Enhancing Digital Identity: Evaluating Avatar Creation Tools and Privacy Challenges for the Metaverse

Abstract

This study explores the process of creating avatars for Virtual Reality and metaverse environments using a variety of specialized applications, including VRChat, Ready Player Me, VRoidStudio, Mixamo, Convai, and MetaHuman. By evaluating these platforms, the research identifies the strengths and limitations of each tool in terms of customization, integration, and overall user experience. The practical implementation focuses on avatar creation within Unity and Unreal Engine, highlighting the technical aspects of rigging, animation, and real-time rendering. The study also delves into the broader implications of avatar use, particularly concerning privacy and security. Our findings reveal that while each platform offers unique advantages, the choice of tool significantly impacts the visual fidelity and performance of avatars in virtual environments. For the ease of use, Ready Player Me stands out with its intuitive interface. VRoidStudio is notable for its high degree of customizability, allowing for detailed avatar personalization. In terms of high-quality graphics, MetaHuman leads the way with its advanced graphical fidelity. At the same time, while some platforms excel in personalizing avatars or integrating with development environments (VRoidStudio, Ready Player Me), others are constrained by their limited flexibility or their platform-specific availability (MetaHuman, Mixamo). Understanding the technical intricacies of these tools is crucial for developing more immersive and secure metaverse experiences.

1. Introduction

The rise of Extended Reality (XR) technologies and solutions has been fueled by increased computational capacities, advancements in multimedia techniques and image processing, the use of cloud computing, and new communication technologies [1]. XR is a generic term used to describe Virtual Reality (VR), Augmented Reality (AR), and Mixed Reality (MR) [2]. The recent progress in XR and immersive technologies is paving the way toward the metaverse paradigm. The metaverse is seen as the next evolution of the Internet and the Internet of Things (IoT), where physical and virtual worlds fully converge [3].

The term metaverse was first coined by the writer Neal Stephenson in 1992 in his science fiction novel Snow Crash. The term combines the prefix “meta”, meaning beyond, and the root “verse”, implying universe. In Stephenson’s original conceptualization, the metaverse is envisioned as a futuristic and hyper-realistic virtual world where humans would spend time engaging in everyday activities such as socializing, playing, working, or shopping. For the metaverse to function as envisioned, it must be a real-time, virtual representation of the physical world, encompassing both the real and virtualized worlds, with their entities, relationships, events, states, processes, and activities. Thus, while various definitions of the metaverse exist [4,5], this research will define the metaverse as the materialization of the convergence of the physical and virtual worlds into products, services, or experiences, utilizing technologies such as the IoT, big data, edge computing, cloud computing, and artificial intelligence.

In this digital realm, avatars play a crucial role as the digital representations of users. These avatars serve as the interface through which users interact, communicate, and collaborate within the metaverse. The creation and customization of these avatars are essential for ensuring that users can express their identities and engage effectively in virtual environments [6]. Given the metaverse’s potential to revolutionize various domains, understanding the process of avatar creation and the security implications of their use is of significant importance.

In this work, a practical study of various techniques and tools available for the creation of avatars within the context of the metaverse is conducted. Our work aims to explore different approaches to avatar creation, analyzing both their advantages and limitations, to identify the best practices for developing and utilizing avatars in virtual environments. We will follow a use case approach, combined with Multi-Criteria Decision Making (MCDM) for the comparative analysis. That is, we will focus on the practical implementation of these techniques, using platforms such as Unity, Unreal Engine, and Blender, among others, and will investigate the broader implications of avatar use in the metaverse, particularly concerning integration, customization, and the overall user experience. While this research primarily focuses on the technical aspects of avatar creation, it acknowledges the importance of considering privacy and cybersecurity concerns, which will be also discussed. Therefore, the main contributions of this paper are as follows:

• It provides a hands-on analysis of various platforms that are used for creating avatars in Virtual Reality and metaverse environments, including VRChat, Ready Player Me, VRoidStudio, Mixamo, Convai, and MetaHuman.
• It analyzes the practical aspects of integrating avatars into popular VR development platforms like Unity and Unreal Engine.
• It explores the privacy and cybersecurity challenges of avatar use in the metaverse, focusing on identity theft, data collection, social engineering, and the need for robust legal protections.
• It enhances the understanding of how digital identities are formed and managed in the metaverse, offering valuable insights for developers, researchers, and policymakers.

The rest of the paper is organized as follows. Section 2 provides a theoretical foundation for understanding the metaverse, VR, AR, and avatars, exploring the various applications of the metaverse and distinguishing between the key technologies that enable it. Section 3 details the research methodology. The detailed outcomes of the avatar creation process are shown in Section 4, offering a comparative analysis of the different platforms and tools, and discussing the integration of avatars into virtual environments. Section 5 explores the privacy and security concerns found. Finally, Section 6 summarizes the key findings of the research and provides suggestions for future research.

2. The Metaverse

2.1. Definition and Applications

The term metaverse has gained significant attention in recent years, due to the rapid advancement of technology. It is envisioned as a real-time, virtual representation of the physical world, encompassing both real and virtualized entities, relationships, events, processes, and activities.

The applications of the metaverse are vast and varied, spanning multiple fields [7,8,9,10]. In education, the metaverse offers a platform for creating realistic learning scenarios, enhancing collaboration and participation among students through virtual lab simulations and immersive educational experiences [11]. In the entertainment industry, the metaverse provides more-immersive gaming [12], cinematic, and social experiences, allowing users to create avatars, explore virtual worlds, and interact with others in real-time. The platform also hosts virtual events and concerts, reaching global audiences with immersive experiences. For business collaboration, the metaverse facilitates virtual meetings and teamwork in shared digital spaces, improving communication in remote or distributed work environments [13]. It fosters a vibrant virtual economy where users can buy, sell, and trade digital goods and services. Social interaction within the metaverse enables individuals to connect with friends and family through avatars, opening possibilities for virtual events and recreational activities.

