This paper argues that there are value and design-based problems in current ambitions for the Metaverse. With the Metaverse deepening longstanding commercial surveillance practices, the paper focuses on data protection harms from biometric and emotion data, the gauging of first-person perspectives, and sensitivities around profiling of avatars. The paper advances two notions to address harms and data protection: surveillant physics and virtual realist governance. Surveillant physics refers to surveillance informing the laws of how that reality operates: this is a useful concept given the granular control that platforms have over virtual worlds and the laws by which they function. Virtual realist governance builds on the longstanding principle of virtual realism and David Chalmer’s recent theorising of Reality+ that demands that the virtual is taken to be real, meaning that experiences of virtual objects and what occurs in-world are treated as meaningful. The paper progresses to further consider governance questions, both around technical and ethical standards, but also data protection ideas such as personal data stores, and data trusts, that were not conceived as Metaverse-based ideas, but have greater chance of being realised as basic premises of the Metaverse are being designed. Although this paper is regretfully pessimistic, finding that a root problem of current ambitions for the Metaverse is that the public good and the commons are missing, it sees virtual realist scope for modes of resistance unseen in other digital realms.