Musaby, K. Pitkin, and E. M. Redmiles, “Ethics emerging: the story of privacy and security perceptions in virtual reality,” in _Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)_ , 2018, pp. 427–442.
  * [7] E. Dick, “Balancing user privacy and innovation in augmented and virtual reality,” Information Technology and Innovation Foundation, Tech. Rep., 2021.
  * [8] P. Caserman, A. Garcia-Agundez, R. Konrad, S. Göbel, and R. Steinmetz, “Real-time body tracking in virtual reality using a vive tracker,” _Virtual Reality_ , vol. 23, pp. 155–168, 2019.
  * [9] V. Clay, P. König, and S. Koenig, “Eye tracking in virtual reality,” _Journal of eye movement research_ , vol. 12, no. 1, 2019.
  * [10] G. Kelly, “Kids deserve better privacy in virtual reality,” Nov 2022. [Online]. Available: https://www.commonsensemedia.org/kids-action/articles/kids-deserve-better-privacy-in-virtual-reality
  * [11] N. Reed, “What are kids doing in the metaverse?” Mar 2022. [Online]. Available: https://www.commonsensemedia.org/kids-action/articles/what-are-kids-doing-in-the-metaverse
  * [12] A. Klein, “Common sense media says school vr tools violate privacy laws,” Nov 2022. [Online]. Available: https://www.govtech.com/education/k-12/common-sense-media-says-school-vr-tools-violate-privacy-laws
  * [13] D. Maloney, S. Zamanifard, and G. Freeman, “Anonymity vs. familiarity: Self-disclosure and privacy in social virtual reality,” in _Proceedings of the 26th ACM Symposium on Virtual Reality Software and Technology_ , 2020, pp. 1–9.
  * [14] S. Sorensen, “Protecting children’s right to privacy in the digital age: parents as trustees of children’s rights,” _Child. Legal Rts. J._ , vol. 36, p. 156, 2016.
  * [15] S. Livingstone, M. Stoilova, and R. Nandagiri, “Children’s data and privacy online: growing up in a digital age: an evidence review,” 2019.
  * [16] P. Kumar, S. M. Naik, U. R. Devkar, M. Chetty, T. L. Clegg, and J. Vitak, “’no telling passcodes out because they’re private’ understanding children’s mental models of privacy and security online,” _Proceedings of the ACM on Human-Computer Interaction_ , vol. 1, no. CSCW, pp. 1–21, 2017.
  * [17] W. Shin, J. Huh, and R. J. Faber, “Tweens’ online privacy risks and the role of parental mediation,” _Journal of Broadcasting & Electronic Media_, vol. 56, no. 4, pp. 632–649, 2012.
  * [18] S. Chai, S. Bagchi-Sen, C. Morrell, H. R. Rao, and S. J. Upadhyaya, “Internet and online information privacy: An exploratory study of preteens and early teens,” _IEEE Transactions on Professional Communication_ , vol. 52, no. 2, pp. 167–182, 2009.
  * [19] D. Boyd and A. E. Marwick, “Social privacy in networked publics: Teens’ attitudes, practices, and strategies,” in _A decade in internet time: Symposium on the dynamics of the internet and society_ , 2011.
  * [20] L. Zhang-Kennedy, C. Mekhail, Y. Abdelaziz, and S. Chiasson, “From nosy little brothers to stranger-danger: Children and parents’ perception of mobile threats,” in _Proceedings of the The 15th International Conference on Interaction Design and Children_ , 2016, pp. 388–399.
  * [21] P. Wisniewski, H. Jia, H. Xu, M. B. Rosson, and J. M. Carroll, “” preventative” vs.” reactive” how parental mediation influences teens’ social media privacy behaviors,” in _Proceedings of the 18th ACM conference on computer supported cooperative work & social computing_, 2015, pp. 302–316.
  * [22] P. Wisniewski, A. K. Ghosh, H. Xu, M. B. Rosson, and J. M. Carroll, “Parental control vs. teen self-regulation: Is there a middle ground for mobile online safety?” in _Proceedings of the 2017 ACM Conference on Computer Supported Cooperative Work and Social Computing_ , 2017, pp. 51–69.
  * [23] L. F. Cranor, A. L. Durity, A. Marsh, and B. Ur, “$\\{$Parents’$\\}$ and $\\{$Teens’$\\}$ perspectives on privacy in a $\\{$Technology-Filled$\\}$ world,” in _10th Symposium On Usable Privacy and Security (SOUPS 2014)_ , 2014, pp. 19–35.
  * [24] P. J. Wisniewski, H. Xu, M. B. Rosson, and J. M. Carroll, “Adolescent online safety: the” moral” of the story,” in _Proceedings of the 17th ACM conference on Computer supported cooperative work & social computing_, 2014, pp. 1258–1271.
