A metaverse consists of an interconnected, persistent 3D virtual environment that has many users integrating with the real world and with each other in order to create an ever-evolving virtual reality. In the metaverse, the perception of reality extends rooting on novelty technologies such as augmented reality and blockchain. According to the Pew Research Centre’s latest research, 54% of technology experts believe metaverse, as an actively developing technology, could reach its full potential by 2040 and the global metaverse market is estimated to reach $94.1 billion in 2023, with projections suggesting it could exceed $1 trillion by 2030. Conversely, with this new form of integration, comes significant privacy and data protection challenges such as cyberbullying, human dignity, digital fraud, money-laundering and others. One of them is “Account Takeover”, a type of digital fraud where the perpetrator gains unauthorized access to the user's account, resulting in stealth of personal information, fraudulent transactions or any other use of the account for hostile intentions. However, when such issues arise and disputes take place, the preliminary action would be defining jurisdiction. This article examines the existing privacy and data protection challenges and disputes emerging from the metaverse, with a specific emphasis on account takeover. By doing so, the article aims to detangle the jurisdictional issues regarding metaverse disputes and platform’s role in it.