Understanding Parents' Perceptions and Practices Toward Children's Security and Privacy in Virtual Reality

Understanding Parents' Perceptions and Practices Toward Children's Security and Privacy in Virtual Reality

Speakers: Jiaxun Cao; Abhinaya S B; Anupam Das; Pardis Emami-Naeini

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=otlQ40-SWu4

Overview

This talk, presented by Jiaxun Cao from Duke University on behalf of co-authors Abhinaya S B, Anupam Das, and Pardis Emami-Naeini, delves into a critical and under-researched area: parents' understanding and management of their children's security and privacy (S&P) within Virtual Reality (VR) environments. With the rapid increase in children under 18 engaging with VR technologies and companies actively working to lower age limits for usage, concerns surrounding children's digital well-being and safety have escalated. While much prior research has focused on general well-being issues like harassment and inappropriate content in VR's age-mixed environments, the specific S&P risks and parental mitigation strategies have remained largely unexplored.

The core of this research addresses a significant knowledge gap, aiming to provide empirical insights into how parents perceive VR-specific S&P threats, what strategies they employ, and their expectations for future VR platforms and stakeholders. Given that children heavily rely on their parents' S&P knowledge and decision-making when interacting with technology, understanding these parental perspectives is paramount. The findings from this study are not merely academic; they are intended to inform technology designers, policymakers, and parents themselves, facilitating the creation of safer, more private VR experiences for young users. This article will dissect the talk's methodology, key findings, and practical implications for all parties involved in safeguarding children in the evolving landscape of virtual reality.

Background

▶ Watch: Introduction and the research gap on VR children's privacy (0:00)

The increasing ubiquity of Virtual Reality has brought with it a unique set of security and privacy challenges, particularly concerning children. Unlike many conventional consumer technologies, VR platforms inherently collect vast amounts of highly sensitive data. This includes motion tracking and eye tracking data, which are indispensable for delivering the immersive experiences that define VR. Beyond device-level data collection, the social dimension of VR introduces further risks. As VR evolves into a popular social technology, users, including children, are prone to self-disclosure of a wide range of personal information, such as emotions, life experiences, and even physical traits, often through their customized avatars.

Prior scholarly work on children in VR has predominantly centered on well-being issues, largely due to the age-mixed environment inherent to many social VR platforms. This has led to intensive child-adult interactions, raising concerns about predators, harassment, cyberbullying, and exposure to inappropriate adult content. However, the specific security and privacy dimensions of these interactions, as well as the broader data collection practices, have been significantly marginalized in academic discourse. Existing research has only offered a general message that bystanders and parents harbor concerns about children's privacy when interacting with strangers in VR, but the granular details of these specific S&P risks and the corresponding parental mitigation practices have not been thoroughly investigated.

Recognizing that children's security and privacy in any technological context heavily depend on their parents' knowledge and decision-making, the researchers identified a critical gap. While extensive empirical knowledge exists regarding parental S&P perceptions and practices in other consumer technologies like smartphones and social media apps, such insights are largely absent for VR. To bridge this gap, the research posed three fundamental questions:

1. What are parents' perceptions of children's security and privacy in VR?
2. What are parents' risk and mitigation strategies for their children's security and privacy in VR?
3. What are parents' expectations toward perceived critical stakeholders and future security and privacy-enhancing features in VR?

To answer these questions, the research team conducted semi-structured interviews with 20 parents. Participants were recruited through diverse channels, including VR-related Discord servers, subreddits, LinkedIn, and Facebook groups, as well as outreach to a local school in North Carolina. A pre-screening survey ensured that participants were adult residents of the US, parents or legal guardians, and whose children used VR at home. The interview structure began by building context around participants' and their children's VR usage, then explored general risks and benefits. Critically, the researchers initially refrained from explicitly mentioning S&P concerns to observe if parents would raise them organically. Only in subsequent sections were participants explicitly prompted about S&P issues, stakeholder responsibilities, existing mitigation strategies, satisfaction with current controls, and desired future features, concluding with a live survey on parental control awareness and effectiveness. This methodology allowed for a comprehensive and nuanced exploration of parental perspectives.

Key Findings

▶ Watch: Initial parental concerns: physical health and child-adult coexistence (4:19)

The study yielded several crucial insights into parents' perceptions, mitigation strategies, and expectations regarding children's S&P in VR, addressing each research question in turn.