  * [25] A. Hiniker, S. Y. Schoenebeck, and J. A. Kientz, “Not at the dinner table: Parents’ and children’s perspectives on family technology rules,” in _Proceedings of the 19th ACM conference on computer-supported cooperative work & social computing_, 2016, pp. 1376–1389.
  * [26] M. Akter, L. Alghamdi, J. Kropczynski, H. R. Lipford, and P. J. Wisniewski, “It takes a village: A case for including extended family members in the joint oversight of family-based privacy and security for mobile smartphones,” in _Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems_ , 2023, pp. 1–7.
  * [27] M. Akter, A. J. Godfrey, J. Kropczynski, H. R. Lipford, and P. J. Wisniewski, “From parental control to joint family oversight: Can parents and teens manage mobile online safety and privacy as equals?” _Proceedings of the ACM on Human-Computer Interaction_ , vol. 6, no. CSCW1, pp. 1–28, 2022.
  * [28] F. O’Brolcháin, T. Jacquemard, D. Monaghan, N. O’Connor, P. Novitzky, and B. Gordijn, “The convergence of virtual reality and social networks: threats to privacy and autonomy,” _Science and engineering ethics_ , vol. 22, pp. 1–29, 2016.
  * [29] B. Heller, “Reimagining reality: human rights and immersive technology,” _Harvard Carr Center Discussion Paper Series_ , 2020.
  * [30] A. Bar-Zeev, “The eyes are the prize: Eye-tracking technology is advertising’s holy grail,” _Retrieved April_ , vol. 22, p. 2020, 2019.
  * [31] J. L. Kröger, O. H.-M. Lutz, and F. Müller, “What does your gaze reveal about you? on the privacy implications of eye tracking,” _Privacy and Identity Management. Data for Better Living: AI and Privacy: 14th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2. 2 International Summer School, Windisch, Switzerland, August 19–23, 2019, Revised Selected Papers 14_ , pp. 226–241, 2020.
  * [32] N. Acosta, “Are ip addresses ‘personal information’under ccpa?” _IAPP Privacy Advisor, April_ , vol. 28, 2020.
  * [33] X. S. Initiative, “The xrsi privacy framework,” 2020.
  * [34] K. Pearlman, X. Initiative, S. Visner, M. Magnano, and R. Cameron, “Securing the metaverse-virtual worlds need real governance,” _Simulation Interoperability Standards Organization–SISO_ , 2021.
  * [35] A. Gallardo, C. Choy, J. Juneja, E. Bozkir, C. Cobb, L. Bauer, and L. Cranor, “Speculative privacy concerns about ar glasses data collection,” _Proceedings on Privacy Enhancing Technologies_ , vol. 4, pp. 416–435, 2023.
  * [36] Q. Zheng, S. Xu, L. Wang, Y. Tang, R. C. Salvi, G. Freeman, and Y. Huang, “Understanding safety risks and safety design in social vr environments,” _Proceedings of the ACM on Human-Computer Interaction_ , vol. 7, no. CSCW1, pp. 1–37, 2023.
  * [37] P. Sykownik, D. Maloney, G. Freeman, and M. Masuch, “Something personal from the metaverse: goals, topics, and contextual factors of self-disclosure in commercial social vr,” in _Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems_ , 2022, pp. 1–17.
  * [38] J. McVeigh-Schultz, A. Kolesnichenko, and K. Isbister, “Shaping pro-social interaction in vr: an emerging design framework,” in _Proceedings of the 2019 CHI conference on human factors in computing systems_ , 2019, pp. 1–12.
  * [39] J. McVeigh-Schultz, E. Márquez Segura, N. Merrill, and K. Isbister, “What’s it mean to” be social” in vr? mapping the social vr design ecology,” in _Proceedings of the 2018 ACM Conference Companion Publication on Designing Interactive Systems_ , 2018, pp. 289–294.
  * [40] D. Maloney, G. Freeman, and A. Robb, “Stay connected in an immersive world: Why teenagers engage in social virtual reality,” in _Interaction Design and Children_ , 2021, pp. 69–79.
  * [41] L. Blackwell, N. Ellison, N. Elliott-Deflo, and R. Schwartz, “Harassment in social vr: Implications for design,” in _2019 IEEE Conference on Virtual Reality and 3D User Interfaces (VR)_. IEEE, 2019, pp. 854–855.
  * [42] K. Shriram and R. Schwartz, “All are welcome: Using vr ethnography to explore harassment behavior in immersive social virtual reality,” in _2017 IEEE Virtual Reality (VR)_. IEEE, 2017, pp. 225–226.
