Eye-tracking technology is being increasingly integrated into mixed reality devices. Although critical applications are being enabled, there are significant possibilities for violating user privacy expectations. We show that there is an appreciable risk of unique user identification even under natural viewing conditions in virtual reality. This identification would allow an app to connect a user's personal ID with their work ID without needing their consent, for example. To mitigate such risks we propose a framework that incorporates gatekeeping via the design of the application programming interface and via software-implemented privacy mechanisms. Our results indicate that these mechanisms can reduce the rate of identification from as much as 85% to as low as 30%. The impact of introducing these mechanisms is less than 1.5° error in gaze position for gaze prediction. Gaze data streams can thus be made private while still allowing for gaze prediction, for example, during foveated rendering. Our approach is the first to support privacy-by-design in the flow of eye-tracking data within mixed reality use cases.

中文翻译：

---

一种保护隐私的眼动追踪数据流传输方法

眼动追踪技术正越来越多地集成到混合现实设备中。尽管正在启用关键应用程序，但违反用户隐私期望的可能性很大。我们表明，即使在虚拟现实中的自然观看条件下，也存在识别唯一用户的明显风险。例如，此标识将允许应用程序将用户的个人 ID 与其工作 ID 相关联，而无需征得他们的同意。为了减轻此类风险，我们提出了一个框架，该框架通过应用程序编程接口的设计和软件实现的隐私机制来结合看门。我们的结果表明，这些机制可以将识别率从高达 85% 降低到低至 30%。引入这些机制的影响小于 1。注视预测的注视位置误差为 5°。因此，注视数据流可以是私有的，同时仍然允许注视预测，例如，在注视点渲染期间。我们的方法是第一个在混合现实用例中支持眼动追踪数据流中的隐私设计的方法。