In the medical field, the metaverse is becoming a valuable tool for medical training, allowing health professionals to simulate procedures and practice decision making in a virtual scenario [14]. It also has applications in virtual therapy, such as treating post-traumatic stress disorder, anxiety, and chronic pain [15]. Artists and creators can use the metaverse as a digital canvas for producing and displaying art, hosting virtual galleries, and reaching a global audience. Virtual tourism allows users to explore global destinations from the comfort of their homes, offering immersive and educational experiences. Professional training benefits from the metaverse through interactive and practical learning environments that enhance employee skills and competencies [10]. Additionally, the metaverse supports scientific research by modeling and simulating complex phenomena, e.g., with digital twins, aiding researchers across disciplines. Although the metaverse is still in its early stages of development, its potential to transform various aspects of society and interaction with the digital world is immense.

Understanding the metaverse requires a clear distinction between the various immersive technologies that contribute to its development, namely Virtual Reality (VR), Augmented Reality (AR), Mixed Reality (MR), and Extended Reality (XR). Virtual Reality (VR) immerses users in a fully digital environment, altering their visual and auditory perceptions to create a completely virtual experience. Using devices like Head-Mounted Displays (HMDs), users can interact with computer-generated worlds, manipulating objects and navigating through virtual spaces, creating a strong sense of presence. Augmented Reality (AR) enhances the real-world environment by overlaying digital information, such as images, sounds, or 3D models, onto the physical world. This allows users to interact with virtual elements while remaining aware of their real surroundings, as seen in applications like Pokémon Go or Instagram filters. Mixed Reality (MR) combines elements of both VR and AR by integrating digital objects into the real world in a way that allows them to interact with the physical environment. Unlike AR, where digital objects are merely overlaid, MR ensures that these virtual elements understand and respond to the real-world context, such as adhering to surfaces or reacting to lighting conditions. Extended Reality (XR) is an umbrella term that encompasses VR, AR, MR, and any other immersive technologies that may emerge. XR represents the full spectrum of immersive experiences that blend the physical and digital worlds.

The creation of avatars and immersive environments within the metaverse heavily relies on a variety of VR tools and platforms, each offering diverse features and functionalities that contribute to the development of detailed and interactive digital spaces. Oculus, a product of Meta [16], has been instrumental in popularizing VR through its range of headsets, including the Oculus Rift, Oculus Quest, and Oculus Go. These devices provide immersive experiences that allow users to explore virtual environments and interact with others through customized avatars. Oculus also offers a comprehensive development platform, with tools for creating avatars and virtual worlds, such as Oculus Avatars. SteamVR [17], developed by Valve, is a widely used platform for VR content distribution, particularly in the PC gaming community. It offers an extensive library of VR games and experiences, along with tools for creating and customizing avatars. Users can design unique characters with detailed customization options and use them in multiplayer games and social VR environments. Rec Room [18] is another social metaverse platform that enables users to create personalized avatars and participate in a wide range of activities, from gaming to social events. The platform provides tools for avatar customization, allowing users to express their style and identity within the metaverse. These VR tools play a crucial role in the development of the metaverse, enabling the creation of immersive experiences and detailed avatars that enhance user interaction and engagement in virtual spaces.

Among the most prominent platforms for the creation of avatars and immersive experiences are Unity [19], Unreal Engine [20], and Blender [21]. Unity is one of the most widely used platforms for developing Virtual Reality applications, offering a versatile game engine that supports both 2D and 3D experiences. Its compatibility with various VR devices, coupled with its extensive customization tools, makes it the preferred choice for creating unique and interactive avatars. Unreal Engine is another leading platform, known for its ability to render high-quality graphics and support realistic physics, which are essential for creating visually stunning and immersive metaverse environments. Blender, while not a game engine like Unity or Unreal Engine, plays a crucial role in the creation of 3D models and animations. As an open-source platform, Blender offers a robust set of tools for modeling, texturing, and animating avatars and other elements that can be integrated into Virtual Reality applications that were developed in Unity and Unreal Engine. Together, these platforms form the backbone of metaverse development, enabling the creation of rich, interactive, and visually compelling virtual experiences.

2.2. Literature Review

The growing importance of the metaverse is reflected in recent studies that explore its various aspects, from avatar experiences and user interactions to platform evaluation and governance.

The work by Shin et al. [22] presented a comprehensive framework for assessing metaverse platforms. The authors identified a critical need for systematic evaluation methods as the metaverse industry expands. They proposed six key evaluation factors, divided into system-level (virtual–real convergence, interoperability, economic system) and user-level (avatar embodiment, connectivity, creative activity) dimensions. These factors were intended to guide both academic research and industry practices by offering a structured approach to evaluating the technological and user-experience aspects of metaverse platforms. To understand the role of avatars in social VR environments, Dong et al. analyzed, in [23], over 6000 user reviews from VRChat. The study emphasized avatar customization, diversity, and the challenges of avatar theft. The findings suggest that while avatars are central to user identity and self-expression in virtual spaces, recent anti-cheat measures have restricted customization, leading to user dissatisfaction. This highlights the delicate balance needed between ensuring security and preserving user freedom in avatar creation. Similarly, the study carried out in [24] offered a detailed exploration of the metaverse’s conceptual frameworks and architectural designs. It discussed the broad applications of the metaverse across sectors like education, healthcare, and entertainment, while also addressing significant challenges such as privacy, security, and interoperability. The authors argue that overcoming these challenges is crucial for the continued growth and success of the metaverse.