  * [43] D. Maloney, G. Freeman, and D. Y. Wohn, “” talking without a voice” understanding non-verbal communication in social virtual reality,” _Proceedings of the ACM on Human-Computer Interaction_ , vol. 4, no. CSCW2, pp. 1–25, 2020.
  * [44] N. Sabri, B. Chen, A. Teoh, S. P. Dow, K. Vaccaro, and M. Elsherief, “Challenges of moderating social virtual reality,” in _Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems_ , 2023, pp. 1–20.
  * [45] S. Youn, “Parental influence and teens’ attitude toward online privacy protection,” _Journal of Consumer Affairs_ , vol. 42, no. 3, pp. 362–388, 2008.
  * [46] W. Shin and H. Kang, “Adolescents’ privacy concerns and information disclosure online: The role of parents and the internet,” _Computers in Human Behavior_ , vol. 54, pp. 114–123, 2016.
  * [47] H. Nissenbaum, _Privacy in context: Technology, policy, and the integrity of social life_. Stanford University Press, 2020.
  * [48] P. Kumar, J. Vitak, M. Chetty, T. L. Clegg, J. Yang, B. McNally, and E. Bonsignore, “Co-designing online privacy-related games and stories with children,” in _Proceedings of the 17th ACM conference on interaction design and children_ , 2018, pp. 67–79.
  * [49] A. N. Joinson, C. B. Paine _et al._ , “Self-disclosure, privacy and the internet,” _The Oxford handbook of Internet psychology_ , vol. 2374252, pp. 237–252, 2007.
  * [50] N. C. Krämer and J. Schäwel, “Mastering the challenge of balancing self-disclosure and privacy in social media,” _Current opinion in psychology_ , vol. 31, pp. 67–71, 2020.
  * [51] C. Hallam and G. Zanella, “Online self-disclosure: The privacy paradox explained as a temporally discounted balance between concerns and rewards,” _Computers in Human Behavior_ , vol. 68, pp. 217–227, 2017.
  * [52] H. Krasnova, E. Kolesnikova, and O. Guenther, “” it won’t happen to me!”: self-disclosure in online social networks,” 2009.
  * [53] J. Nolan, K. Raynes-Goldie, and M. McBride, “The stranger danger: Exploring surveillance, autonomy, and privacy in children’s use of social media.” _Canadian Children_ , vol. 36, no. 2, 2011.
  * [54] K. Subrahmanyam, R. E. Kraut, P. M. Greenfield, and E. F. Gross, “The impact of home computer use on children’s activities and development,” _The future of children_ , pp. 123–144, 2000.
  * [55] S. Livingstone, J. Davidson, J. Bryce, S. Batool, C. Haughton, and A. Nandi, “Children’s online activities, risks and safety: a literature review by the ukccis evidence group,” 2017.
  * [56] S. Livingstone and P. K. Smith, “Annual research review: Harms experienced by child users of online and mobile technologies: The nature, prevalence and management of sexual and aggressive risks in the digital age,” _Journal of child psychology and psychiatry_ , vol. 55, no. 6, pp. 635–654, 2014.
  * [57] L. Palen and P. Dourish, “Unpacking” privacy” for a networked world,” in _Proceedings of the SIGCHI conference on Human factors in computing systems_ , 2003, pp. 129–136.
  * [58] S. Livingstone, “Children’s privacy online: experimenting with boundaries within and beyond the family,” 2006.
  * [59] H. J. Smith, T. Dinev, and H. Xu, “Information privacy research: an interdisciplinary review,” _MIS quarterly_ , pp. 989–1015, 2011.
  * [60] K. Sun, C. Sugatan, T. Afnan, H. Simon, S. A. Gelman, J. Radesky, and F. Schaub, ““they see you’re a girl if you pick a pink robot with a skirt”: A qualitative study of how children conceptualize data processing and digital privacy risks,” in _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_ , 2021, pp. 1–34.
  * [61] B. Shmueli and A. Blecher-Prigat, “Privacy for children,” _Colum. Hum. Rts. L. Rev._ , vol. 42, p. 759, 2010.
  * [62] S. Livingstone, “Developing social media literacy: How children learn to interpret risky opportunities on social network sites,” _Communications_ , vol. 39, no. 3, pp. 283–303, 2014.
