Zepeto lets users create 3D avatars and hang out in virtual worlds, but the safety risks are real. We tested the app for two weeks on both an iPhone 16 running iOS 18.3 and a Samsung Galaxy S24 on Android 15 to see exactly what kids get exposed to, and the results concerned us.
- Zepeto requires users to be 13+, but has no real age verification system in place
- Public virtual rooms allow direct contact with strangers of any age
- The app collects camera access, location data, and biometric information for avatar creation
- Built-in parental controls are minimal and children can change privacy settings on their own
- In-app currency (ZEMs) creates real spending risk without purchase restrictions enabled by default
#Zepeto Overview and How the App Works
Zepeto is a social app developed by South Korean company Naver Z. Users scan their face to generate a 3D avatar, dress it up, explore virtual worlds, and interact with other players. The app has over 400 million registered users worldwide.
It’s popular with teens and preteens because of brand collaborations with Nike, Gucci, and Disney. Users earn or buy ZEMs (a virtual currency) to purchase outfits and accessories for their avatars.
According to Zepeto’s Guardian’s Guide, the platform uses AI-powered content moderation to filter abuse and hate speech. Real-time chat still slips through.
If your child uses other social apps, check whether TikTok listens to conversations and review the risks of stranger chat apps. These platforms share many of the same contact and privacy issues that make Zepeto risky, and understanding the patterns across apps helps you spot red flags faster.
#Is Zepeto Safe for Kids Under 13?
No. Zepeto’s terms of service set a minimum age of 13 (14 in South Korea). But there’s no ID check or parental consent gate during sign-up. Any child can create an account in under two minutes using a throwaway email address.
We tested this ourselves. Signed up on an iPhone 16 with a generic email and had full access to public rooms within 90 seconds.
Common Sense Media’s privacy evaluation flagged Zepeto for collecting biometric face data from underage users.
For parents already managing screen time, our guide on Android screen time settings covers device-level app restrictions. You can also learn how to disable Screen Time if you need to reset those controls on an iPhone or iPad.
#Biggest Safety Risks on Zepeto
The dangers fall into three categories: stranger contact, inappropriate content, and privacy.
Stranger contact is the top concern. Zepeto’s public “World” rooms let anyone join and chat freely without being friends or followers first. During our testing on a Samsung Galaxy S24 running Android 15, we entered three public rooms and received unsolicited messages within five minutes. One message asked for a personal Instagram handle.
Inappropriate content shows up in user-created worlds and avatar poses. Parent reviews on Common Sense Media describe kids encountering sexual roleplay scenarios.
Privacy is the third concern. Zepeto collects location data and device identifiers. According to Zepeto’s privacy policy (updated November 2025), this data may be shared with advertising partners, and the app also tracks which virtual worlds you visit and for how long, building a detailed behavioral profile of each user over time.
If your child’s account on any platform has been compromised before, our article on what to do when Discord gets hacked walks through recovery steps that apply to most social apps.
#Does Zepeto Have Parental Controls?
Zepeto has some privacy settings, but calling them “parental controls” is generous. Here’s what’s actually available:
Message restrictions let users limit who can send direct messages. The options are All, Following Only, or None. The default is All, so anyone can message your child unless they manually change it.
Profile visibility stays public even on “private” accounts. Display names, avatar appearances, and profile photos remain visible to everyone.
No parental lock. Zepeto doesn’t offer a parent-managed dashboard or any kind of PIN-protected settings. Your child can toggle every privacy setting back to fully open, and you’d never know unless you checked the app yourself.
The most effective controls are at the device level. Apple’s Screen Time and Google’s Family Link let you block the app entirely, set daily time limits, or require purchase approval. If you’ve forgotten your Screen Time passcode, we’ve got a walkthrough for resetting a forgotten Screen Time passcode.
For home network filtering, a parental control router can block Zepeto’s domains across every device in your house.
#Steps to Make Zepeto Safer for Your Child
If your teenager insists on using Zepeto, these steps reduce the risk significantly.
Set messages to “None” or “Following Only.” Open Zepeto, go to Profile > Settings > Privacy, and change the message setting. Done. That alone blocks random users from reaching your child.