The psychological and behavioral effects of virtual embodiment, particularly in AR settings, is addressed in [25]. The study suggested that the quality of avatar representation directly impacts user immersion and interaction, with implications for therapeutic applications in treating psychological conditions. The concept of virtual embodiment is shown to play a critical role in how users perceive their presence and identity within virtual environments. Finally, Weidner et al. showed, in [6], the visualization techniques used for avatars and agents in immersive environments. The authors reviewed the technical and aesthetic considerations involved in creating realistic and engaging avatars, highlighting their importance in enhancing user experience in gaming and social VR applications. The study underscored the need for high visual fidelity and realistic interactions to maintain user engagement and satisfaction.

Regarding governance strategies for digital content platforms [26], we can find several governance models. Comparing the governance structures of well-known digital platforms like YouTube [27], TikTok [28], Reddit [29], and decentralized platforms such as Steemit [30] and Mastodon [31], it is clear that these models differ significantly in content moderation, user autonomy, and transparency [32,33], ranging from highly centralized control to community-driven, decentralized systems. On the one hand, centralized platforms excel in efficient content control but often sacrifice transparency and user involvement. For instance, platforms like YouTube and TikTok belong to this category. They use algorithmic moderation and corporate oversight to control content. One positive outcome is that this allows for the efficient enforcement of rules and rapid responses to issues like misinformation. However, it could raise concerns about censorship, algorithmic biases, and limited user participation in governance decisions. On the other hand, decentralized platforms provide greater transparency and user control but face challenges in scaling and maintaining consistent content policies. For instance, Reddit offers a decentralized approach, where independent subreddit moderators establish their own content rules. This leads to more diverse governance, although inconsistencies across communities appear. Blockchain-based platforms, like Steemit and Mastodon, represent even more decentralized models. They aim to empower users through community-driven moderation and voting.

Focusing on metaverse platforms, the analysis of governance structures becomes even more complex due to their immersive and decentralized nature [34]. Metaverse platforms, such as Decentraland [35] or The Sandbox [36], often blend centralized and decentralized governance models. These platforms allow users to own virtual assets through blockchain technology, promoting decentralized ownership and self-governance through mechanisms like Decentralized Autonomous Organizations (DAOs). In these DAOs, users can vote on platform policies, participate in decision-making processes, and influence the development of the virtual environment, embodying the principles of decentralization and user empowerment. However, these metaverse platforms also face unique governance challenges. Decentralized models enhance transparency and user control, but they can lead to governance impasse and scalability issues, especially when large-scale decisions need to be made rapidly. From a different perspective, Meta’s Horizon Worlds [37] (formerly Facebook) follows a centralized governance model. Meta [16] exerts centralized control over the platform’s content moderation, data management, and governance decisions. It defines the policies, oversees user conduct, and manages the platform’s evolution, including updates and changes to the virtual environment. Both centralized and decentralized metaverse environments face legal complexities related to intellectual property rights, the management of user-generated content, and data privacy (discussed in Section 5). These challenges may manifest on different scales, though. In centralized platforms, these issues are typically managed through top-down control, whereas in decentralized platforms, they often require community-driven governance mechanisms and more complex regulatory frameworks.

Particularly for the digital content platforms that will be analyzed in this paper (VRChat, Ready Player Me, VRoid Studio, Mixamo, and MetaHuman), we can describe their governance strategies as follows. VRChat employs a mixed governance strategy, where both automated systems and community-driven reports play a role in content moderation. This allows users to report offensive behavior or inappropriate content. Although users have significant autonomy in creating and sharing custom avatars and virtual worlds, the platform manages high-level moderation and can enforce bans for policy violations. Similarly, Ready Player Me operates under a centralized governance model, where avatar customization is guided by platform policies. However, as avatars are integrated into multiple external virtual environments, those environments may impose their own rules, hence giving users substantial autonomy while maintaining the platform’s control over avatar creation guidelines. In contrast, VRoid Studio provides high autonomy to users for avatar creation, allowing them to freely distribute their avatars across various platforms with minimal internal governance. The governance of avatars is largely left to the external platforms where these avatars are used, and VRoid Studio only focuses on ensuring compliance with its software and branding guidelines. Mixamo emphasizes asset management and ensures compliance with intellectual property regulations but gives users significant control over how assets are used in third-party projects. Its governance is centralized, focusing on the appropriate use of tools. Finally, MetaHuman offers extensive autonomy for creating photorealistic digital humans, but the platform maintains a strict centralized governance model, particularly monitoring the use of assets in commercial or sensitive contexts to prevent misuse. Despite the creative freedom offered, it sets clear rules around the responsible use of its tools and assets, ensuring compliance across different environments.

Finally, platforms generally reward the creators of high-quality content through increased visibility and community recognition. Creators may have their avatars or assets featured in the platform’s marketplace or highlighted in featured sections. VRChat and MetaHuman offer further incentives, such as premium memberships or monetization opportunities, so that creators can profit from their work. Ready Player Me encourages cross-platform sharing, helping content creators gain wider recognition. MetaHuman targets professional projects, where quality content could, for instance, lead to commercial partnerships. In contrast, low-quality or inappropriate content can face penalties such as reduced visibility due to de-prioritization in search algorithms. Community voting or rating systems can also affect content rankings, in a way that content which does not meet user expectations may fall quickly. Persistent violations, including harmful content, may lead to account restrictions or complete removal from the platform.