  * [63] J. C. Yip, K. Sobel, X. Gao, A. M. Hishikawa, A. Lim, L. Meng, R. F. Ofiana, J. Park, and A. Hiniker, “Laughing is scary, but farting is cute: A conceptual model of children’s perspectives of creepy technologies,” in _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_ , 2019, pp. 1–15.
  * [64] Y. Feng and W. Xie, “Teens’ concern for privacy when using social networking sites: An analysis of socialization agents and relationships with privacy-protecting behaviors,” _Computers in Human Behavior_ , vol. 33, pp. 153–162, 2014.
  * [65] A. Bowyer, K. Montague, S. Wheater, R. McGovern, R. Lingam, and M. Balaam, “Understanding the family perspective on the storage, sharing and handling of family civic data,” in _Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems_ , 2018, pp. 1–13.
  * [66] A. Duerager and S. Livingstone, “How can parents support children’s internet safety?” 2012.
  * [67] M. Madden, S. Cortesi, U. Gasser, A. Lenhart, and M. Duggan, “Parents, teens, and online privacy.” _Pew internet & American life project_, 2012.
  * [68] P. Wisniewski, H. Xu, M. B. Rosson, and J. M. Carroll, “Parents just don’t understand: Why teens don’t talk to parents about their online risk experiences,” in _Proceedings of the 2017 ACM conference on computer supported cooperative work and social computing_ , 2017, pp. 523–540.
  * [69] L. Blackwell, E. Gardiner, and S. Schoenebeck, “Managing expectations: Technology tensions among parents and teens,” in _Proceedings of the 19th ACM Conference on Computer-Supported Cooperative Work & Social Computing_, 2016, pp. 1390–1401.
  * [70] S. T. Hawk, L. Keijsers, W. W. Hale III, and W. Meeus, “Mind your own business! longitudinal relations between perceived privacy invasion and adolescent-parent conflict.” _Journal of Family Psychology_ , vol. 23, no. 4, p. 511, 2009.
  * [71] S. Livingstone and M. Bober, “Regulating the internet at home: contrasting the perspectives of children and parents,” in _Digital generations_. Routledge, 2013, pp. 93–113.
  * [72] J. G. Smetana, ““it’s 10 o’clock: Do you know where your children are?” recent advances in understanding parental monitoring and adolescents’ information management,” _Child Development Perspectives_ , vol. 2, no. 1, pp. 19–25, 2008.
  * [73] B. Teitell, “In digital world, kids gain the upper hand,” _Boston Globe, September_ , vol. 5, 2013.
  * [74] R. Jääskeläinen, “Think-aloud protocol,” _Handbook of translation studies_ , vol. 1, pp. 371–374, 2010.
  * [75] [Online]. Available: https://www.qualtrics.com/
  * [76] J. Saldaña, _The coding manual for qualitative researchers_. sage, 2021.
  * [77] N. McDonald, S. Schoenebeck, and A. Forte, “Reliability and inter-rater reliability in qualitative research: Norms and guidelines for cscw and hci practice,” _Proceedings of the ACM on human-computer interaction_ , vol. 3, no. CSCW, pp. 1–23, 2019.
  * [78] A. Strauss and J. Corbin, “Basics of qualitative research techniques,” 1998.
  * [79] S. Steinberg, “Parent’s guide to vr headsets and vr games for kids,” Jun 2023. [Online]. Available: https://www.verizon.com/about/parenting/parents-guide-vr-headsets-and-vr-games-kids
  * [80] E. Gent and LiveScience, “Are virtual reality headsets safe for children?” Dec 2016. [Online]. Available: https://www.scientificamerican.com/article/are-virtual-reality-headsets-safe-for-children/
  * [81] M. Jay, “What parents need to know about vr,” Apr 2023. [Online]. Available: https://www.esrb.org/blog/what-parents-need-to-know-about-vr/
  * [82] P. Emami-Naeini, H. Dixon, Y. Agarwal, and L. F. Cranor, “Exploring how privacy and security factor into iot device purchase behavior,” in _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_ , 2019, pp. 1–12.
  * [83] S. Baker, J. Waycott, R. Carrasco, R. M. Kelly, A. J. Jones, J. Lilley, B. Dow, F. Batchelor, T. Hoang, and F. Vetere, “Avatar-mediated communication in social vr: an in-depth exploration of older adult interaction in an emerging communication platform,” in _Proceedings of the 2021 CHI conference on human factors in computing systems_ , 2021, pp. 1–13.
