Eye-Tracking in Virtual Reality: A Visceral Notice Approach for Protecting Privacy

Evan Selinger, Ely Altman, and Shaun Foster

Privacy Studies Journal

ISSN: 2794-3941

ISSN: 2794-3941

Vol. 2 (2023): 1-31

## Abstract

Eye-tracking is in our future. Across many fields, it is becoming widely used. This paper analyzes eye-tracking in virtual reality and characterizes the results as a case study that illuminates novel privacy risks. Our research question is: How can we support and protect users in this environ -ment? We consider a design strategy originally proposed by Ryan Calo called 'visceral notice' that provides users with an experientially resonant means of understanding privacy threats. To make our case for visceral notice, we proceed as follows. First, we provide a concise account of how eye-tracking works, emphasizing its threat to autonomy and privacy. Second, we discuss the sensitive personal information that eye-tracking reveals, complications that limit what eye-track -ing studies establish, and the comparative advantage large technology companies may have when tracking our eyes. Third, we explain why eye-tracking will likely be crucial for developing virtual reality technology. Fourth, we review Calo's conception of visceral notice and offer suggestions for applying it to virtual reality to help users better appreciate the risks of eye-tracking. Finally, we consider seven objections to our proposals and provide counterpoints to them.

## Key Words

Eye-tracking, privacy, visceral notice, virtual reality, metaverse

## Introduction

David Eggers's fictional satire of Silicon Valley, The  Every ,  presents  an  incident  where a  powerful  technology  company  uses  eye-tracking  technology  to  derail  a  politician's career. A 'vigorous' 'global debate about the ethics of eye tracking' follows. 1 However, as  Eggers  writes,  'anyone  hoping  to  hold  back'  the  technology  'was  proven  a  fool.' 2 Once 'capitalists leaped in' and 'apps and related products' started 'proliferating,' it was too late to prevent technology companies from engineering uncritical societal accep -tance of their vision. 3 It will be tragic if real life ends up imitating art.

Like it or not, eye-tracking is picking up steam. For example, eye-tracking could provide manufacturing companies with insights into the 'cognitive state' of their employees, their situational awareness, their attention, and more, leveraging that data to identify, predict, and eliminate inefficiencies. 4 In light of all the workplace possibilities, eye-track -ing researchers warn that the technology 'should never be used for 'big brother' style monitoring or for evaluative assessments of workplace satisfaction and performance.' 5

Workplace surveillance is just the beginning. Tobii, a prominent Swedish eye-tracking company, claims to 'unlock the future'  by  applying  eye-tracking  to  simulations  that enhance how pilots and doctors are trained in high-intensity but low-risk environments. Eye-tracking could also gauge if drivers are attentive behind the wheel. 6 Additionally, researchers are exploring the possibility of expanding eye-tracking to typical smartpho -nes (no VR headset required). This shift has the potential to increase eye-tracking by 'orders of magnitude.'

During this  eye-tracking  frenzy,  it  is  important  to  look  to  the  future  and  proactively address one of the most concerning applications: virtual reality (henceforth, VR). If the enthusiasm surrounding the metaverse is any indication, VR will likely be one of the largest  eye-tracking  domains.  Currently,  metaverse-oriented  companies  are  investing heavily in VR technology and services. 7 As recently as October of 2022, Meta released their newest VR headset (which has eye-tracking capabilities), the Meta Quest Pro, for a hefty $1,499. 8 A frequently cited estimate predicts 'the collective value' of change that the metaverse will facilitate 'will be in the tens of trillions of dollars.' 9

1 Dave Eggers, The Every (London: Penguin Press, 2021), 360-61.

2 Eggers, The Every , 361.

3 Eggers, The Every , 361.

4 Ting Zheng, Christoph H. Glock, and Eric H. Grosse, 'Opportunities for Using Eye Tracking Technology in Manufacturing and Logistics: Systematic Literature Review and Research Agenda,' Computers & Industrial Engineering 171 (September 1, 2022): 108444. https://doi.org/10.1016/j.cie.2022.108444.

5 Stephen Hutt, Angela E.B. Stewart, Julie Gregg, Stephen Mattingly, and Sidney K. D'Mello, 'Feasibility of Longitudinal Eye-Gaze Tracking in the Workplace,' Proceedings of the ACM on Human-Computer Interaction 6, no. ETRA (May 13, 2022): 148:1-148:21. https://doi.org/10.1145/3530889.

6 Christer Ahlström, Katja Kircher, Marcus Nyström, and Benjamin Wolfe, 'Eye Tracking in Driver Attention Research-How Gaze Data Interpretations Influence What We Learn,' Frontiers in Neuroergonomics 2 (2021). https://www.frontiersin.org/articles/10.3389/fnrgo.2021.778043.

7 Matthew Ball, The Metaverse: And How It Will Revolutionize Everything (New York: Liveright Publishing Corporation, 2022).

While it may be a decade or more before VR goes mainstream outside gaming, enterprise and health products, and specialized simulations, we ought to start thinking about pri -vacy now. Otherwise, it may be too late to enact robust safeguards to mitigate the flow of function creep and the power that special interests will exert over infrastructure and technical standards. Without anticipatory governance, too much control will be ceded to technology companies with poor privacy track records, like Meta, that are prioritizing VR development. As heavily financed first-movers, they will have a powerful influ¬ence on consumer behaviour.

We expect users will face heightened privacy risks in VR. Some problems are familiar, such as companies aggregating sensitive information into big data profiles, weaponizing predictive analytics, and deploying dark patterns. Given how interfaces are often desig -ned and the invisibility of back-end data collection and analysis, people cannot reaso -nably be expected to understand what they agree to and how vulnerable they become when consenting to typical terms of service agreements. Our paper focuses on one of the most important new threats in VR: eye-tracking. As Tom Wheeler, former chairman of the U.S. Federal Communications Commission, notes: 'Meta has already patented tech -nology to build eye tracking and facial expression tracking into the optical equipment worn to access the metaverse … [that] ... could be more revealing than hooking up to a lie detector.' 10

To address the privacy risks that eye-tracking poses, this paper considers the following research question. What are the merits and limitations of a design shift for conveying information in an experientially resonant manner that follows privacy scholar Ryan Calo's 'visceral notice' strategy? We see this as a modest proposal, not a silver bullet. After all, providing robust privacy protections in VR will require many governance mechanisms. 11 Furthermore, since our design recommendations are conjectural, additional interdiscipli -nary testing is required to assess their efficacy.

