The UK’s data watchdog is seeking clarification from Mark Zuckerberg’s Meta about parental controls on its popular virtual reality headset, as campaigners warned that it could breach an online children’s safety code. The Information Commissioner’s Office said it was planning “further discussions” with the Facebook and Instagram owner about its £300 Oculus Quest 2 device, which was a sought-after gift over Christmas. However, child safety experts have warned that the headset’s lack of parental controls – which would allow parents to block content that could be harmful to children – expose young users to the threat of abuse on the platform. Research by the Center for Countering Digital Hate (CCDH), a campaign group, has flagged multiple instances of abuse on VRChat, a top-selling social app for Oculus users. Examples of under-18s being harassed on VRChat included a young person’s avatar – the digital representation used by people on virtual reality platforms – being followed by two heavily breathing men and another male joking in front of an under-18 that they were a “convicted sex offender”. The ICO said it would contact Meta about the device’s compliance with the age-appropriate design code, also known as the children’s code, which states that the “best interests of the child should be a primary consideration” for online services likely to be accessed by a person under 18. “Online services and products that use personal data and are likely to be accessed by children are required to comply with the standards of our children’s code,” said an ICO spokesperson. “We are planning further discussions with Meta on its children’s privacy and data protection by design approaches to Oculus products and virtual reality services. Parents and children who have concerns about how their data is being handled can complain to us at the ICO.” The code focuses on preventing websites and apps from misusing children’s data and also applies to “connected devices”, but it does not regulate content. A breach of the code could be punished by a fine of up to £17.5m or 4% of a company’s global turnover, which in the case of Meta would be £2.5bn, although formal warnings and reprimands are also possible. The architect of the children’s code, the crossbench peer Beeban Kidron, said Meta could be challenged under several aspects of the code. For instance, users need to be over 13 to use the Oculus headset – a Facebook account, which has a minimum age of 13, is required to operate it – which could put Meta in breach of the code’s provisions requiring companies to check a user’s age. VRChat, which also has a minimum age requirement of 13, faces similar questions. “The worries about the Oculus VR Headset demonstrate why we need to see ‘safety by design’ as a new norm in tech,” said Kidron. “Kids using VR headsets like Oculus can access chatrooms and other features known to carry risk, by simply ticking a box declaring they meet the minimum age requirements. This is an insufficient barrier to underage use of services known to harbour child abuse, harassment, racism and pornography.” Andy Burrows, the head of child safety online policy at the NSPCC, said there were “substantive” questions about whether Meta was complying with the children’s code. “Immersive virtual environments present an increased risk to children being exposed to harm in different and intensified ways, and it’s clear Meta hasn’t developed the Oculus headset in a way that’s at all consistent with a safety-by-design approach.” Burrows added that the CCDH research raised concerns about Zuckerberg’s plans for the “Metaverse”, a catch-all term for an immersive VR world in which people interact socially and professionally. “If this is the start of Mark Zuckerberg’s Metaverse it suggests he isn’t committed to building it safely from the outset, and that much-needed lessons still haven’t been learnt,” said Burrows. The CCDH, which said it had found more than 100 potential violations of Meta’s policies over a 12-hour period on VRChat, said Meta was “ignoring the need to embed even minimum protection” for its metaverse plans. “The public has a right to ask how anyone in good conscience could invite people on to a new platform without real confidence it is safe for them,” said Imran Ahmed, the CCDH chief executive. A Meta spokesperson said the company was “confident” that the Oculus headset met the conditions of the children’s code. “We’re committed to meeting the obligations under the code, and to providing young people with age-appropriate experiences,” said the spokesperson, adding that the Oculus terms of service did not permit under-13s to create accounts or use the device. The spokesperson said Meta was also committed to building the Metaverse responsibly and had already announced a $50m (£37m) investment programme to ensure the concept met regulatory and legal concerns, distributing the money among organisations and academic institutions such as Seoul National University and Women in Immersive Tech. VRChat has been approached for comment.