  * [84] K. Fu, Y. Chen, J. Cao, X. Tong, and R. LC, “” i am a mirror dweller”: Probing the unique strategies users take to communicate in the context of mirrors in social virtual reality,” in _Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems_ , 2023, pp. 1–19.
  * [85] S. Barth and M. D. De Jong, “The privacy paradox–investigating discrepancies between expressed privacy concerns and actual online behavior–a systematic literature review,” _Telematics and informatics_ , vol. 34, no. 7, pp. 1038–1058, 2017.
  * [86] P. Wisniewski, “The privacy paradox of adolescent online safety: A matter of risk prevention or risk resilience?” _IEEE Security & Privacy_, vol. 16, no. 2, pp. 86–90, 2018.
  * [87] S. Yardi and A. Bruckman, “Social and technical challenges in parenting teens’ social media use,” in _Proceedings of the SIGCHI conference on human factors in computing systems_ , 2011, pp. 3237–3246.
  * [88] M. Mazmanian and S. Lanette, “” okay, one more episode” an ethnography of parenting in the digital age,” in _Proceedings of the 2017 ACM conference on computer supported cooperative work and social computing_ , 2017, pp. 2273–2286.
  * [89] A. Ekambaranathan, J. Zhao, and M. Van Kleek, “Understanding value and design choices made by android family app developers,” in _Extended Abstracts of the 2020 CHI Conference on Human Factors in Computing Systems_ , 2020, pp. 1–10.
  * [90] A. Ekambaranathan, J. Zhao, and M. Van Kleek, ““money makes the world go around”: Identifying barriers to better privacy in children’s apps from developers’ perspectives,” in _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_ , 2021, pp. 1–15.
  * [91] A. Ekambaranathan, J. Zhao, and M. Van Kleek, “How can we design privacy-friendly apps for children? using a research through design process to understand developers’ needs and challenges,” _Proceedings of the ACM on Human-Computer Interaction_ , vol. 7, no. CSCW2, pp. 1–29, 2023.
  * [92] A. K. Ghosh, K. Badillo-Urquiola, S. Guha, J. J. LaViola Jr, and P. J. Wisniewski, “Safety vs. surveillance: what children have to say about mobile apps for parental control,” in _Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems_ , 2018, pp. 1–14.
  * [93] J. Li, K. Sun, B. S. Huff, A. M. Bierley, Y. Kim, F. Schaub, and K. Fawaz, ““it’s up to the consumer to be smart”: Understanding the security and privacy attitudes of smart home users on reddit,” in _IEEE Symposium on Security and Privacy (SP)(SP)_. IEEE Computer Society Los Alamitos, CA, 2023, pp. 380–396.
  * [94] J. Holvast, “History of privacy,” in _The history of information security_. Elsevier, 2007, pp. 737–769.
  * [95] N. Malazizi, H. Alipour, and H. Olya, “Risk perceptions of airbnb hosts: Evidence from a mediterranean island,” _Sustainability_ , vol. 10, no. 5, p. 1349, 2018.
  * [96] P. M. Regan, “Privacy as a common good in the digital world,” _Information, Communication & Society_, vol. 5, no. 3, pp. 382–405, 2002.
  * [97] P. Emami-Naeini, Y. Agarwal, L. F. Cranor, and H. Hibshi, “Ask the experts: What should be on an iot privacy and security label?” in _2020 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2020, pp. 447–464.
  * [98] P. Emami-Naeini, J. Dheenadhayalan, Y. Agarwal, and L. F. Cranor, “Which privacy and security attributes most impact consumers’ risk perception and willingness to purchase iot devices?” in _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2021, pp. 519–536.
  * [99] M. Wolfe, “Childhood and privacy. altman, i. and wohmill, jf children and the environment,” 1978.
  * [100] E. A.-L. Lee and K. W. Wong, “A review of using virtual reality for learning,” _Transactions on edutainment I_ , pp. 231–241, 2008.
  * [101] S. Helsel, “Virtual reality and education,” _Educational Technology_ , vol. 32, no. 5, pp. 38–42, 1992.
  * [102] V. S. Pantelidis, “Virtual reality in the classroom,” _Educational technology_ , vol. 33, no. 4, pp. 23–27, 1993.
  * [103] T. Kojić, D. Ali, R. Greinacher, S. Möller, and J.-N. Voigt-Antons, “User experience of reading in virtual reality—finding values for text distance, size and contrast,” in _2020 Twelfth International Conference on Quality of Multimedia Experience (QoMEX)_. IEEE, 2020, pp. 1–6.

