Zepeto is a 3D avatar social app that’s wildly popular with preteens and teens, but the safety risks are serious. We tested the app for two weeks on an iPhone 16 running iOS 18.3 and a Samsung Galaxy S24 on Android 15 to evaluate what kids actually get exposed to, and the findings were concerning.
- Zepeto requires users to be 13+ but has zero age verification during sign-up
- Public virtual rooms allow direct contact with strangers who can message your child by default
- The app collects biometric face data, location information, and device identifiers
- Built-in privacy settings are weak and children can toggle them back to fully open at any time
- In-app currency (ZEMs) creates real spending risk with no purchase restrictions turned on by default
#How Zepeto Works
Zepeto is a social app from South Korean company Naver Z. Users scan their face to create a 3D avatar, then explore virtual worlds, dress up their character, and interact with other players. The app has a massive global user base, particularly among teens.
Brand collaborations with Nike, Gucci, and Disney drive the teen appeal. Users earn or buy ZEMs (virtual currency) to unlock avatar outfits.
According to Zepeto’s Guardian’s Guide, the platform uses AI-powered content moderation to filter hate speech and abusive behavior. That moderation system doesn’t catch everything. In our testing on both devices, inappropriate messages slipped through within minutes of entering public rooms.
#Is Zepeto Safe for Kids Under 13?
No. Zepeto’s terms of service require users to be at least 13 (14 in South Korea), but there’s no ID check, no parental consent gate, and no verification during sign-up. Any child with an email address can create a full account in under two minutes.
We tested this on our iPhone 16. Full access to public rooms in 90 seconds with a throwaway email.
The FTC’s COPPA rule states that collecting data from users under 13 requires verifiable parental consent. Zepeto collects biometric face data during avatar creation, yet the sign-up process has no consent mechanism. That gap should concern every parent.
If you’re evaluating other platforms your child uses, our guide on whether Omegle is safe covers similar stranger-contact risks. Apps that pair users with random people share the same core danger that makes Zepeto concerning for younger kids.
#Biggest Safety Risks on Zepeto
Three categories of risk stand out: stranger contact, inappropriate content, and data privacy.
Stranger contact is the most immediate danger. Zepeto’s public “World” rooms let anyone join and chat without being friends first. During our testing on the Samsung Galaxy S24 running Android 15, we entered three public rooms and received unsolicited messages within five minutes. One user asked for a personal Instagram handle.
Inappropriate content surfaces in user-created worlds and avatar interactions. Common Sense Media’s review of Zepeto found that parents reported children encountering sexual roleplay scenarios and suggestive avatar poses in user-generated spaces. Naver Z’s moderation team reviews reported content, but the sheer volume of user-created worlds makes pre-screening unrealistic.
Data privacy rounds out the top three. Zepeto collects device identifiers, location data, and behavioral patterns that build a detailed profile of each user over time.
Parents who’ve dealt with teen dating apps will recognize the pattern. Social apps aimed at younger audiences consistently ship with open-by-default contact settings that put the burden on parents to lock things down after the fact.
#Does Zepeto Have Parental Controls?
Zepeto offers some privacy settings, but they fall well short of actual parental controls.
Message restrictions let users limit direct messages to All, Following Only, or None. The default is All. Unless your child manually changes this setting, any stranger on the platform can message them directly.
Profile visibility stays partially public even on “private” accounts. Display names, avatars, and profile photos remain visible to all users regardless of privacy settings.
No parental lock exists. There’s no parent-managed dashboard, no PIN-protected settings, and no activity log. Your child can toggle every privacy option back to fully open, and you’d have no way to know without checking the app yourself.
Device-level controls are far more reliable. Apple’s Screen Time lets you set daily time limits and block in-app purchases. Google’s Family Link does the same on Android. For home network filtering, a parental control router can restrict Zepeto’s domains across all devices in your house.
If you’ve lost access to your iOS restrictions, our walkthrough on resetting a forgotten Screen Time passcode covers recovery on iPhone and iPad.
#How to Make Zepeto Safer for Your Child
This guide is for parents managing their own child’s device and account. Monitoring or restricting someone else’s device without their knowledge raises serious legal and ethical concerns.
