Gaze traces can infer interest, cognition, and health

What it is

A dense enough gaze trace tells the system more than “where is the cursor.” Scan paths, fixation duration, pupil diameter, and blink rhythm can support inferences about what is interesting, whether reading is effortful, cognitive load, sleepiness, and possible neurological or psychiatric change. Liebling and Preibusch, and later privacy surveys of eye tracking, mark this stream as highly sensitive: it samples cognition and bodily state while the user thinks they are only looking. That is not the same as using gaze as an implicit attention measure to adapt a UI—the latter asks how to use it; this asks what the data can leak.

Why it happens

Fixation duration and regressions correlate with processing depth; pupil size, after lighting is controlled, still moves with load, arousal, and some drugs; scan paths are stable enough in a person to have biometric potential. Clinically, quality of pursuit, saccade velocity, and fixation stability already help observe Parkinson’s, attention-deficit, and post-injury change—which means the same sensors in a consumer device may capture kindred signals. Users cannot easily “not look” the way they can cover a camera; while the eyes are open and facing the tracker, samples accrue.

An inference need not be diagnostically accurate to be a risk. “This shot dilated the pupil” on the ad side, or “this stretch was mind-wandering” at work, will be used as a decision input even at high error rates. Sensitivity comes from being usable as a basis, not from the inference already being medically established.

Studying it

Attack papers try to recover, from traces, the image that was viewed, the identity of a looked-at person, the topic of read text, or a fatigue/load binary. Defense papers measure which features (raw coordinates, heatmaps, AOI durations, pupil) still re-identify a person after de-identification. The survey by Kröger, Lutz, and Müller lists inferable attributes and is a starting threat model. “Can infer” in the lab is not “does infer” in the product; separate model capability, retention, and who actually has access. Experiments in which students watch public pictures underestimate how sensitive traces over medical records, pay slips, or children’s faces are.

Where it stops holding

Very low-rate presence detection (“looking at the screen or not”) leaks much less. Conversely, a consumer headset that ships pupil diameter and high-rate coordinates approaches a research tracker in sensitivity. In some jurisdictions gaze falls under biometric or health data and cannot be classified as “just input coordinates.” Disabled users’ gaze patterns may themselves disclose a diagnosis; an anonymized heatmap may not wash that off. Children cannot meaningfully consent to this class of inference; collection thresholds should be higher.

Applying it

• Write eye tracking in the threat model as a sensor that can infer interest, load, and health, not as an ordinary pointer.
• Do not collect pupil diameter or raw high-rate traces by default unless a function clearly needs them; when needed, derive on-device and upload the derivative.
• Verify by listing stored fields against an inference checklist, confirming that no unused raw quantity remains that would support health or identity inference.

Related

• Same group: C8.07.2 Raw gaze data and derived metrics need different retention policies · C8.07.3 Eye-tracking collection requires disclosure independent of other sensors
• Adjacent: C8.13 Gaze as implicit attention measurement · C9.13 Informed consent and correction of implicit inferences
• Search: eye-tracking privacy · gaze inference · pupillometry