8 Adi Robertson, 'The Meta Quest Pro Is a Cutting-Edge Headset Looking for an Audience,' The Verge (October 11, 2022). https://www.theverge.com/23393115/meta-quest-pro-vr-headset-hands-on-specs-price.

9 Robertson, 'The Meta Quest' , xv.

10 Tom Wheeler, 'If the Metaverse Is Left Unregulated, Companies Will Track Your Gaze and Emotions,' Time . Accessed September 26, 2022. https://time.com/6188956/metaverse-is-left-unregulated-companies-willtrack-gaze-emotions/.

11 There are no silver bullets for protecting privacy in VR. Even technical approaches for protecting eye-tracking data, like differential privacy, are imperfect and value-laden, and cannot be effectively implemented without notifying users. For more, see Brendan David-John, Diane Hosfelt, Kevin Butler, and Eakta Jain, 'A PrivacyPreserving Approach to Streaming Eye-Tracking Data,' IEEE Transactions on Visualization and Computer Graphics 27,  no.  5  (2021): 2555-65. https://doi.org/10.1109/TVCG.2021.3067787 ;  see  Liu,  et  al,  'Differential Privacy'; see Christina Katsini, Yasmeen Abdrabou, George E. Raptis, Mohamed Khamis, and Florian Alt, 'The Role of Eye Gaze in Security and Privacy Applications: Survey and Future HCI Research Directions,' Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems , 1-21. CHI '20. New York, NY, USA: Association for Computing Machinery, 2020. https://doi.org/10.1145/3313831.3376840.

To make our case for visceral notice, we proceed as follows. First, we provide a con -cise  account  of  how  eye-tracking  works,  emphasizing its threat to autonomy and pri -vacy. Second, we discuss the sensitive personal information that eye-tracking reveals, complications that limit what eye-tracking studies establish, and the comparative advan -tage large technology companies may have when tracking our eyes. Third, we explain why eye-tracking will likely be crucial for developing VR technology. Fourth, we review Calo's conception of visceral notice and offer suggestions for applying it to VR to help users better appreciate eye-tracking risks. Finally, we consider seven objections to our proposals and provide counterpoints to them.

We recognize that eye-tracking exists outside of VR, that eye-tracking data in VR can be combined with additional information, and that even without eye-tracking, companies can collect and analyze a host of sensitive information in VR, including biometric data. 12 Indeed,  researchers  who  constructed  an  escape  room  game  in  VR  to  experimentally determine how many privacy data attributes an attacker can obtain, claim the metaverse presents 'unprecedented privacy risks.' 13 Nevertheless, we limit the scope of our analy -sis to the privacy risks that eye-tracking poses in VR. Our justification is that developing the hardware and software needed to create maximum fidelity and engagement likely means relying heavily on eye-tracking. The confluence between technical requirements and privacy risks makes eye-tracking in VR a topic worthy of its own inquiry - especially because, as we will contend, designers can use the distinctive affordances of the medium (perhaps more effectively than in typical 2D applications) to highlight novel dangers. Relatedly, we recognize that visceral notice in the context of privacy risks is neither a comprehensive nor global solution. Nevertheless, as U.S.-based writers we live in a coun -try where the notice-and-consent regime is central to privacy regulation. Consequently, this is our starting point, and we believe that our analysis of visceral notice's application to eye-tracking risks will have broader value.

## 1. How Eye-Tracking Works

The practice of eye-tracking dates to the late 1800s. 14 Currently, researchers use several methods in controlled laboratory studies. For example, some approaches measure pupil dilation and facial expressions to gauge what users are looking at, how long their attention is captured, and what they feel about what they see. A more accurate method, though, is directly tracking infinitesimal pupil movements with infrared light (henceforth, IR). IR tracking shoots IR light at the eyeball to pinpoint the pupil's location and reveal where the user is looking. There are two ways of gleaning this information: dark pupil and light pupil tracking. 15 If the IR light hits the pupil, a bright spot will reflect the light, revealing the pupil's location. If the IR light does not hit the pupil, the pupil is shown as a dark spot, whereas the rest of the eye is lighter. The main idea is that the technology can discern where the pupil is and where it is moving to, enabling eye-tracking technologies, virtual avatars, and users' digital interfaces to respond appropriately.

12 The hardware supporting this is already emerging: see Scott Hayden, 'Varjo's Enthusiast Grade VR Headset Is Getting a Brain-Computer Interface,' Road to VR (blog), May 31, 2022. https://www.roadtovr.com/varjos-aeroopen-brain-computer-bci/.

13 Vivek Nair, Gonzalo Munilla Garrido, and Dawn Song, 'Exploring the Unprecedented Privacy Risks of the Metaverse,' arXiv, 26 July 2022. https://doi.org/10.48550/arXiv.2207.13176.

14 Jennifer Romano Bergstrom and Andrew Jonathan Schall, Eye Tracking in User Experience Design (Amsterdam: Elsevier, 2014). https://doi.org/https://doi.org/10.1016/C2012-0-06867-6.

It is noteworthy that the field of user experience research characterizes eye-tracking as being at the 'beginning of a golden age' because advances in hardware and software are democratizing eye-tracking. 16 In other words, the technology is becoming so easy to use that it is accessible for people who lack a 'highly advanced understanding of human phy -siology, engineering, and computer science.' 17 Consequently, it is reasonable to anticipate that eye-tracking will become increasingly prevalent.

By following and analysing our pupils, eye-tracking measures a host of involuntary eye movements that users have no autonomy over, including fixations (when users look at one object for an extended period of time), saccades ('rapid eye movements from one fixation point to another, lasting 30 to 80 ms'), smooth pursuits (following a moving object), and many uncontrollable movements (e.g., blinking, blink duration, blink frequency, microt -remors, pupil size, and pupil reactivity). 18

From all these movements, it is unsurprising that only twenty minutes of VR can gene -rate approximately two million data points. 19 For instance, saccades alone haemorrhage data: 'the eye is constantly moving between fixation points,' enabling trackers to collect high amounts of data. 20 Researchers believe that for VR to feel sufficiently comfortable, immersive, and convincing, headsets will need to track individual eye movements more than 90 times per second. 21

