Raw gaze data and derived metrics need different retention policies
Aliases: raw gaze · heatmap retention · gaze derivative
What it is
Eye-tracking products split into at least two layers. Raw gaze is coordinates, timestamps, pupil diameter, sometimes eye images, at the sample rate. Derived metrics are heatmaps, total AOI dwell, a session-level load score computed from the raw stream. The two layers differ in re-identification power and in room for later inferences, so retention, access, and permission to upload cannot share one policy. Applying a heatmap’s loose rule to the raw stream keeps the most sensitive layer for the least sensitive reason.
Why it happens
The raw stream keeps the full temporal structure of the scan path and can train new models beyond the collection purpose: tomorrow’s algorithm can read attributes from yesterday’s file that have not been defined today. Derivatives flatten structure—a heatmap drops order, AOI durations drop the path—so re-identification gets harder, though “which class of object was dwelled longer” may still leak. The flatter the transform, the narrower later inference, and the more functions are constrained.
Retention should therefore be graded by “what else can still be made from this,” not by file size. A local, short-TTL raw buffer can support this session’s foveation or this session’s calibration; a raw file uploaded across sessions is almost always more than the function needs. Population-level aggregates re-identify less than a personal heatmap; a personal heatmap less than a personal raw stream.
Studying it
On the same traces, compare what raw replay, a personal heatmap, an AOI vector, and a population aggregate can each support (identity, viewed content, load). Then measure, after deleting raw, which product functions (a gaze cursor, a rendering island, a simple attention heatmap) must stop. This is a function–risk contrast, not an anonymization contest. Time matters: keeping raw for 30 days versus 30 seconds changes both incident replay and the abuse window. “Anonymized” in legal text often still retains re-identifiable derivatives and is not a technical result.
Where it stops holding
Incident investigation, clinical research, or scientific collection under explicit consent may justifiably keep raw longer; that is a separate consent and must not be mixed with product telemetry. Real-time foveation needs a millisecond buffer, which is not “retention.” When the edge device cannot compute derivatives and must send raw to the cloud, the transfer itself is a retention event and should be governed as the raw layer, not as “we only store heatmaps in the end.” Assistive logs that must replay a session to debug false selections should be a user-exportable, user-deletable local package, not a default cloud archive.
Applying it
- Layer it: raw on-device by default, destroyed in minutes or at session end; derived metrics capped by function; long-term only for population aggregates.
- Ban coordinate time series and pupil diameter from the upload list unless there is a separate, switchable research consent.
- Verify by cutting raw storage and walking core functions, listing what still works and what must stop; tabletop an identity and content-inference exercise on whatever is still uploaded.