##  Appendix A Interview Protocol

###  A.1 Introduction

Hi there! Thank you for participating in our study! My name is [NAME] and this
is [NAME]. In this interview, I will be asking you about your usage of VR and
your children’s usage of VR.

Before we get started, do you have any questions about the consent form that
you signed? [If yes, answer the questions].

Before we begin the interview session, can you please show me your VR
headset(s) to the camera? [If they decline, politely convey that we cannot
continue the interview process]. As mentioned in the consent form, we would
like to audio-record this interview for analysis purpose. We will keep our
video on throughout the interview process; but it is completely up to you if
you would like to have your video on or off. Could you please confirm that you
allow us to audio-record this interview? [Start the audio recording].

We will use the term “children” in general, but if your response would be
different for any specific child of yours, please feel free to let us know. We
are very interested in understanding this. Thank you again. Let’s get started!

###  A.2 VR Usage

Parent’s Use of VR

  * •

Do you use VR?

  * •

Could you please tell us the purposes for which you use VR?

  * •

Could you please name the VR apps that you use?

  * •

How long have you been using VR and how often do you use VR?

Children’s Use of VR

  * •

Does any of your children under the age of 18 use VR?

  * •

Could you please tell us the purposes for which your children use VR?

  * •

Could you please name the VR apps that your children use?

  * •

Since what age have your children started using VR, and how often do they use
VR?

###  A.3 Parents’ Perceived Risks of Children’s Use of VR in General

  * •

What group or demographic do your children usually interact with on VR? In
terms of their age, gender, race, education, or any other demographic
information that you have.

  * •

From your perspective, what are the potential risks to (your) children because
of using VR?

  * •

What has made you perceive these potential risks to (your) children’s use of
VR? How / in what way?

  * •

Who do you think is responsible for mitigating the potential risks? Please
name any individuals, groups, or institutions that you perceive to be
responsible for mitigating the risks for children.

  * •

What are these stakeholders’ responsibilities in mitigating the potential
risks?

###  A.4 Parents’ Perceived Concerns Toward Their Children’s S&P in VR

  * •

On a scale of 1 to 5, one being not at all concerned and five being very
concerned, how concerned about security and privacy regarding your children’s
use of VR?

    * –

If “Not at all concerned”:
What makes you not at all concerned about your children’s use of VR?

    * –

If concerned:
What makes you concerned about your children’s use of VR?

  * •

Have you ever had any privacy or security concerns about (your) children’s use
of VR?

    * –

If yes:
What privacy or security concerns do you have about (your) children’s use of
VR?

    * –

If no:
What privacy or security risks do you imagine there would be?

###  A.5 Parents’ S&P Protective Practices Toward Their Children’s Use of VR

  * •

Have you ever taken any steps to address your concerns about your children’s
use of VR? If yes, please tell us what actions you have taken and why? (ex: do
you monitor them)

    * –

How do your children react / respond to these steps?

  * •

Have you ever read about the privacy practices of the VR platform that (your)
children interact with? The platform includes VR apps as well as a VR headset.
Where did you get this information?

    * –

Have you been satisfied with the information you found? What additional
information about the privacy and security practices of the VR platform would
you like to know about?

    * –

How would you like this information to be presented to you?