To consider the best-case scenario for corporate use of this data, even if we, optimistically and unrealistically, imagine that the companies providing VR services are all good actors and will use this data solely to improve user experience, privacy advocates still might have cause for concern. Since all the aforementioned small eye movements are involun -tary, users are likely to be either unaware of the data they convey or physically unable to prevent it. With Instagram, conscientious users can choose not to like a post, and with Google, it is possible to use ad-blockers or turn off some data collection services. By con -trast,  since  eye-tracking  is  unmediated  by  technological  services  like  incognito  mode and captures uncontrollable data spillage, users have less control over their privacy. 22 Indeed, since it is early days for consumer VR, there currently are no standard privacyenhancing techniques. 23 Given these limitations, heightened privacy risks are likely to follow. For example, while companies might use eye-tracking data for seemingly positive goals beyond optimizing user experience (e.g., improving safety), they could also collect eye-tracking data for targeted marketing. 24 With its wealth of information, eye-tracking technology has been referred to as 'advertising's Holy Grail.' 25 The situation is equally uneasy in cases where users can control their eye movements. Carefully controlling eye movements is 'physically and cognitively tiring,' and the fatigue increases over long periods. 26 Consequently, we may be unable to consciously withhold personal informati -on. 27

15 Brittan  Heller,  'Reimagining  Reality:  Human  Rights  and  Immersive  Technology,'  Carr  Center  Discussion Paper Series, 2020-008, Harvard Kennedy School, June 12, 2020.

16 Bergstrom and Schall, 'Eye Tracking in User Experience Design,' 11.

17 Bergstrom and Schall, 'Eye Tracking in User Experience Design,' 11-12.

18 Frederike Wenzlaff, Peer Briken, and Arne Dekker, ' Video-Based Eye Tracking in Sex Research: A Systematic Literature Review,' The Journal of Sex Research 53, no. 8 (October 12, 2016): 1008-19. https://doi.org/10.108 0/00224499.2015.1107524; Jacob Leon Kröger, Otto Hans-Martin Lutz, and Florian Müller, 'What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking,' in Privacy and Identity Management. Data for Better Living: AI and Privacy , eds. Michael Friedewald, Melek Önen, Eva Lievens, Stephan Krenn, and Samuel Fricker (Cham: Springer International Publishing, 2020), 576:226-41. https://doi.org/10.1007/9783-030-42504-3\_15.

19 Jeremy Bailenson, 'Protecting Nonverbal Data Tracked in Virtual Reality,' JAMA Pediatrics 172, no. 10 (2018): 905-6. https://doi.org/https://doi.org/10.1001/jamapediatrics.2018.1909.

20 Maria Mikhailenko, Nadezhda Maksimenko, and Mikhail Kurushkin, 'Eye-Tracking in Immersive Virtual Reality for Education: A Review of the Current Progress and Applications,' Frontiers in Education 7 (2022). https://www.frontiersin.org/articles/10.3389/feduc.2022.697032.

21 Joseph Jerome and Jeremy Greenberg, 'Privacy & Autonomy Considerations in Emerging, Immersive Digital Worlds,' AUGMENTED REALITY + VIRTUAL REALITY, The Future of Privacy Forum, April 2021. https://fpf.org/wp-content/uploads/2021/04/FPF-ARVR-Report-4.16.21-Digital.pdf.

## 2. What Mined Eye-Tracking Data Reveals

Preliminary controlled studies suggest eye-tracking data can be used to predict a user's gender,  age,  race,  geographic  origin,  certain  mental  and  physical  conditions,  sexual attraction and preferences, personality traits, skills, mental strain, drug use, and certain cognitive processes. 28 Eye-tracking sensors could even identify anonymous users by ana -lysing their irises (which have unique biometric signatures) as well as unique biometric processes like pupil reactivity and gaze velocity. 29 Such data might be capable of predic -ting users' values, interests, and decisions -implicating privacy interests and potentially causing privacy harm.

Sociocultural  norms  can  influence  visual  behaviours,  including  where  people  look and when they avoid meeting another person's gaze. Still, researchers caution against making generalized claims about the impact of background conditions like culture that lack  contextual  sensitivity. 30 Nonetheless,  some of the claims about what eye-tracking can reveal are surprising. According to psychologists, when people of different cultural backgrounds view a video depicting a culturally specific practice, their eye movements reflect whether they are familiar with what they observe. 31 Similarly, researchers found that subtle differences in eye movements occur when subjects view the faces of people from other races and their own race. 32 Finally, when people read languages that are not their native tongue, their eyes move differently compared to native speakers. 33

22 For more on incognito mode in VR, see Vivek Nair, Gonzalo Munilla Garrido, and Dawn Song, 'Going Incognito in the Metaverse,' arXiv, August 19, 2022. https://doi.org/10.48550/arXiv.2208.05604.

23 Mainly data minimization protocols exist now, such as companies requiring developers to obtain a research license to access raw data. Meta's eye-tracking privacy policy appears to be the first one to set permissions broadly.  Meta  allows  Quest  Pro  users  to  turn  eye-tracking  on  (or  not)  and  determine  which  apps  can  use eye-tracking. However, choosing not to use eye-tracking can result in trade-offs, such as access to lower-quality avatars and graphics. Gaming laptops offer eye-tracking as a niche feature for doing things like enabling steam -ers to visualize where they are looking for their fans. But because these are niche behaviours, there currently are no standard privacy-enhancing techniques.

24 Brittan Heller and Avi Bar-Zeev, 'The Problems with Immersive Advertising: In AR/VR, Nobody Knows You Are an Ad,' Journal of Online Trust and Safety 1, no. 1 (October 28, 2021). https://doi.org/10.54501/jots.v1i1.21.

25 Avi Bar-Zeev, 'VR and AR Eye-Tracking Technology Will Usher in a Privacy Dystopia,' Vice (May 28, 2019). https://www.vice.com/en/article/bj9ygv/the-eyes-are-the-prize-eye-tracking-technology-is-advertisings-holygrail.

26 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 3.

27 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 3.

28 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 2.

29 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 2.1.