For Research Question One: Parents' Perceptions of Children's Security and Privacy in VR, the findings highlighted a significant disparity in parental concerns:

• Physical Health vs. S&P Risks: When asked about general concerns, most parents prioritized physical health risks, such as eyesight strain and potential injuries during VR usage, which they defined as "real-life concerns." While parents acknowledged the potential for data collection, they often disregarded these privacy risks in practice, finding them abstract and theoretical. As one participant articulated, "I'm more worried about their interactions with strangers than I'm worried about advertisers. There are all kinds of people talking about how eye and face tracking can allow companies to know more about you, but I don't know what they're going to do with it that we're worried about. I have never found an answer."
• Social Interaction vs. Data Surveillance: Among identified S&P risks, parents exhibited greater concern for issues arising in social interaction contexts, particularly self-disclosure to strangers or through avatars. They perceived VR's immersive nature and the use of avatars as major contributors to children more readily giving out information. Concerns about child-adult coexistence and potential negative influences from adults, other children, and user-generated environments also ranked high. In contrast, concerns about data surveillance by VR companies were generally disregarded, even if parents were aware of the possibility of headset and app data collection.
• Lack of Practical Awareness: Many participants admitted they had "never thought about the security and privacy issues in VR before" being prompted. A general lack of practical S&P awareness was observed, largely stemming from a belief that VR is still in its "nascent development" with a relatively small user base compared to more mature technologies like social media. Parents of teenagers also expressed confidence in their children's maturity in using technology, further reducing perceived immediate S&P concerns. Consequently, this general lack of concern translated into fewer active mitigation practices.

Regarding Research Question Two: Parents' Risk and Mitigation Strategies for Children's Security and Privacy in VR, the study found:

• Reliance on Active Strategies: Parents primarily relied on active strategies to manage their children's VR use. Almost all participants mentioned proactively educating children through conversations and setting rules, often emphasizing these were general rules not exclusive to VR. A frequently mentioned strategy was managing children's app access and S&P information flow through shared and associated accounts. Unlike social media, where children often have separate accounts, most participants shared a single VR headset and account with their children. While often driven by practical limitations, some parents found this practice beneficial for monitoring activity.
• Underutilization of Passive Strategies: In contrast, passive strategies, such as using parental controls, were perceived as potentially useful but were uncommonly used by participants. The primary reasons cited were low usability and technical constraints of existing controls.
• S&P vs. Autonomy Trade-offs: A significant finding was the diverse ways parents balanced children's S&P with their autonomy in VR. Participants held two distinct stances: some prioritized S&P, advocating for significant restrictions, while others leaned towards fostering autonomy, believing children could develop social skills in VR. This complex trade-off directly influenced their mitigation approaches.

Finally, for Research Question Three: Parents' Expectations Toward Perceived Critical Stakeholders and Future Security and Privacy-Enhancing Features in VR, parents expressed desires for specific functionalities:

• Desired Features: Collectively, parents desired real-time S&P alerts to notify them of harmful interactions, AI-based harm detection capabilities, a secondary app (in place of the headset) for parental monitoring, mirroring functionality to observe children's VR experience, and general usage reports.
• Complex Trade-offs in Desired Features: Despite desiring these features, parents simultaneously expressed concerns about the more intense collection of children's activity in VR that such features would necessitate. This highlighted a fundamental dilemma: parents want more protection and oversight, but are wary of the increased data collection required to provide it, further complicating the S&P versus autonomy trade-off.

In summary, the research underscores that parents' understanding and practical engagement with VR S&P for children are still developing, influenced by a hierarchy of concerns, the perceived "newness" of the technology, and a complex negotiation between safety and autonomy.

Technical Deep Dive

▶ Watch: Parents' security and privacy concerns after prompting (5:00)

While the talk focuses on a qualitative study rather than a traditional technical system or exploit, the "technical deep dive" in this context refers to the rigorous methodology employed to gather and analyze parental perceptions. The scientific validity and depth of such research are rooted in its design and execution, ensuring the findings are robust and representative.

The core of this study's technical approach was the deployment of semi-structured interviews. This method was chosen specifically for its ability to delve deeply into participants' subjective experiences, perceptions, and nuanced decision-making processes, which would be difficult to capture with quantitative surveys alone. The semi-structured format allowed researchers to follow a predetermined set of questions (the interview protocol) while also maintaining the flexibility to explore emergent themes and elaborate on participants' unique insights. This balance is crucial for qualitative research, enabling both systematic data collection and the discovery of unexpected findings.