3. Methodology

The methodological approach employed in this study combines a case study analysis with an MCDM framework. The case study approach provides in-depth contextual analysis of each system, while MCDM facilitates a structured, quantitative comparison based on predefined evaluation criteria.

Each of the avatar systems considered in this study was treated as an individual case. The data for these case studies were gathered through real experimentation. The criteria selected for the MCDM analysis include the user experience (how easy and intuitive the avatar creation process is), customization (how extensively the avatar system allows users to modify and personalize their avatars to meet specific needs or preferences), and integration (how well the avatar system can connect and function with other platforms, applications, or game engines). These criteria were chosen based on their relevance to digital identity management in avatar systems, as highlighted in prior research. In this study, each evaluation criterion was considered equally important, reflecting the absence of any strong justification to prioritize one criterion over another. Thus, the analysis proceeded under the assumption of equal weighting to maintain objectivity and simplicity.

The selected tools for the creation of VR and metaverse avatars were VRChat [38], Ready Player Me [39], VRoidStudio [40], Mixamo [41], Convai [42], and MetaHuman [43]. The selection of the applications was based on their significance in the field of digital avatars and identity, as well as their wide recognition across different industries and use cases. Each platform provides distinct tools for avatar customization and integration, ranging from basic creation to advanced photorealistic modeling, reflecting both popular and specialized solutions in the field. A special focus was given to MetaHuman, which offers highly realistic digital human creation with advanced rigging and seamless integration within Unreal Engine. All the chosen platforms are well-established, widely accessible, and have a broad user base, making them suitable for examining the various aspects of avatar creation and deployment.

4. Results

In this section, we show the experimental results and analyses that were derived from the comparative evaluation of avatar creation platforms. The key insights regarding the user experience, customization capabilities, and platform integration into virtual environments are highlighted, providing a comprehensive overview of the performance and suitability of each platform for use in digital identity and metaverse applications.

4.1. Platforms for Avatar Creation

The creation of avatars for use in Virtual Reality and metaverse environments is facilitated by a variety of applications that are designed to simplify and streamline the process. First, VRChat is a popular platform that allows users to create and interact with avatars within a virtual world. It provides tools for avatar customization and integration into its social VR environment (see Figure 1 for the main interface of VRChat). Second, Ready Player Me offers an easy-to-use system for creating avatars that can be imported into various games and VR applications. Users can personalize their avatars with a wide range of customization options, making it a versatile tool for both developers and end-users. Figure 2 showcases the Ready Player Me avatar creation interface, customization details, and final avatar view. Third, VRoidStudio is particularly popular for creating anime-style humanoid avatars, offering detailed customization features that allow users to design unique characters, although it requires additional steps to integrate with platforms like Unity and Unreal Engine (see Figure 3, showing VRoidStudio’s main window and avatar import options). On the other hand, Mixamo provides pre-made, rigged, and animated avatars that can be easily integrated into VR applications, making it a convenient option for developers who need ready-to-use characters (Figure 4). Another option is Convai, a platform that combines avatar creation with AI-driven features, allowing users to develop avatars with specific personalities and behaviors for immersive interactions (Figure 5).

MetaHuman, by Unreal Engine, stands out for its ability to create highly realistic, photorealistic avatars. It offers extensive customization options and is particularly suited for high-end VR applications that require lifelike human characters. Figure 6 depicts the MetaHuman plugin within Unreal Engine, the MetaHuman Creator interface, and a list of predefined avatars.

MetaHuman Creator is a powerful tool within the Unreal Engine ecosystem, developed by Epic Games, to enable the rapid creation of highly realistic and customizable digital humans. Leveraging cloud-based computing and advanced 3D scanning technology, MetaHuman allows users to create characters that are visually stunning and fully rigged for animation within Unreal Engine. MetaHuman Creator offers a user-friendly interface with a variety of starting templates that cover diverse human features, including different ethnicities and body types. These templates serve as a base for users to build upon, using robust customization options to adjust specific attributes like facial features, skin tone, hair, and clothing (Figure 6). A standout feature of MetaHuman is its advanced rigging system. Each character is automatically rigged with a detailed skeletal structure, supporting both facial and body animations. The rigging system includes numerous control points, enabling nuanced animations that capture a wide range of human emotions and actions.

MetaHuman avatars are fully compatible with Unreal Engine’s animation tools, facilitating the seamless integration of motion capture data, manual keyframing, and procedural animation. The facial rigging is optimized for high-fidelity performance, essential for achieving lifelike digital humans, as shown in Figure 6. Graphical fidelity is a key strength of MetaHuman, using high-resolution textures and Physically-Based Rendering (PBR) materials to simulate realistic skin, hair, and eyes. These elements dynamically respond to lighting and environmental effects, resulting in digital humans that behave realistically in various virtual environments (Figure 7). The cloud-based nature of MetaHuman Creator allows for real-time adjustments and rendering, providing immediate feedback during the design process. This real-time capability is crucial for iterative design, enabling rapid prototyping and refinement. Integration with Unreal Engine ensures that all assets, including textures, rigging, and animations, are preserved during the export process, facilitating a smooth transition from creation to deployment. Future developments, such as a fully integrated MetaHuman plugin within Unreal Engine, promise to further streamline the workflow.

These applications provide a wide range of needs, from simple and quick avatar creation to highly detailed and complex character development, making them essential tools in the production of avatars for the metaverse and other Virtual Reality environments.