However, researchers stress that in many cases it is too soon to tell what eye-tracking will  be  able  to  reveal  or  predict  accurately.  Controlled  studies  contain  confounding variables.  For  example,  there  are  many  reasons  why  eyes  dilate,  and  researchers could  misinterpret  whether  dilated  eyes  signal  desire  or  fear.  Additionally,  some inference  methods  have  yet  to  be  implemented  outside  of  controlled  conditions. 34

The  limits  of  current  eye-tracking  research  point  towards  two  ominous  possibilities. Some start-ups and smaller app developers could follow the AI trend of creating 'snake oil' eye-tracking applications that are riddled with incorrect or incomplete descriptions of  the  technology's  power. 35 The  scientifically  unsound  or  incorrect  eye-tracking  infe -rences that result could end up negatively impacting lives, much like we have already seen with misapplications of biometric data. 36 Conversely, since big tech companies have access to massive user data, highly advanced machine learning algorithms, and substan -tial latitude to experiment with their information, they likely are better equipped to gene -rate more accurate predictions than the ones catalogued in peer-reviewed literature. This difference suggests our current understanding of eye-tracking's capabilities and harms is both underdeveloped and, worryingly, an underestimate. 37

30 Jennifer X. Haensel, Tim J. Smith, and Atsushi Senju, 'Cultural Differences in Mutual Gaze during Faceto-Face Interactions: A Dual Head-Mounted Eye-Tracking Study,' Visual Cognition 30, no. 1-2 (February 7, 2022): 100-115. https://doi.org/10.1080/13506285.2021.1928354.

31 Omid Kardan, Laura Shneidman, Sheila Krogh-Jespersen, Suzanne Gaskins, Marc G. Berman, and Amanda Woodward, 'Cultural and Developmental Influences on Overt Visual Attention to Videos,' Scientific Reports 7, no. 1 (2017): 11264. https://doi.org/10.1038/s41598-017-11570-w.

32 Stephen D. Goldinger, Yi He, and Megan H. Papesh, 'Deficits in Cross-Race Face Learning: Insights from Eye Movements and Pupillometry,' Journal of Experimental Psychology: Learning, Memory, and Cognition 35, no. 5 (2009): 1105-22. https://doi.org/10.1037/a0016548; Peter J. Hills and J. Michael Pake, 'Eye-Tracking the Own-Race Bias in Face Recognition: Revealing the Perceptual and Socio-Cognitive Mechanisms,' Cognition 129, no. 3 (2013): 586-97. https://doi.org/10.1016/j.cognition.2013.08.012; Esther Xiu Wen Wu, Bruno Laeng, and Svein Magnussen, 'Through the Eyes of the Own-Race Bias: Eye-Tracking and Pupillometry during Face Recognition,' Social Neuroscience 7, no. 2 (2012): 202-16. https://doi.org/10.1080/17470919.2011.596946.

33 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 2.4.

34 Kröger, Lutz, and Müller, 'What Does Your Gaze Reveal,' section 3.

35 Frederike Kaltheuner, 'AI snake oil, pseudoscience and hype (an interview with Arvind Narayanan),' in Fake AI , ed. Frederike Kaltheuner (Manchester, UK: Meatspace Press, 2021). https://fakeaibook.com.

36 Luke Stark and Jevan Hutson, 'Physiognomic Artificial Intelligence,' Fordham Intellectual Property, Media and Entertainment Law Journal 32, no. 4 (January 1, 2022): 922. https://ir.lawnet.fordham.edu/iplj/vol32/iss4/2.

37 Stark and Hutson, 'Physiognomic Artificial Intelligence'.

## 3. The Future of VR, Eye-Tracking, and Privacy

VR developers and theorists are pursuing an ambitious goal. Philosopher David Chal -mers identifies the endpoint by speculating that 'within a century we will have virtual realities that are indistinguishable from the nonvirtual world.' 38 Even if this is an overambitious projection, it is reasonable to expect future VR designers to attempt to create lifelike immersive worlds. Immersive VR is commonly defined as a sensory experience within a computer-generated world that is 'almost real and believable' compared to the physical world. 39 Creating immersive VR requires advances in software and hardware, and likely, increased eye-tracking.

## 3a. Eye-Tracking is Essential to The Future of VR

There are many reasons why eye-tracking is essential to the future of VR. For starters, it will help create immersive VR through foveated rendering. Foveated rendering mimics how human eyes work by blurring our peripheral vision to create a central and vibrant focus. 40 Additionally, foveated rendering will help reduce simulation sickness, a phenom -enon that occurs if the focus, rendering, visuals, or hardware are incorrectly calibrated. 41 To make immersive VR mainstream, developers must minimize, if not stop simulation sickness. 42

Additionally, foveated rendering potentially can reduce the computing cost of VR signi -ficantly. If eye-tracking can identify where our eyes are focused, foveated rendering can deprioritize detail in areas outside the user's focus, potentially making the technology more feasible to mass produce at high quality. 43

Eye-tracking can also make it easier to direct and control content. For instance, new inter -faces like direct gaze 'gesture' interactions will improve interactivity and user experi -ence. Suppose users could manipulate VR content with their eyes (e.g., open drop-down menus by looking in the corner or teleporting by blinking several times). Then, VR could be  less  physically  taxing  than  the  alternative  of  gesturing  with  controllers  for  hours.

38 David J. Chalmers, Reality +: Virtual Worlds and the Problems of Philosophy (New York: W.W. Norton & Company, 2022), xiii-xiv.

39 Borko Furht, ed., 'Immersive Virtual Reality,' in Encyclopedia of Multimedia (Boston, MA: Springer US, 2008), 345-46. https://doi.org/10.1007/978-0-387-78414-4\_85.

40 Heller, 'Reimagining Reality,' 3.

41 Heller, 'Reimagining Reality,' 5.

42 Preliminary research suggests that simulation sickness may disparately impact women who are often underrepresented in VR research ( see Niall L. Williams and Tabitha C. Peck, 'Estimation of Rotation Gain Thresholds Considering FOV, Gender, and Distractors,' IEEE Transactions on Visualization and Computer Graphics 25, no. 11 (2019): 3158-68. https://doi.org/10.1109/TVCG.2019.2932213; Tabitha C. Peck, Laura E. Sockol, and Sarah M. Hancock, 'Mind the Gap: The Underrepresentation of Female Participants and Authors in Virtual Reality Research,' IEEE Transactions on Visualization and Computer Graphics 26,  no.  5  (2020):  1945-54. https://doi.org/10.1109/TVCG.2020.2973498) as well as people with medical conditions and disabilities ( see Imtiaz Muhammad Arafat, Sharif Mohammad Ferdous, and John Quarles, 'The Effects of Cybersickness on Persons with Multiple Sclerosis,' Proceedings of the 22nd ACM Conference on Virtual Reality Software and Technology (2016): 51-59. https://doi.org/https://doi.org/10.1145/2993369.2993383).

43 Jerome and Greenberg, 'Privacy & Autonomy Considerations,' 16.

While eye strain is a serious issue, eye-tracking can be a form of control that other sensory modalities support, such as voice and touch.

