The rise of the Metaverse introduces significant challenges to existing data protection frameworks, notably the EU General Data Protection Regulation (GDPR). This chapter explores how the immersive and data-intensive nature of the Metaverse may exacerbate privacy risks through the large-scale collection and inference of personal data, including emotional and behavioral attributes. Key concerns include the regulation of profiling and automated decision-making, transparency of data processing, identification of data controllers, and the evolving nature of user consent. It also questions whether inferred data should be granted the same legal protections as traditional personal data. Moreover, the chapter considers different models of data controllership and reflects on the implications for user autonomy, consent validity, and the effectiveness of rights such as data portability. Concluding, the author urges the need for a coordinated legal response to ensure accountability and protect data subjects in an increasingly complex digital environment.