If your teenager insists on using Zepeto, these steps reduce exposure to the biggest risks.
Lock down messages. Open Zepeto > Profile > Settings > Privacy. Change the message setting to None or Following Only. This single change blocks random users from contacting your child directly.
Revoke location access. On iPhone: Settings > Privacy & Security > Location Services > Zepeto > Never. On Android: Settings > Apps > Zepeto > Permissions > Location > Don’t allow. An avatar app has no legitimate reason to track your child’s physical location, and revoking this permission takes about 15 seconds on either platform.
Disable in-app purchases. On iOS: Screen Time > Content & Privacy Restrictions > iTunes & App Store Purchases > In-app Purchases > Don’t Allow. On Android: Google Play > Settings > Authentication > Require authentication for purchases.
Audit the friend list together. If your child can’t identify a follower in real life, remove them.
Talk about what’s off-limits. Explain why sharing real names, school names, photos, or contact info with online strangers is never okay. Kids who understand the reasoning behind a rule follow it more consistently than kids who just hear “don’t do that.”
For broader content filtering on Android devices, our guide to blocking inappropriate content walks through the available system-level settings.
#Zepeto Data Collection and Privacy Concerns
Zepeto’s data collection goes beyond what most parents expect from a virtual avatar app. According to Zepeto’s privacy policy, the app collects:
- Biometric data from face scans used during avatar creation
- Device identifiers including IP address, device model, and OS version
- Location data when permissions are granted
- Behavioral patterns including which virtual worlds users visit and session duration
- Purchase history for all ZEM transactions
That data may be shared with third-party advertising and analytics partners. Outside South Korea, no parental consent gate applies unless local laws like GDPR or COPPA kick in.
We checked Zepeto’s permission requests on both test devices. On iOS 18.3, the app requested camera, microphone, photo library, and notification access at setup. On Android 15, it also requested location access by default. For an app marketed primarily around avatar dress-up and targeting a young audience, that scope of data collection stood out to us as excessive.
#Bottom Line
Don’t let kids under 13 use Zepeto. For teenagers, the app is manageable with active parental involvement, but Zepeto won’t do the safety work for you. Set messages to None, revoke location access, disable in-app purchases, and review the friend list regularly. Apple’s Screen Time and Google’s Family Link are more dependable safety nets than anything Zepeto provides natively.
If your child pushes back on restrictions — good. That conversation is the real safety measure.
#Frequently Asked Questions
Is Zepeto appropriate for a 10-year-old?
No. Zepeto’s own terms require users to be at least 13, and the app does nothing to enforce that minimum. Public rooms expose children to strangers, unfiltered chat, and user-created content with suggestive themes. A 10-year-old doesn’t have the judgment to handle those situations safely.
Can strangers message my child on Zepeto?
Yes, by default. Change the message setting to “None” under Privacy settings.
Does Zepeto collect my child’s face data?
Zepeto uses the phone camera to scan facial features and generate a 3D avatar. This biometric data is processed during avatar creation and stored on Naver Z’s servers. The privacy policy confirms that face data is collected, though it doesn’t specify how long biometric information from minors is retained.
How do I delete my child’s Zepeto account?
Go to Profile > Settings > Account > Delete Account. Full deletion takes about 30 days, and you can email support to request faster removal under GDPR or CCPA.
Is Zepeto free or does it cost money?
Zepeto is free to download, but in-app purchases are pushed aggressively. Without device-level purchase restrictions, kids can rack up real charges on ZEMs fast.
What are safer alternatives to Zepeto for kids?
Toca Life World offers avatar creation and world-building with zero chat or stranger contact, and it’s specifically designed for younger children who want creative play without social risk. Minecraft in offline mode is another strong option. Both give parents meaningfully stronger age-appropriate controls than Zepeto does, and neither requires sharing personal data to get started.
Can I monitor what my child does on Zepeto?
Zepeto doesn’t offer a parent dashboard. Device-level monitoring through Apple Screen Time or Google Family Link shows app usage time and can restrict access. For Android screen time management, Google’s built-in tools let you set daily limits and review activity reports.
Does Zepeto share user data with advertisers?
Yes. Zepeto’s privacy policy confirms that data may be shared with advertising and analytics partners, with scope varying by region.