Metaverse presents significant opportunities for educational advancement by facilitating immersive, personalized, and interactive learning experiences through technologies such as virtual reality (VR), augmented reality (AR), extended reality (XR), and artificial intelligence (AI). However, this potential is compromised if digital environments fail to uphold individuals’ privacy, autonomy, and equity. Despite their widespread adoption, the privacy implications of these environments remain inadequately understood, both in terms of technical vulnerabilities and legislative challenges, particularly regarding user consent management. Contemporary Metaverse systems collect highly sensitive information, including biometric signals, spatial behavior, motion patterns, and interaction data, often surpassing the granularity captured by traditional social networks. The lack of privacy-by-design solutions, coupled with the complexity of underlying technologies such as VR/AR infrastructures, 3D tracking systems, and AI-driven personalization engines, makes these platforms vulnerable to security breaches, data misuse, and opaque processing practices. This study presents a structured literature review and comparative analysis of privacy risks, consent mechanisms, and digital boundaries in metaverse platforms, with particular attention to educational contexts. We argue that privacy-aware design is essential not only for ethical compliance but also for supporting the long-term sustainability goals of digital education. Our findings aim to inform and support the development of secure, inclusive, and ethically grounded immersive learning environments by providing insights into systemic privacy and policy shortcomings.

The European Union's Cyber Resilience Act (CRA) establishes a comprehensive regulatory framework designed to enhance the cybersecurity of digital products throughout their entire lifecycle. This paper presents a systematic analysis of the technical and organizational requirements imposed by the CRA, offering a structured overview of its provisions and requirements. From this analysis, we derive an architecture that supports a compliance-by-design approach, enabling the CRA obligations to be met from the early stages of product development. This work fills a gap in the literature by providing a generalizable technical perspective on CRA compliance, supporting developers and manufacturers with a clear list of security requirements and a set of architectural guidelines.

The unabated complexity growth of digital regulation worldwide triggered an increased focus on the development and integration of dynamic compliance management techniques into software engineering. This trend is also influenced by the adoption of agile and DevOps methodologies, which raises the necessity of a compliance model that "flows" in parallel with them. Indeed, in a typical industrial environment, compliance analyses are mostly performed at a late stage of the software development process, often resulting in rework due to code rewriting, increasing production costs. In this paper, we explore a framework called ComplOps to automate compliance management in the software development lifecycle. The framework combines concepts of Compliance-as-Code, Compliance by Design, and Infrastructure-as-Code, among others, to impose regulatory analyses at the beginning of the development lifecycle, enabling real-time verification. This paper proposes a formalization of the ComplOps concept and introduces an applicable model that enhances agility and scalability in compliance processes.