  * •

Have your children ever talked to you about their experience with using VR?
What was the conversation about?

  * •

Have you ever discussed the privacy risks of VR with your children?
If yes:

    * –

Could you please tell us about such conversations? For example, what topics
did you talk about, and how did your children perceive the conversation?

    * –

Did you observe any changes in your children’s interaction with VR after such
conversations, and if yes, in what way?

If yes/no:

    * –

What is your perspective on the impact of having such a conversation with your
children?

That brings us to the end of our session today! To record your completion of
the interview, can you please fill out the compensation survey? (share link)

###  A.6 Live survey about parental control features

Parental Control Features

  * •

Headset mirroring

  * •

Set passwords

  * •

Block content

  * •

Block apps

  * •

Restrict playtime

  * •

Restrict social communication

For each feature, we asked parents two questions as follows:

  * •

Have you heard of this feature?

    * –

Yes

    * –

No

  * •

How effective do you think this feature is?

    * –

Not effective at all

    * –

Slightly effective

    * –

Moderately effective

    * –

Very effective

    * –

Extremely effective

##  Appendix B Parent Participants’ and Their Child(ren)’s VR Usage

TABLE II: Parents’ VR usage. ID | VR Device Ownership | Parent Purposes of Usage | Others
---|---|---|---
P1 | Meta Quest Pro | Creativity, Education, Gaming, Health, Productivity, Socialization, Streaming |
P2 | Meta | Gaming, Other (please specify) | Work
P3 | Meta Quest 2 | Gaming, Other (please specify) | Exploration of VR
P4 | Oculus | Creativity, Education, Gaming, Productivity, Socialization |
P5 | Meta Quest 2 | Gaming, Health, Socialization, Streaming |
P6 | Meta Quest 2 | Creativity, Gaming, Socialization |
P7 | Meta Quest | Gaming |
P8 | Meta Oculus Quest 2 | Creativity, Education, Gaming, Health, Streaming, Other (please specify) |
P9 | DEVASCO & Bnext | Creativity, Education, Health, Other (please specify) | Virtual tours
P10 | Oculus, Google Cardboard | Education |
P11 | Oculus, Microsoft Hololens | Creativity, Education, Gaming, Productivity, Other (please specify) | Product training
P12 | Oculus | Creativity, Gaming, Socialization, Streaming |
P13 | Oculus | Gaming, Health |
P14 | Oculus Meta Quest | Gaming |
P15 | Oculus | Gaming, Socialization |
P16 | Oculus Quest 2 | Education, Streaming |
P17 | Meta Oculus | Education, Streaming |
P18 | Oculus | Gaming |
P19 | Oculus Quest 2 | Education, Gaming, Health, Socialization, Streaming |
P20 | Oculus | Creativity, Gaming, Socialization, Streaming |
TABLE III: Children’s VR usage. ID | Child Purposes of Usage | Others
---|---|---
P1 | Unspecified |
P2 | Other (please specify) | No longer interested
P3 | Gaming |
P4 | Creativity, Education, Gaming |
P5 | Gaming |
P6 | Other (please specify) | No longer interested
P7 | Gaming |
P8 | Creativity, Education, Gaming, Socialization |
P9 | Creativity, Education, Health, Other (please specify) | Virtual field trips
P10 | Education, Gaming |
P11 | Gaming |
P12 | Unspecified |
P13 | Gaming, Health |
P14 | Gaming |
P15 | Gaming, Socialization |
P16 | Gaming |
P17 | Gaming, Streaming |
P18 | Gaming |
P19 | Gaming |
P20 | Gaming |

##  Appendix C Interview Participants’ Full Demographics

TABLE IV: Parents’ age, gender, race, and education background distributions. Age |  | Gender |  | Race |  | Education Background |
---|---|---|---|---|---|---|---
25-34 | 10% | M | 70% | White | 55% | Doctorate degree | 5%
35-44 | 15% | F | 30% | Black | 20% | Master’s degree | 45%
45-54 | 65% |  |  | Asian | 20% | Professional degree | 5%
55-64 | 10% |  |  | Prefer not to say | 5% | Bachelor’s degree | 30%
|  |  |  |  |  | Associate’s degree | 5%
|  |  |  |  |  | 1 or more years of college credit, no degree | 5%
|  |  |  |  |  | Regular high school diploma | 5%