Through the looking glass: eye tracking biometrics and the loss of anonymity in extended reality

Abstract The rapid growth of extended reality (XR), encompassing technologies such as virtual reality (VR) and augmented reality (AR), introduces unprecedented challenges in safeguarding personal user privacy. This study explores the extent to which XR eye-tracking biometric technologies can compromise user anonymity and reveal private identities. Leveraging the GazeBaseVR dataset (Lohr et al. in Sci Data 10(1): 177, 2023), which comprises extensive gaze data from hundreds of users, we extracted a comprehensive set of gaze features–including fixation, saccade, and Savitzky–Golay–based velocity statistics, along with position- and task-related measures–that capture the distinctive dynamics of individual eye movements. Using these features, we trained a simple Multi-Layer Perceptron (MLP) classifier to identify individuals based on their unique eye movement patterns. Our model achieved a high identification accuracy of 96.61% on identifying users while watching a video in a VR environment, underscoring the severe privacy risks posed by XR technologies in their collection and processing of biometric data. Beyond presenting these findings, this research highlights the broader implications of XR eye-tracking on user privacy and advocates robust solutions to address these concerns. We urge technologists, policymakers, and privacy advocates to collaborate in establishing comprehensive regulations and privacy-preserving mechanisms to mitigate the potential misuse of XR biometric data. This work aims to inspire further interdisciplinary research to ensure that technological innovation does not come at the expense of fundamental privacy rights.