4.2. VR Development Engines

4.2.1. Unity

Unity is a versatile and widely used platform for developing VR applications, particularly in the context of avatar creation. This section outlines the process of configuring avatars in Unity, focusing on two primary methods: using Unity’s built-in tools and packages, and leveraging the Avatar SDK provided by PICO for specific headset integration.

To begin with, avatars created using external tools (such as Ready Player Me) can be imported into a Unity project by simply dragging the relevant files into the “Assets” section of the Unity project (Figure 8). The next step involves configuring the movement of the avatar to ensure realistic, human-like motion. This is achieved through a method called Inverse Kinematics (IK), which is an animation technique that links bones in a chain, allowing the connected parts to move in a coordinated manner.

The first step in setting up IK in Unity is to install the “Animation Rigging” package from the Unity Package Manager. Once installed, this package provides a set of tools that allow developers to view and manipulate the avatar’s skeleton, which is essential for configuring realistic movements (see Figure 9). The process involves creating an object hierarchy that includes the avatar’s limbs, such as arms and legs, and then configuring these limbs using the IK constraints provided by the package. Figure 10 shows an example, outlining the step-by-step configuration of a VR IK rig for an avatar. First, a child element named “VR IK Rig” is created and assigned a rig component. Next, a “Rig Builder” component is added to the avatar, and the “VR IK Rig” is placed into the “Rig Layers” section. Following this, a “Two Bone IK Constraint” is applied to the right arm, as shown in the resulting avatar structure (Figure 10d). To enable the component, the first bones of the avatar’s right hand are selected, and then the bones are linked to the “Right Arm IK” constraint. The system automatically creates two child objects (target and hint) for alignment, and these are adjusted to align the hand with the IK target. Finally, the arm movement is tested, and the same process is repeated for the left arm, ensuring that all mobility objects are children of the VR IK Rig. By aligning these constraints properly, the avatar’s limbs can be made to move in response to user inputs or interactions in the virtual environment. Once the limbs are configured, the movement of the avatar’s entire body, including walking and head movement, can be set up by scripting and using Unity’s XR Interaction Toolkit. This toolkit allows the avatar to follow the movements of the VR headset and controllers, making the virtual experience more immersive and responsive (Figure 11). After completing the configuration, the avatar should be fully functional within the Unity environment, ready to interact within the VR application.

For developers using the PICO VR headset, Unity’s standard tools can be supplemented with the PICO Avatar Software Development Kit (SDK). This SDK provides additional functionalities that are specifically designed for PICO devices, allowing for more advanced avatar customization and interaction. To use the PICO Avatar SDK, developers must first download a project template from the PICO developer portal. This template includes all the necessary components and configurations to begin working with PICO avatars (Figure 12). The process of creating an avatar with the PICO SDK involves assigning a skeleton to the avatar, configuring the bones for movement, and optimizing the avatar for use with the PICO headset (Figure 13). The PICO Avatar SDK also includes tools for testing and refining the avatar’s animations and interactions within the Unity editor before deploying the application to a PICO device. This ensures that the avatar’s movements and responses are accurate and natural when viewed through the PICO headset (Figure 14).

Integrating a VR headset into a Unity project is crucial for developing immersive experiences. The PICO 4 headset, for example, requires specific configurations to enable full functionality within Unity. Developers must first set up a developer account with PICO and create a project on the PICO developer platform. Next, the Unity project must be configured to support Android, the operating system used by the PICO headset. This involves installing the Android SDK and NDK tools, importing the PICO SDK into Unity, and enabling the PICO XR plugin in the project settings. Once these steps are completed, developers can link the project to the PICO device, allowing them to test and debug their applications directly on the headset. A complete description of this process has been prepared by the authors and is available in [44].

4.2.2. Unreal Engine

Unreal Engine is another powerful platform for developing VR applications, particularly when high-quality graphics and realistic physics are required. The process of importing and configuring avatars in Unreal Engine is straightforward, thanks to the engine’s robust toolset. Avatars created in other platforms or using tools like MetaHuman can be imported into Unreal Engine through Quixel Bridge, a tool integrated into the Unreal ecosystem (Figure 15). Once imported, avatars can be further customized using Unreal Engine’s visual scripting and animation tools, allowing developers to create complex behaviors and interactions. Setting up a VR headset in Unreal Engine involves configuring the engine’s VR support settings and ensuring that the project is compatible with the target device. For PICO devices, this includes importing the appropriate SDKs and configuring the engine to support Android deployment [44]. This ensures that the application will run smoothly on the headset, with full support for VR interactions.

4.3. Results in Terms of User Experience and Customization

Each platform offered distinct capabilities and customization options. For instance, avatars created using Ready Player Me were characterized by their simplicity and ease of integration into various virtual environments. The platform provided a straightforward interface with a variety of customization features, allowing users to generate avatars quickly, which are suitable for a wide range of applications, especially in social VR settings. The resulting avatars, while not as detailed as those created using more advanced tools, were effective for quick deployment and use in interactive environments. As an example, we visually represented the avatar creation process and results in Figure 2, which depicts the Ready Player Me interface, the detailed customization options, and the final avatar view.

On the other hand, VRoidStudio specializes in creating highly stylized, anime-like avatars. The results from VRoidStudio were particularly detailed, with a focus on facial expressions, hairstyles, and other aesthetic elements that appeal to users who are interested in creating personalized and visually distinct characters. However, as noted, the VRoidStudio avatars required additional steps for integration into platforms like Unity and Unreal Engine, which may limit their usability for developers who need a more streamlined workflow. Figure 3 showed the main window of VRoidStudio and the options available for exporting avatars, highlighting the detailed customization capabilities and the technical considerations for integration.