Other possibilities also exist for using eye-tracking to control content. Recall that the goal of lifelike immersive VR is to feel indistinguishable from physical reality. To achieve this state, the technology likely will trend towards systems that are incredibly easy to use, also known as systems that enable 'ultra-low-friction' input. 44 Consider  Meta's  'intel -ligent click.' 45 Using intelligent click, AI-infused software might be able to anticipate our desires. The intelligent click would only require users to click a button. Using predictive software, the system is supposed to do what we want, when we want, without the need to communicate anything explicitly. Gaze, analysed through eye-tracking, will likely be critical for sensing our intent and executing this functionality.

In the past, much of predictive eye-tracking relied on knowledge of the environment and the gaze point. 46 However, recently, researchers could predict interactions using only gaze, 'independent of any knowledge of the eye's location or the gazed-upon object.' 47 These calculations require incredible computing power. And it will take time until eye-tracking technology can produce a mainstream 'intelligent click.' However, recent research has found a 'hidden structure in gaze,' which can be used to predict future gazes. 48 The -refore, even though predictive eye-tracking may seem very sci-fi, it may not be that far away. And crucially, if predictive eye-tracking is popularized and integrated into lots of our technology, it seems patently clear that eye-tracking may be here to stay.

Another benefit is that eye contact, one of the most important forms of non-verbal commu -nication, might also be enabled by eye-tracking. 49 If VR avatars could meet our gaze in a manner that mimics regular human eye contact, VR social interaction might feel far more satisfying.

44 Lisa Brown Jaloza, 'Inside Facebook Reality Labs: Wrist-Based Interaction for the next Computing Platform,' Tech at Meta, March 18, 2021. https://tech.fb.com/ar-vr/2021/03/inside-facebook-reality-labs-wrist-based-interaction-for-the-next-computing-platform/.

45 Meta's description of intelligent click occurs in the context of proposing ideas for a smart wristwatch. For more information, see Jaloza, 'Inside Facebook.' Although Meta has canceled its smartwatch ( see Florence Ion, 'Meta's Smartwatch Is Dead Before It Can Even Compete (Report),' Gizmodo, June 9, 2022. https://gizmodo.com/meta-facebook-smartwatch-ar-glasses-portal-cancelled-de-1849041987.),  the  company  can  apply the research and development it conducted to create it elsewhere.

46 Brendan David-John, Candace Peacock, Ting Zhang, T. Scott Murdison, Hrvoje Benko, and Tanya R. Jonker, 'Towards Gaze-Based Prediction of the Intent to Interact in Virtual Reality,' ETRA Short Papers, ACM Symposium on Eye Tracking Research and Applications,  May  2021,  article  2.  https://doi.org/https://dl.acm.org/ doi/10.1145/3448018.3458008.

47 David-John, et, al. 'Towards Gaze-Based Prediction,' 5.

48 Gabor Lengyel, Kevin Carlberg, Majed Samad, and Tanya Jonker, 'Predicting Visual Attention Using the Hidden  Structure  in  Eye-Gaze  Dynamics,'  2021.  https://tanyajonker.com/assets/publications/Lengyal\_et\_ al\_2021\_EMICS.pdf.

49 Maha Elgarf, Slim Abdennadher, and Menna Elshahawy, 'I-Interact: A Virtual Reality Serious Game for Eye Contact Improvement for Children with Social Impairment,' in Serious Games , eds. Mariano Alcañiz, Stefan Göbel, Minhua Ma, Manuel Fradinho Oliveira, Jannicke Baalsrud Hauge, and Tim Marsh (Cham: Springer International  Publishing,  2017),  10622:146-57.  https://doi.org/10.1007/978-3-319-70111-0\_14;  MiaolongYuan, Gim Guan Chua, Farzam Farbiz, and Susanto Rahardja, 'Eye Contact with a Virtual Character Using a VisionBased Head Tracker,' in Computer and Information Sciences , eds. Erol Gelenbe, Ricardo Lent, Georgia Sakellari,  Ahmet  Sacan,  Hakki  Toroslu,  and  Adnan  Yazici  (Dordrecht:  Springer  Netherlands,  2011),  62:217-25. https://doi.org/10.1007/978-90-481-9794-1\_43.

Still, research indicates that technology needs further refinement before VR avatar eye contact feels right. A study from Tampere University in Finland found that eye contact with VR avatars does not elicit the same physiological responses (e.g., momentarily slower heart rate and increased skin conductance) that eye contact with people generates. Alt -hough the researchers also note that this discrepancy might exist for a reason that may not apply to future technology-namely, online avatars currently do not look convincingly lifelike. 50 To be sure, creating lifelike avatars will be difficult. It requires replicating fea -tures like micro expressions around the eyes and avoiding the psychologically uncom -fortable design qualities of the uncanny valley. Still, it is not an impossible task. In sum, as VR avatars continue to improve and enhance social presence, their ability to meet our gaze will become more important, and eye-tracking likely will be critical to facilitating convincing interactions and conversations with them.

Innovators hope that someday VR will provide better options for some activities than physical reality.  For  example,  education may get an upgrade if students can take rea -listic  and  engaging  VR  tours  of  places  they  otherwise  could  not  visit-such  as  being led  by  an  avatar  of  Jane  Goodall  through  a  simulated  Gombe  Stream  National  Park in Tanzania. 51 Or dating could get more interesting if you could meet up with some -one  in  a  simulated  version  of  Paris  or  the  moon,  instead  of  a  local  cafe. 52 Indeed, Chalmers  goes  so  far  as  to  predict  that  VR  'resolution  will  get  better,  until  a  vir -tual  world  looks  exactly  like  a  nonvirtual  world  …We  may  spend  much  of  our  lives in  these  environments,  whether  for  work,  socializing,  or  entertainment.' 53   VR  eyetracking  promises  to  improve  immersion  and  feedback  to  these  types  of  activities.

To achieve this heightened level of immersion, VR technology should be able to sense, process, and respond to many of the small signals our actions, words, and eyes broadcast into the world. During casual in-person conversations, we often subconsciously notice and react to slight tells that many people have. For example, if someone's eyes continually flick to the side and ceiling while you speak to them, it is reasonable to presume they are not entirely focused or might be nervous. Eye-tracking must capture and accurately represent these small movements virtually so other users can see them and respond. Additionally, to generate a 'context appropriate interaction,' with computer-generated non-player  characters  (NPCs),  VR  software  should  be  capable  of  inferring  whether  a user's stare is aggressive, inquisitive, or fearful. Conversations with NPCs could be far more engaging if technology could discern when our glances signify interest (as opposed to revulsion) and tailor appropriate responses based on that information. In short, VR likely will rely heavily on eye-tracking to generate compelling and engaging VR experi -ences.