Participant Recruitment and Screening:

The recruitment process was designed to secure a diverse and relevant participant pool. Researchers advertised the study across various online platforms where VR users and parents might converge:

• VR-related Discord servers: Targeting communities specifically engaged with VR technology.
• Subreddits: Utilizing Reddit's thematic communities for VR enthusiasts and parents.
• LinkedIn and Facebook groups: Leveraging professional and social networks to reach parents.

Additionally, outreach to a local school in North Carolina aimed to diversify the recruitment beyond purely online channels, potentially reaching a broader demographic.

A crucial step was the implementation of a pre-screening survey. This survey ensured that the 20 selected participants met specific criteria, guaranteeing their relevance to the study's objectives:

• They had to be adult residents of the US.
• They were required to be parents or legal guardians.
• Crucially, their children used VR at home, ensuring direct experience with the study's subject matter.

Interview Protocol and Data Collection:

The interview protocol was structured meticulously to gather comprehensive insights without leading participants. It progressed through several phases:

1. Context Building: Initial questions focused on participants' and their children's general VR usage patterns, including types of games/apps, frequency, and duration. This helped establish a baseline understanding of their VR ecosystem.
2. General Risks and Benefits: Participants were then asked about their general perceptions of risks and benefits associated with children's VR usage. Notably, at this stage, the researchers did not explicitly mention security or privacy. This deliberate omission was critical to observe whether S&P concerns would emerge organically as primary concerns for parents, or if other issues (e.g., physical health, content appropriateness) would dominate.
3. Explicit S&P Focus: Following the general discussion, the interview explicitly shifted focus to children's security and privacy in VR. Participants were prompted to specify any S&P concerns they had, leveraging their prior experiences with other technologies to help them articulate potential VR-specific risks. This phase aimed to uncover both explicit and latent S&P concerns.
4. Stakeholder Responsibilities: Participants were asked about their perceptions of various stakeholders' responsibilities (e.g., VR companies, app developers, parents themselves, policymakers) in addressing S&P concerns.
5. Mitigation Strategies and Satisfaction: The discussion then moved to the strategies parents currently employed to address S&P risks, if any. Researchers also inquired about parents' satisfaction with existing S&P controls within VR platforms.
6. Desired Future Features: A forward-looking component asked participants about their desired features for future VR platforms that could enhance S&P for children.
7. Live Survey on Parental Controls: Each interview concluded with a brief live survey designed to gauge participants' awareness and perceived effectiveness of existing parental controls in VR. This provided a quantitative check on their qualitative statements regarding parental control usability.

By structuring the interviews in this manner, the researchers were able to systematically explore a wide range of parental perspectives, from unprompted general concerns to specific S&P issues, mitigation practices, and future expectations. The semi-structured nature allowed for the collection of rich, qualitative data, enabling a deep understanding of the complex interplay between parental awareness, perceived risks, and practical actions in the context of children's VR security and privacy. This meticulous approach forms the robust "technical" foundation of the study's findings.

Demo / Proof of Concept

▶ Watch: Why parents lack practical security and privacy mitigation (6:40)

This talk presented the findings of a qualitative research study based on semi-structured interviews with parents. As such, the presentation did not include a technical demonstration or a proof of concept of a specific exploit, tool, or software. The focus was on empirical data collection and analysis regarding human perceptions and practices, rather than the development or showcasing of a new technological artifact.

Defensive Implications

▶ Watch: Summary: Perceived vs. real-life risks for children in VR (7:25)

The findings from this study carry significant defensive implications for various stakeholders, including parents, VR companies, and policymakers, outlining clear pathways to enhance children's security and privacy in VR.

For Parents:

The research highlights that parents primarily rely on active strategies such as conversations and setting rules. This foundational approach should be strengthened by:

• Proactive Education and Awareness: Parents need to be more aware of VR's unique S&P risks beyond physical safety. VR companies and educational resources should provide accessible information that leverages physical metaphors (as children perceive more S&P risks in physical contexts) to explain abstract digital threats like data collection and self-disclosure.
• Understanding Social VR Dynamics: Parents must understand that the immersive nature of VR and the use of avatars can make children more prone to self-disclosure and interaction with strangers. Conversations should specifically address these dynamics, emphasizing caution in sharing personal information and navigating age-mixed social environments.
• Leveraging Shared Accounts (Strategically): While often a practical necessity, the use of shared and associated accounts can be a valuable monitoring tool. Parents should be educated on how to effectively use these shared accounts to manage app access and monitor activity, not just for practical reasons but as a deliberate S&P mitigation strategy.
• Awareness of Parental Control Limitations: Parents should be informed about the current limitations, low usability, and technical constraints of existing parental controls. This knowledge can help manage expectations and encourage them to advocate for better tools.