Mixamo offers pre-rigged and animated avatars, making it an excellent choice for developers who need ready-to-use characters with a minimal setup. The results from Mixamo were highly functional avatars that could be immediately implemented into projects, particularly for game development and other interactive applications. However, the customization options were somewhat limited compared to platforms like VRoidStudio or MetaHuman. Figure 4 provided a view of Mixamo’s initial interface and the file format selection process, demonstrating how easily these avatars can be prepared for use in platforms like Unity.

Convai provides a unique approach by integrating AI-driven features that allow avatars to exhibit specific behaviors and personalities. This resulted in avatars that were not only visually customizable but also capable of interacting with users in more dynamic and intelligent ways. These avatars were well-suited for applications that required more than just a visual representation, such as virtual assistants or Non-Playable Characters (NPCs) in games. Figure 5 depicted Convai’s avatar editor and creation interface, showcasing the platform’s ability to develop avatars with complex behaviors and interactive capabilities.

Finally, MetaHuman by Unreal Engine stood out for its ability to create photorealistic avatars with extensive customization options. The results from MetaHuman were exceptionally detailed, with a focus on realistic facial features, skin textures, and expressions. These avatars were ideal for high-end applications that demand lifelike human characters, such as in cinematic productions or advanced VR simulations. However, the complexity of these avatars may pose challenges in terms of performance optimization, particularly in real-time applications. Figure 6 and Figure 7 provided insights into the MetaHuman plugin within Unreal Engine, the MetaHuman Creator interface, and the list of predefined avatars, which highlight the platform’s capacity to deliver highly realistic digital characters.

The comparative analysis of the four avatar creation platforms reveals distinct strengths and weaknesses across multiple criteria, particularly in terms of their user experience, customization, and integration capabilities. In terms of the ease of use, Ready Player Me excels with its simple, intuitive interface, while VRoidStudio offers a robust desktop application with many customization options. However, platforms like MetaHuman and Mixamo demonstrate a higher graphical quality and a greater variety of animations, catering to users who prioritize realism and high-end visual fidelity. In contrast, customization and modification flexibility vary significantly among the platforms. VRoidStudio allows for extensive customization, including model quality adjustments, whereas Ready Player Me and Mixamo limit the ability to modify avatars or adjust the quality. MetaHuman provides the highest graphical quality but remains restricted in terms of creating avatars from scratch and is exclusive to Unreal Engine.

Additionally, these platform differences also impact the emotional and informational value that users derive from them, which, in turn, could influence users’ intentions to continue using the platforms. VRChat and MetaHuman that offer high levels of customization and graphical fidelity that tend to enhance the emotional value because users may create avatars that resonate with their personal identity. It makes these platforms more engaging on an emotional level. Instead, Ready Player Me, with its ease of use and cross-platform compatibility (as we discuss in next subsection), provides high informational value for users seeking functionality and seamless integration. Overall, the results of avatar creation across these platforms demonstrated a wide spectrum of possibilities, from simple, easily deployable characters to highly detailed, realistic models that are suitable for complex virtual environments. Each platform’s unique strengths cater to different aspects of avatar creation, whether it be quick deployment, high customization, or advanced interaction capabilities.

4.4. Results in Terms of Integration into Virtual Environments

The integration of avatars into virtual environments varied significantly, depending on the platform used for their creation and the target application. In this work, the integration process is discussed with respect to both Unity and Unreal Engine, two of the most prominent platforms for VR development.

In Unity, the integration of avatars was generally straightforward, particularly when using tools like Ready Player Me or Mixamo, which provided avatars in compatible formats that can be easily imported into Unity projects. Once imported, these avatars could be further customized and animated using Unity’s extensive toolset. The integration process in Unity was enhanced by the platform’s support for various SDKs, such as the PICO Avatar SDK, which allows developers to optimize avatars for specific hardware, like the PICO VR headset. This flexibility made Unity a versatile choice for developers looking to deploy avatars across a range of VR environments. For example, regarding the configuration process detailed previously, Figure 8a showed the Assets folder in Unity where avatars are stored, and Figure 9 and Figure 10 provided visual guidance on the rigging and animation setup that ensures that avatars move realistically within the virtual space.

For Unreal Engine, the integration of avatars, particularly those created with MetaHuman, required a more nuanced approach due to the high level of detail and complexity involved. Unreal Engine’s powerful graphics engine could render photorealistic avatars with advanced lighting and shading effects, which enhanced the overall immersion in virtual environments. However, this level of detail also necessitates careful optimization to ensure that the avatars perform well in real-time applications, especially in VR settings where maintaining a high frame rate is crucial for a smooth user experience. The use of tools like Quixel Bridge simplified the process of importing and configuring these high-quality avatars within Unreal Engine, allowing developers to create visually stunning and responsive virtual worlds. Figure 15 illustrated the importation process of MetaHuman avatars into Unreal Engine, showcasing how these tools are used to integrate high-fidelity characters into a project.

The importance of avatar behavior in virtual environments is also of special interest. In platforms like Convai, avatars are not just static visual entities but can interact with their surroundings and users in intelligent ways. This dynamic interaction is particularly essential in applications where user engagement is key, such as in training simulations, educational environments, or interactive entertainment. Figure 5 depicted how avatars can be designed with specific behavioral traits, which are then integrated into the virtual environment for enhanced user interaction.

The comparative analysis of the four avatar creation platforms in terms of integration with external applications is clearly another key differentiator. Ready Player Me stands out for its seamless integration with Unity and Unreal Engine through plugins, while MetaHuman is limited to Unreal Engine. Despite the strengths in specific areas, challenges like compatibility issues with file formats (e.g., VRM files in VRoidStudio) and limitations in customization highlight the trade-offs that users must consider when selecting an avatar creation platform.