50 Aleksi H. Syrjämäki, Poika Isokoski, Veikko Surakka, Tytti P. Pasanen, and Jari K. Hietanen, 'Eye Contact in Virtual Reality - A Psychophysiological Study,' Computers in Human Behavior 112 (2020): 106454. https://doi. org/10.1016/j.chb.2020.106454.

51 Ball, The Metaverse , 253-254.

52 Ball, The Metaverse , 255.

53 Chalmers, Reality +: , xiii.

## 3b. Privacy Dangers of Eye-Tracking in VR

Eye-tracking has been compared to an uncontrollable like button, signalling tons of inti -mate information without a person's knowledge or consent. 54 Brittan Heller aptly coined the concept 'biometric psychography' to characterize the situation, defining biometric psychography as 'the gathering and use of biological data, paired with the stimuli that caused a biological reaction, to determine users' preferences, likes, and dislikes.' 55 In the hands of advertisers, biometric psychography could supercharge targeting advertising, behavioural modification, and privacy violations. Fundamentally, users face heightened privacy risks in VR, many of which they are unprepared for and currently have little to no recourse to combat.

After all, common boundaries that people deploy in physical reality to protect their pri -vacy do not apply in VR. 56 In daily life, for the most part, the threat of sustained eyetracking is as remote as the danger of telepathy. Furthermore, in special cases where it is prudent to prevent others from monitoring our eyes, like high-stakes poker, one can use physical barriers that might not exist in VR, such as protective dark glasses. Whether VR offers eye-tracking barriers will depend on what governance mechanisms are adopted. 57 Moreover, even if users are given easy-to-access settings for turning off eye-tracking, the practical costs for using those settings may be too high; programs that become necessary for work, school, socializing, or providing accessibility for users with disabilities could lose critical functionality.

More pertinently, people will have difficulty grasping the new VR eye-tracking privacy threats if their disclosure is buried in the long and dense terms of service agreements that over 90% of consumers never read. 58 Simply put, we are concerned that users will still lack a meaningful understanding of the risks, even if they are explained. The problem is exacerbated by the fact that while eye-tracking on its own can be invasive, we should expect eye-tracking data to be aggregated with additional biometric information. If our eyes, voices, movements, and faces are surveilled in VR, privacy will be exceptionally hard to protect. 59 To address these issues, we will consider a novel approach to presenting information about eye-tracking to users in VR.

54 Brittan Heller, 'Watching Androids Dream of Electric Sheep: Immersive Technology, Biometric Psychography, and the Law,' Vanderbilt Journal of Entertainment & Technology Law 23, no. 1 (December 1, 2020): 1. https:// scholarship.law.vanderbilt.edu/jetlaw/vol23/iss1/1.

55 Heller, 'Watching Androids Dream,' 6.

56 For more on the boundary management framework for protecting privacy, see Margot Kaminski, 'Regulating Real-World Surveillance,' Washington Law Review (January  1,  2015):  1132-35.  https://scholar.law.colorado. edu/faculty-articles/405.

57 Potential design techniques exist to protect users' identity while retaining eye-tracking functionality, such as changing angle and distance cameras creating optical defocus (see: Brendan John, Sanjeev Koppal, and Eakta Jain.  'EyeVEIL: Degrading Iris Authentication in Eye Tracking Headsets,' 2019. https://jainlab.cise.ufl.edu/ documents/2019\_ETRA\_pre\_print\_eyeVEIL.pdf.),  or  developers  could  introduce  pixel  noise  to  the  iris  to decrease recognition of specific irises (see Brendan David-John, Ao Liu, and Lirong Xia, 'Let It Snow: Adding Pixel Noise to Protect the User's Identity,' 2020. https://www.researchgate.net/publication/341830854\_Let\_It\_ Snow\_Adding\_pixel\_ noise\_to\_protect\_the\_user's\_identity.).

58 Caroline Cakebread, 'You're Not Alone, No One Reads Terms of Service Agreements,' Insider (2017). https:// www.businessinsider.com/deloitte-study-91-percent-agree-terms-of-service-witho ut-reading-2017-11.

## 4. Visceral Notice

Ryan Calo conceived of 'visceral notice' as a potentially helpful strategy to get the majo -rity of people that currently ignore privacy policies to more fully engage and compre -hend them. Unlike inaccessible terms of service agreements that are lengthy and filled with legal jargon, visceral notice triggers familiar sensory experiences, delivering critical information. Crucially, Calo contends, 'the goal of visceral notice is not to manipulate pre -ferences but to give consumers the information they need to act upon their preferences.' 60 In other words, visceral notices should only be used as a tool to increase user awareness and comprehension of risks. It should not be deployed to intentionally modify behaviour like nudges. 61

At a basic level, visceral notice can be understood in phenomenological terms because it draws from familiar, embodied experience. Calo provides a clear example of pain as information. Imagine a world where we receive a text-based 'alert' that our body was in pain instead of feeling an intense first-person sensation. We can easily tune out the mes -sage - much like the flood of privacy notices that saturate our inboxes. Yes, pain is unple -asant, but it also has utility. Sometimes, we can benefit from acknowledging what pain communicates and be grateful that, discomforting as it may be, it grabs our attention. 62

In some contexts, regulators already appreciate the benefits of visceral notice. For example, rumble strips on highways notify car drivers that they are moving off the main lanes and towards potential danger. While drivers can ignore traffic signs or roads that gradually trail off, rumble strips provide a visceral notice by triggering disconcerting sounds and vibrations. 63

Calo contends visceral notice can be applied to digital privacy policies, and outlines three main design methods to implement it: familiarity as warning, psychological response as a form of notice, and showing. 64 We will explore each modality, offer suggestions for applying them to VR and eye-tracking, and consider objections to enhancing privacy through visceral notice.

59 For more on voice surveillance in VR, see Jacob Leon Kröger, Otto Hans-Martin Lutz, and Philip Raschke, 'Privacy Implications of Voice and Speech Analysis - Information Disclosure by Inference,' in Privacy and Identity Management. Data for Better Living: AI and Privacy , eds. Michael Friedewald, Melek Önen, Eva Lievens, Stephan Krenn, and Samuel Fricker (Cham: Springer International Publishing, 2020), 576:242-58. https:// doi.org/10.1007/978-3-030-42504-3\_16. For movement surveillance, see Jacob Leon Kröger, Philip Raschke, and Towhidur Rahman Bhuiyan, 'Privacy Implications of Accelerometer Data: A Review of Possible Inferences,' Proceedings of the 3rd International Conference on Cryptography, Security and Privacy , ICCSP '19. New York, NY: Association for Computing Machinery, 2019, 81-87. https://doi.org/10.1145/3309074.3309076. For face surveillance, see Evan Selinger and Woodrow Hartzog, 'The Inconsentability of Facial Surveillance,' SSRN Scholarly Paper. Rochester, NY, March 19, 2020. https://papers.ssrn.com/abstract=3557508.

