Eye-tracking collection requires disclosure independent of other sensors

What it is

Headsets and laptops often bundle eye tracking with head tracking, hand tracking, and cameras under one “allow tracking.” Users tick it thinking they are letting the headset know which way they face, and simultaneously open a sensor that can infer reading and pupil change. Independent disclosure means eye-tracking collection has its own explanation, its own switch, and its own visible state, and cannot be carried in on another sensor’s consent. This is the structure of notice before collection, not a retention policy after the fact, and not the functional boundary of using gaze as an attention measure.

Why it happens

Consent fails when bundling compresses different risks into one tick. Head direction is mostly pointing and reprojection, with a narrower leak surface; hands are pose; an RGB camera is appearance. Gaze adds a channel into load, interest, and health inference. Written as one sentence—“this device tracks your motion for immersion”—the user never gets to refuse by risk layer.

Independent disclosure also has to be visible in flight. While IR lamps are on and coordinates are emitted, the UI needs a status in the same class as a microphone light, not a one-time screen at first launch. Otherwise a user who takes glasses off, hands the device to someone else, or walks into a meeting cannot tell whether the channel is still open. On a child account or a shared device, a missing independent switch lets the first consenter decide for everyone after.

Studying it

Contrast bundled consent with per-sensor consent, and test whether people can correctly report “is eye tracking on, what is it for, can I turn it off without losing head tracking.” Then vary status indication (persistent icon, per-session prompt, none) and watch closing behavior and lending behavior. Liebling and Preibusch’s list of privacy design questions for eye tracking can scaffold the questionnaire. Laboratory consent forms are already strong disclosure and will overestimate how well a product checkbox is understood; put the notice in the real system dialog and measure again.

Where it stops holding

Purely local, never-persisted samples that only drive this frame’s rendering still need notice—people have a right to know there is IR and an eye image in front of the face—but the cost of refusal should be turning off foveation and taking a safe fallback, not bricking the device. In accessibility, eye control may be the only input; the switch cannot mean “off equals cannot call for help.” Provide a degraded path and write that dependence into the notice. When IT enables gaze on enterprise devices, the end user’s independent refusal may not exist; notice at least becomes an unskippable explanation plus an appeal channel. Some jurisdictions already require separate biometric consent; bundling may work technically and fail legally.

Applying it

• Split eye tracking out of the master “motion tracking” switch: separate copy, separate toggle, in-flight indicator at microphone grade.
• State purposes (pointing, rendering, analytics) and which functions survive turning it off; do not punish turning gaze off by taking head tracking with it.
• Verify with people who did not design the system, walking first-run setup and a lending scenario, checking that they can turn gaze off without opening help and still navigate by head direction.

Related

• Same group: C8.07.1 Gaze traces can infer interest, cognition, and health · C8.07.2 Raw gaze data and derived metrics need different retention policies
• Adjacent: C7.07 Privacy visibility of voice input · C9.13 Informed consent and correction of implicit inferences
• Search: informed consent · sensor disclosure · eye tracking