Turn off location access. On iPhone, go to Settings > Privacy & Security > Location Services > Zepeto > Never. On Android, go to Settings > Apps > Zepeto > Permissions > Location > Don’t allow. There’s no reason an avatar app needs to know where your child is, and revoking this permission takes about 15 seconds on either platform.
Disable in-app purchases. On iOS, use Screen Time > Content & Privacy Restrictions > iTunes & App Store Purchases > In-app Purchases > Don’t Allow. On Android, open Google Play > Settings > Authentication > Require authentication for purchases.
Review their friend list. Go through followers together. If your child can’t tell you who someone is, remove them.
Talk about what’s off-limits. Explain that sharing personal photos, real names, school names, or other contact info with online strangers is never okay. Kids who understand why a rule exists follow it more consistently than kids who just hear “don’t do that.”
#Zepeto Data Collection and Privacy Concerns
Zepeto’s data collection goes beyond what most parents expect from an avatar app. Based on Zepeto’s privacy policy, the app collects:
- Biometric data from face scans used during avatar creation
- Device identifiers including IP address, device model, and OS version
- Location data (if permissions are granted)
- Usage patterns including which worlds you visit and how long you stay
- Purchase history for ZEM transactions
The privacy policy also states that data may be shared with third-party advertising partners and analytics providers. In South Korea, users under 14 require legal guardian consent. Outside Korea, that rule doesn’t apply.
We checked the app’s permissions on both platforms. On iOS 18.3, Zepeto requested camera, microphone, photo library, and notification access during setup. On Android 15, it went further and also requested location access by default, which we found concerning for an avatar dress-up app targeting a young audience.
If you’re worried about what other apps collect, our breakdown of whether buying from TikTok ads is safe covers similar permission red flags.
#Bottom Line
Zepeto isn’t safe for kids under 13, period. For teenagers, it can work with active parental involvement, but the app won’t do the heavy lifting for you. Set messages to None, disable location access, turn off in-app purchases, and have regular conversations about online safety. Device-level controls through Screen Time or Family Link are more reliable than anything Zepeto offers natively.
#Frequently Asked Questions
#Is Zepeto appropriate for a 10-year-old?
No. Zepeto’s minimum age requirement is 13, and the app has no real age verification. Public rooms expose users to strangers, unfiltered conversations, and user-created content that may include suggestive themes. A 10-year-old lacks the judgment to handle these situations safely.
#Can strangers message my child on Zepeto?
Yes, by default. The message setting starts at “All,” so anyone can send direct messages. Change it to “None” in Privacy settings.
#Does Zepeto use my child’s face data?
Zepeto uses your phone’s camera to scan facial features and generate a 3D avatar. This biometric data is processed during creation. The app’s privacy policy states that face data is used for avatar generation, but parents should be aware this information is collected and stored on their servers.
#How do I delete my child’s Zepeto account?
Go to Profile > Settings > Account > Delete Account. Full deletion takes about 30 days. You can also email Zepeto’s support team to request faster data removal under GDPR or CCPA, though response times vary and you should follow up if you don’t hear back within two weeks. During the 30-day window, the account is deactivated but personal data may still be retained on their servers.
#Is Zepeto free or does it cost money?
Zepeto is free to download and use, but it pushes in-app purchases heavily. ZEMs (the virtual currency) cost real money, and exclusive avatar outfits, accessories, and branded items create pressure to spend. Without purchase restrictions enabled on the device, kids can rack up charges fast.
#What are safer alternatives to Zepeto for kids?
Toca Life World has avatar creation without any chat or stranger contact. Minecraft in offline mode also works. Both have stronger parental controls than Zepeto.
#Can I monitor what my child does on Zepeto?
Zepeto doesn’t offer a parent dashboard or activity log. Your best option is device-level monitoring through Apple Screen Time or Google Family Link, which show app usage time and can restrict access. Sitting with your child while they use the app is the most reliable way to see what they encounter.
#Does Zepeto sell user data to advertisers?
Zepeto’s privacy policy confirms that user data, including device identifiers and usage patterns, may be shared with third-party advertising and analytics partners. The extent of data sharing varies by region due to different privacy regulations like GDPR in Europe and CCPA in California.