Abstract
This systematic literature review summarizes the latest evidence on privacy, security, and governance in XR-based education. Following the PRISMA 2020 guidelines, 102 peer-reviewed studies published between 2018 and 2026 and retrieved from eight scholarly databases and last searched in March 2026 were analyzed through a narrative thematic synthesis; the review was not registered. The findings indicate that XR adoption in education is growing rapidly, especially since COVID-19, and is leading to the collection of highly detailed behavioral, physiological, spatial, and interaction data. The reviewed literature primarily focuses on XR applications, multimodal data collection, privacy, and security risks. In contrast, fewer studies examine trust, consent, governance, or mitigation controls. The review identifies biometric re-identification, sensitive attribute inference, side-channel leakage, immersive manipulation, and weak consent mechanisms as the most prominent concerns. At the same time, the evidence reveals a persistent imbalance between problem identification and practical response. Existing mitigation efforts remain fragmented across technical, organizational, and policy-oriented approaches, with limited convergence into deployable models for educational institutions. The review highlights a clear maturity gap: XR in education is advancing faster than the privacy, security, and governance structures needed to support it responsibly. The central contribution of this study is a structured synthesis that shows that, despite growing awareness of the risks, a unified, education-specific framework for protecting student data in immersive learning environments remains absent.