For VR Companies:

VR companies bear a substantial responsibility in designing safer and more private environments for children. The study's findings point to several critical areas for improvement:

• Redesigning S&P Controls: There is an urgent need to redesign existing S&P controls to be more usable, engaging, modality-specific, and granular for both children and parents. Controls should be intuitive and easily accessible, moving beyond abstract settings to offer actionable insights and management capabilities.
• Mandatory Onboarding Training: Implementing mandatory onboarding training for parents when they set up VR devices for children could significantly enhance their firsthand VR knowledge and awareness of S&P risks. This training should be interactive and informative, not just a static terms-of-service agreement.
• Developing Desired Features: Companies should prioritize the development of features that parents explicitly desire, such as real-time S&P alerts for harmful interactions, AI-based harm detection, secondary apps for remote parental monitoring (in place of direct headset usage), mirroring capabilities, and general usage reports.
• Addressing Data Collection Concerns: Crucially, when developing these advanced S&P features, VR companies must proactively address parental concerns about more intense collection of children's activity. This requires transparent data handling practices, clear communication about what data is collected and why, and the implementation of privacy-preserving design principles (e.g., differential privacy, local processing) wherever possible. Companies need to build trust by demonstrating a commitment to minimizing data collection and maximizing privacy for young users.
• Facilitating Trade-offs: Recognizing that parents have different trade-offs between children's S&P and autonomy, VR platforms should offer flexible controls that allow parents to customize settings according to their individual philosophies, rather than imposing a one-size-fits-all approach.

For Policy Makers:

The nascent stage of VR and the unique S&P challenges it presents for children highlight a need for proactive regulatory measures:

• Improved Policy Regulations: Policymakers should work to establish and enforce specific policy regulations for children's S&P in VR, moving beyond general digital safety guidelines. These regulations should account for the immersive nature of VR, the unique data collection capabilities (e.g., biometric data like eye tracking), and the social interaction dynamics that differentiate VR from other technologies.
• Stakeholder Accountability: Policies should clearly define the responsibilities of VR hardware manufacturers, software developers, and content creators in protecting children's S&P, ensuring accountability across the ecosystem.

By taking these defensive implications seriously, all stakeholders can contribute to creating a safer, more private, and ultimately more beneficial VR experience for children.

Key Takeaways

• Physical safety is prioritized over S&P: Parents perceive physical health risks (eyesight, injuries) as "real-life concerns," often disregarding abstract data surveillance or privacy risks in practice due to a lack of tangible understanding.
• Social interaction risks dominate S&P concerns: Parents are more worried about self-disclosure to strangers through avatars and negative influences in social VR environments than about data collection by companies.
• Active mitigation is prevalent; passive controls are underutilized: Parents primarily rely on proactive conversations, rules, and shared accounts, while existing parental controls are perceived as useful but rarely used due to poor usability and technical limitations.
• Complex trade-offs between S&P and autonomy: Parents hold differing views on balancing children's security and privacy with their desire for autonomy in VR, influencing their mitigation strategies and expectations.
• Desire for advanced S&P features, but with data collection concerns: Parents want features like real-time alerts, AI-based harm detection, and monitoring apps, but are simultaneously concerned about the increased data collection these features would require.
• Imperative for improved VR S&P guidance, usability, and policy: VR companies must redesign S&P controls for better usability and engagement, provide mandatory parent onboarding, and policymakers need to develop specific regulations for children in VR.

About the Speaker(s)

The talk was presented by Jiaxun Cao, affiliated with Duke University. Jiaxun Cao is one of the co-authors of the paper, alongside Abhinaya S B, Anupam Das, and Pardis Emami-Naeini. The presentation was given on behalf of all co-authors, highlighting their collaborative research efforts in understanding parents' perceptions and practices concerning children's security and privacy in Virtual Reality.