# Differential Privacy for Eye-Tracking Data

## TL;DR

This paper examines privacy risks in eye-tracking data, showing heatmaps do not guarantee privacy and proposing noise mechanisms, especially Gaussian noise, to ensure differential privacy while maintaining utility.

## Contribution

It analytically demonstrates privacy vulnerabilities of heatmaps and introduces two noise mechanisms, with a focus on Gaussian noise, to achieve differential privacy in eye-tracking data.

## Key findings

- Heatmaps do not inherently guarantee privacy.
- Gaussian noise mechanism effectively preserves privacy.
- Proposed mechanisms balance privacy and utility.

## Abstract

As large eye-tracking datasets are created, data privacy is a pressing concern for the eye-tracking community. De-identifying data does not guarantee privacy because multiple datasets can be linked for inferences. A common belief is that aggregating individuals' data into composite representations such as heatmaps protects the individual. However, we analytically examine the privacy of (noise-free) heatmaps and show that they do not guarantee privacy. We further propose two noise mechanisms that guarantee privacy and analyze their privacy-utility tradeoff. Analysis reveals that our Gaussian noise mechanism is an elegant solution to preserve privacy for heatmaps. Our results have implications for interdisciplinary research to create differentially private mechanisms for eye tracking.