60 Ryan Calo, 'Against Notice Skepticism In Privacy (And Elsewhere),' Notre Dame Law Review 1027 (March 21, 2011): 1046. https://papers.ssrn.com/sol3/papers.cfm?abstract\_id=1790144.

61 For more on how nudges modify behavior, see: Evan Selinger and Kyle Whyte, 'Is There a Right Way to Nudge? The Practice and Ethics of Choice Architecture: Practice and Ethics of Choice Architecture,' Sociology Compass 5, no. 10 (2011): 923-35. https://doi.org/10.1111/j.1751-9020.2011.00413.x.

62 Calo, 'Against Notice Skepticism,' 1034.

63 Calo, 'Against Notice Skepticism,' 1034

## 4a. Experientially Enhancing Sensitivity to The Privacy Risks of Eye-Tracking

Because people are unaccustomed to having their eyes persistently tracked, it is crucial to notify them of this new mode of monitoring in VR. For the visceral experience to effec -tively convey the new threat, it should have two features. It should be attention-grabbing, and it should incorporate the specific privacy risk it is warning against. Fortunately, there is a simple way to combine both elements in VR.

Consider a typical online experience. We have become used to quickly skipping past the wording of online contracts and racing towards clicking the 'I agree' button, and privacy scholars claim that the experience has conditioned us to behave like simple input-out -put machines. 65 See the button, click the button. Do not bother to try to comprehend the terms, much less think about whether they are fair or even cost-benefit justified. Instead of seeing the offering as a negotiation, we experience it as background noise or a frustra -ting nuisance that delays our use of a desired product or service. The act of notice needs to be done differently - in a way that disrupts our auto-pilot habit and encourages us to reflect on what we are doing. For the experience to include the needed specificity that is appropriate to the future of VR, it must involve eye-tracking.

To combine both features, VR designers could display the terms of service contract in a new way. To move through the terms, users could use their eyes. As their tracked eyes scan the words, the contract will scroll up or down, depending on where attention gets directed. When someone is ready to sign off and accept the agreement, they would need to perform a visual feat that signals affirmative intention - something more robust than blinking over a 3-D 'I agree button.' One possibility is to present users with numbers arranged at different heights. To convey agreement, users would need to move their eyes over each number in the correct sequence - a process that utilizes the user-experience design  technique  of  productive  friction,  requires  concentration,  and  is  unlikely  to  be accomplished by accidental or random behaviour.

This process is better suited to helping people appreciate that their eyes will be tracked than to understanding the range of privacy risks associated with eye-tracking data. After all, the contract still can contain features that limit intelligibility, like boilerplate jargon. Consequently, the contract should be limited to providing the most minimal level of per -missions. Ideally, when users buy VR hardware and turn it on for the first time, the tech -nology should guide them through an interactive 20- to 30-minute session that acquaints them with specific risks (see section 4b). This session could resemble the training screen users enter before playing a new video game. Here, they would be given further sensi - Incemnification Cin You agron bo inc or damage of Eye Tracking Intem You ug un data, interest mapping.

64 Calo, 'Against Notice Skepticism,' 1035, 1038, and 1041.

65 Brett M. Frischmann and Evan Selinger, Re-Engineering Humanity (Cambridge: Cambridge University Press, 2019), 60-80.

Tomation, focus dok

(Figure 1) Terms of Service

<!-- image -->

tizing experiences that acquaint them with the privacy risks before being prompted to agree to more data-intensive conditions. Once they agree, we recommend further imple -mentation of visceral notice features within the user interface of VR to continuously alert users to privacy threats.

To ensure that users receive ongoing visceral notice privacy updates after buying VR technology, we suggest that developers and companies consider implementing visceral notice as a continuous and iterative design process. Ideally, with each software update (like periodic Apple IOS updates), companies could release an updated visceral notice privacy tutorial and updated visceral notice design features on the user interface.

In sum, we have provided three general proposals about how visceral reality could alert users of privacy risks. The first proposal entails modifying standard terms of service agreements by allowing eye movements to convey agreement. The second entails institu -ting an initial VR safety visceral notice tutorial when users buy new products. The third incorporates  visceral  notice  features  within  VR  interfaces.  Using  Calo's  three  visceral notice ideas, we will clarify how to implement our proposals. The recommendations are non-exhaustive and have not been tested. We aim to begin a critical discussion around visceral notice for eye-tracking and VR. We hope future research further refines the sug -gestions.

## 4b. Showing

By showing, Calo means using narrative and other demonstration techniques to pre -sent negative consequences or vulnerabilities in emotionally resonant ways. For example, Calo suggests that a company that provides loans can do more for consumers than merely disclose basic information, such as interest rates. 'We can imagine further inputs - for instance, what will happen to this or that borrower should he miss a payment or if inte - rest rates change - to dramatize other terms of the deal on offer.' 66 The idea is that design features that demonstrate to a user how a problem would affect them specifically, are likely to cause a more visceral response and understanding. We will offer several hypo -thetical ways to apply this strategy to eye-tracking in VR.

Our first suggestion is to have users viscerally confront the meaning of their eyes being tracked in the privacy training module described previously. In a potential immersive VR privacy module, users might find themselves standing on a pillar raised hundreds of feet. Beneath them, a crowd of people are looking at them, and before them are large TV screens, suspended in the air which are all recording and playing the users' cur -rent movements. After a short interval of this disorientating experience, the screen could present to the user relevant data and analytics concerning the scenario in the privacy module.