We can affirm that the integration of avatars into virtual environments is a critical aspect of VR development that requires the careful consideration of both the technical capabilities of the development platform and the specific needs of the application. Whether aiming for simplicity and ease of use or high-fidelity and advanced interaction, the choice of tools and platforms significantly influences the final outcomes in terms of both visual quality and performance. In this work, we have provided clear examples and illustrations that demonstrate these processes, offering valuable insights into the practicalities of avatar integration within different virtual environments (see

Table 1. Summary of the comparative analysis using MCDM, based on the experimental use cases.

Criteria	Ready Player Me	VRoidStudio	Convai	Mixamo	Metahuman
User experience	High	Medium	Medium	Medium	Medium
Customization	Medium	High	Medium	Low	High
Integration	High	Low	High	Medium	Low

).

5. Privacy and Cybersecurity Challenges

5.1. Data Collection, Surveillance, and Third-Party Access

Avatars are often used to track a user’s behavior, preferences, and interactions within virtual environments. This data can include movement patterns, speech, and even emotional responses. The extensive data collected through avatar interactions can be used for profiling or surveillance without the user’s explicit consent, leading to the potential misuse or exploitation of personal information. In addition, advanced avatars may incorporate biometric data, such as facial expressions, voice patterns, or even heart rate, to enhance realism and interactivity. The collection and storage of such sensitive data raise significant privacy concerns, particularly if these data are shared with third parties or are vulnerable to unauthorized access. Similarly, while avatars can provide a layer of anonymity or pseudonymity, linking avatars to real-world identities is a growing concern. If virtual interactions can be traced back to an individual’s real identity, the privacy protections that avatars are supposed to provide can be undermined, exposing users to risks like doxing or real-world harassment. Even when avatars are designed to be pseudonymous, advanced data analytics can sometimes re-identify users by correlating avatar behavior with other available data, effectively stripping away the anonymity that avatars are supposed to afford.

On the other hand, the platforms hosting avatars often share user data with third-party entities, including advertisers, data brokers, or even governments. This sharing can occur without the user’s full awareness or consent, leading to privacy breaches that extend beyond the virtual world. If platforms do not implement robust data protection measures, avatar-related data can be vulnerable to breaches. Unauthorized access to this data can result in the exposure of personal information, leading to privacy invasions both within and outside the virtual environment. From a technical perspective, most solutions proposed so far have relied on the correct use of privacy policy implementations [45], the use of cryptography [46], or anonymization techniques.

The legal landscape surrounding avatars and privacy regulation is still developing. Many jurisdictions lack specific regulations that address the unique privacy issues posed by avatars, leaving users with limited legal recourse in the event of a privacy violation. In the European Union, privacy issues related to avatars and virtual environments are primarily governed by the General Data Protection Regulation (GDPR) [47], one of the most comprehensive data protection laws globally. While the GDPR does not specifically address avatars or the metaverse, its principles apply broadly to the collection, processing, and storage of personal data, which include the data generated and used by avatars. GDPR regulates how personal data, such as biometric information, behavioral data, and identity-related data associated with avatars, are handled. It provides users with rights over their data, including the right to access, rectify, and erase their information, and it requires companies to obtain explicit consent before collecting or processing such data. However, there are currently no specific regulations within the EU that exclusively address the unique privacy challenges posed by avatars and virtual environments. The application of GDPR to the metaverse and avatars is still evolving, with legal interpretations developing as cases arise. In the United States, there is no comprehensive federal data protection law equivalent to GDPR that specifically addresses avatars and privacy in virtual environments. However, several laws at both the federal and state levels may apply. The Children’s Online Privacy Protection Act (COPPA) [48] is a federal law designed to protect the privacy of children under 13. It applies to online services, including games and virtual worlds, that may use avatars and collect personal data from children. Platforms targeting children must comply with COPPA’s strict requirements on data collection and parental consent. Additionally, various states, most notably California, have enacted their own privacy laws that could impact how avatar-related data are handled. The California Consumer Privacy Act (CCPA) [49] provides residents with rights like those under GDPR, including the right to know what personal data are collected, the right to delete data, and the right to opt-out of data sales. The California Privacy Rights Act (CPRA), an extension of the CCPA effective in 2023, enhances protections for sensitive personal data, including precise geolocation, race, ethnicity, and health data, which could be relevant to avatars in certain contexts. Like in the EU, there is no specific legislation in the US that directly addresses the privacy concerns that are unique to avatars. However, existing laws can apply to aspects of avatar data, and the legal landscape is likely to evolve as the metaverse and similar technologies become more prevalent.

As for real-world cases, the event with Facebook (Meta) and its handling of user data, especially after the Cambridge Analytica scandal [50], is well known. This case highlights how personal data from users, including behavioral data, preferences, and interactions, were collected without explicit consent, used for profiling, and shared with third parties for political manipulation. Similarly, in the gaming industry, platforms like Fortnite and Roblox gather large amounts of user data and in-game behaviors as described in their privacy policies [51,52], which could raise concerns about third-party access and potential misuse.

