>>290455845
It's in the settings
An avatar that is private can't be cloned
And avatar that is public can be cloned if the player using it has set avatar cloning to on

Something to note, VRchat has an API that broadcasts every avatar that is set to public, with a lot of information attached (pic related)