5.2. Identity Theft and Impersonation

Another important privacy concern is the unauthorized cloning or theft of avatars. Avatars, which often represent a user’s identity in virtual spaces, can be copied or stolen, leading to impersonation. This can result in significant privacy violations, as the stolen avatar could be used to interact with others, possibly in ways that the original user would not condone. Not only that, but the impersonator could try to gather personal information, leading to social engineering or manipulation. For example, attackers could use avatars to gain the trust of others within a virtual environment, potentially extracting personal information or manipulating users in harmful ways. There is also a concern that avatars could be used to subtly manipulate users psychologically, whether through targeted interactions that exploit emotional vulnerabilities or through the presentation of certain stimuli that influence behavior without the user’s informed consent. Moreover, this problem becomes more severe in cases where the avatar reflects the real appearance of its owner. The avatar is the digital representation of a user. This means that it can be totally fictitious or strikingly similar. The extent to which another person could create and use an avatar that visually could be associated with the real image of another person is an open issue.

In the EU, personal real images are protected under the GDPR legislation, but there are several other laws and legal principles that also cover real individual images. The European Convention on Human Rights (ECHR), particularly Article 8, safeguards the right to privacy, encompassing an individual’s control over the use of their likeness. Many EU member states also recognize the “right of publicity” or “personality rights”, granting individuals authority over the commercial exploitation of their name and image. Furthermore, copyright and intellectual property laws may protect images such as creative works, granting exclusive rights to the copyright holder and thereby restricting unauthorized usage. The Unfair Commercial Practices Directive (2005/29/EC) also plays a role by prohibiting misleading business practices, including the unauthorized use of someone’s image in advertising. National legislations provide additional layers of protection; for instance, Germany’s Kunsturhebergesetz (KUG) requires consent for the publication or use of a person’s image, while the French Civil Code mandates explicit consent for commercial activities involving an individual’s likeness. These legal protections collectively ensure that companies cannot exploit personal images for profit without the appropriate authorization, and individuals have the right to seek legal remedies such as damages or injunctions if their images are used unlawfully.

In the US, the legislation on personal image rights is more fragmented and varies significantly from state to state. The right of publicity is a state-level legal doctrine that gives individuals control over the commercial use of their name, likeness, voice, signature, or other identifiable characteristics. This right is particularly relevant in protecting against the unauthorized use of a person’s image for advertising or commercial purposes. The right to privacy, encompassing protection against the unauthorized use of personal images, is recognized under both state common law and constitutional principles in the US. Particularly of interest in this case is the appropriation of a name or likeness, which overlaps with the right of publicity and prevents the unauthorized commercial use of a person’s identity, including their name or likeness. However, there is no comprehensive federal law specifically addressing the protection of personal images in the manner that GDPR does in the EU. Certain federal statutes offer indirect protection. For instance, the Lanham Act provides protection against false endorsement, which is applicable when someone’s image is used in a way that suggests they endorse a product or service without their consent. Additionally, the COPPA specifically safeguards the personal information and images of children under the age of 13. Beyond federal statutes, image protection is also enforced through common law rights in many states. These common law rights allow individuals to file lawsuits for the unauthorized use of their image, particularly in cases where it invades their privacy or misappropriates their likeness for commercial purposes. In this scenario, and differing from the data perspective, where laws are clearly applicable, future legislation will have to explicitly address the protection of avatars, considering their growing importance as digital representations of personal identity.

From a technical perspective, some authors have addressed this open challenge. In [53], the authors studied the risks posed by the exploitation of behavioral data by malicious actors and presented an attack scenario, in which the clones of NFT avatars were used to compromise privacy, including committing identity theft and the misuse of personal information. To mitigate these risks, the authors proposed a privacy awareness framework that utilized Machine Learning (ML) algorithms to detect and predict privacy threats in real-time, enabling users to protect their digital identities. Similarly, Alqudah et al. [54] developed a tool that used Open Source Intelligence (OSINT), ML, and web scraping techniques to detect and report fake profiles with high accuracy, thereby helping users and organizations protect their digital identities on platforms like Facebook and Instagram.

A relevant real-world case is the issue with Non Fungible Token (NFT) avatars being cloned and used for malicious purposes. In a 2021 case involving CryptoPunks [55], one of the most valuable NFT avatar collections, fake CryptoPunks were created and sold, causing financial loss and identity impersonation in the NFT community. Another example is the widespread deepfake technology, which has been used to clone avatars, mimic real people’s appearances, and deceive other users, leading to identity theft and reputation damage on platforms such as Zoom and social media [56,57].

As a final note, policymakers should work towards establishing clearer definitions and protections for digital identities, treating avatars as extensions of personal data to ensure comprehensive coverage under data protection laws. This could involve implementing stringent guidelines on the collection, storage, and sharing of biometric data from avatars, preventing misuse or unauthorized access by third parties. Additionally, specific protections must be integrated against avatar impersonation and cloning, combining principles from both privacy law and intellectual property rights to address these emerging threats. Furthermore, creating robust oversight mechanisms would ensure that these protections are enforced across international platforms, especially when it comes to regulating cross-border data transfers, thereby enhancing global compliance and accountability in virtual environments.

6. Conclusions

As the metaverse evolves, avatar creation has become integral to user identity and interaction within virtual environments. In this study, we have evaluated, from a practical perspective, various tools for avatar creation, such as VRChat, Ready Player Me, VRoidStudio, Mixamo, Convai, and MetaHuman, focusing on their strengths, limitations, and compatibility with platforms like Unity and Unreal Engine. Selecting appropriate tools based on specific needs for visual fidelity, customization, and platform integration is fundamental to achieve a high quality of the users’ experience. Critical privacy and security concerns, including data collection, identity theft, and the legal implications of avatar usage were also addressed. As avatars become more realistic and integral to virtual experiences, the need for robust privacy protections and legal frameworks becomes increasingly vital. A balance is essential to support the secure and ethical use of avatars as digital identity becomes more prevalent in the metaverse.