(Figure 2) Raised Pillar

<!-- image -->

Alternatively, users could be placed in a virtual art gallery containing different painting styles (e.g., abstract and figurative), sculptures of human faces with varying skin tones, and strategically placed products. Users can be instructed to walk around and browse the exhibition. After a brief time, they are then presented with crucial eye-tracking infor -mation, ranging from heat maps illustrating where they were looking to statistics repre -senting what they saw. The goal is to sensitize people to what eye-tracking can reveal and how seemingly innocuous visual activity can be surveilled and analysed, with rapid but not necessarily accurate assumptions generated about interests. Imagine you focu -sed primarily on the figurative paintings and light-skinned sculptures. There could be several reasons why this happened. Maybe you are not a fan of cubism, or perhaps you like cubism, but the paintings in the gallery were constructed too poorly for your taste. Maybe you have biases, or perhaps you simply favoured the lighter-skinned sculptures because the lighting made them more visually pronounced. There are lots of possibili -ties. Hopefully, the experience (and perhaps some accompanying narrative) will prompt Current Gathered Data Resisto:

66 Calo, 'Against Notice Skepticism,' 1042.

54%

(Figure 3) Art Gallery

<!-- image -->

users to consider whether companies should have the power over this information and increase awareness of the privacy risks in VR.

Designers can further tweak the scenario so that it aligns more directly with Calo's loan example - an example that renders salient a harm that unfolds over time. Consider one of the most challenging privacy issues: helping individuals understand that individual actions can have profound long-term societal impacts. To illustrate this point through showing, users could re-enter the art exhibition after being presented with the initial core eye-tracking information. Now, the virtual space will have changed. If users pre -viously looked more at figurative than abstract art, this time, only figurative art will be displayed. Or, if users looked more at light-skinned than dark-skinned sculptures, only light-skinned ones are displayed. Having had a chance to explore the updated environ -ment, users are presented with an explanation for the change: the gallery has been alte -red to showcase seemingly preferential content. The experience could prompt the user to think critically about whether it is a good idea to engage in activities that exacerbate the influence of bias and lead to virtual worlds having less diversity.

## 4c. Familiarity as Warning

Another visceral notice method, familiarity as warning , is used by designers to 'leverage the  individual's  familiarity  with  a  previous  technology  to  realign  expectations  with reality.' 67 For example, we are accustomed to microwaves emitting a noise when they are done; we are used to blue text on a website indicating a hyperlink; 68 and with newer cars, we expect a little beeping sound when our cars are in reverse. 69 These expectations prime Privacy Alert: Eye-Tracking is Active us to respond appropriately to the situation at hand. Each of our responding 'interventi -ons' is a conscious and intentional design choice intended to elicit specific behaviours. 70

67 Calo, 'Against Notice Skepticism,' 1037; for more on how this concept is applied to standardizing XR safety, see https://www.theinformation.com/articles/we-need-a-911-for-the-metaverse.

68 Calo, 'Against Notice Skepticism,' 1035.

69 Calo, 'Against Notice Skepticism,' 1036.

We can apply the same idea to privacy with eye-tracking by capitalizing on users' fami -liarity with previous indicators that prime them to privacy-awareness to encourage them to be more conscious and careful with immersive VR technology. Basically, users must grasp that their behaviour is being surveilled and data-mined. One way to do this is to leverage a helpful design feature that became popular during the pandemic. The video conferencing platform Zoom provides an audio alert that announces 'recording in pro -gress,' adding the visual element of a pulsing red circle next to 'Recording…' The notice is attention-grabbing for two reasons. It is multi-sensory (and thus more accessible than one that only stimulates one sense). Additionally, the circle evokes the recording feature

on Apple's 'voice memos,' and the dot  is  reminiscent  of  the  one  sig -nifying that the camera feature is enabled.  In  VR,  similar  elements could be adapted to say something like 'Surveillance and Data Mining in Process.'

To  focus  the  user's  attention  on eye-tracking, designers could com -bine  the  pulsing  circle  icon  with an image of a watchful eye in the shape of a 3-D bright red eye icon. The eye icons should constantly be moving  around,  just  like  human

(Figure 4) Alert: Eye-Tracking is Active

<!-- image -->

eyes. Next to the icons, designers could insert text that conveys something like: ' Alert: Eye-Tracking is Active,' using fonts and colours that are familiar from other warnings.

## 4d. Psychological Response as Notice

Using the strategy ' psychological response as a notice ' designers can 'leverage … visual and audio clues' that people respond to 'in specific, predictable ways' to advance a con -sumer's understanding of how a new technology functions and the risks it poses. 71 For example, studies show that people psychologically respond to technology with anthro -pomorphic features as if dealing with an actual person. 72 Consequently, Calo notes, since 'people are routinely being tracked by a variety of companies and other parties, but do not realize they are,' adding 'an anthropomorphic cue could drive home the fact of tracking in a way that privacy policies cannot.' 73

70 Calo, 'Against Notice Skepticism,' 1035.

71 Calo, 'Against Notice Skepticism,' 1038.

72 Calo, 'Against Notice Skepticism,' 1038.

73 Calo, 'Against Notice Skepticism,' 1039.

One anthropomorphic cue that Calo suggests is to have a little avatar run across the screen when they click on new websites. 74 Since seeing a physical manifestation of being followed is presumably uncomfortable, it can help the user to become more viscerally aware of tracking and take it more seriously than if the notice was a wall of boring text. For another example, imagine a little green gnomish figure tucked into the top righthand corner of a computer screen. It has bulging eyes (to signify eye-tracking), and stares intensely at users, always meeting their gaze directly. It might also occasionally blink or tap the foot slightly to attract users' attention. Being continually looked at by an anthropomorphic figure like the gnome can trigger our psychological discomfort - a sense of creepiness. 75

Interestingly, the experience of creepiness has a complicated relation to privacy. On the one hand, as privacy scholar Neil Richards argues, creepy is a poor basis for making normative judgments because the term is both overinclusive and underinclusive. 76 On

(Figure 5) Creepy Gnome

<!-- image -->

the other hand, since psychologists contend that creepiness is an 'evolved adaptive emo -tional response' that tells us to 'maintain vigilance,' it may be useful in this context for alerting users of privacy dangers. 77

Here is one more suggestion. Suppose that little tendrils of colour trailed according to where  users'  eyes  move.  The  colours  might  only  be  noticeable,  not  necessarily  large, strong, or garish. The default for a feature like that would be 'on' but could be turned off.  This  strategy plays on a dynamic that psychologists call 'feature-based attention' (henceforth, FBA). 78 FBA is 'the selective processing of a relevant feature over unattended feature,' and in this case, the focal features are items like colours and motions. 79  While psychologists find that correctly employed FBA can improve people's ability to under -stand and retain information, additional research should be done to determine its effi -cacy in this context. Furthermore, our eye-tracking design suggestions should be taken as conjectural ideas to consider implementing. As Calo notes, visceral notice suggestions require interdisciplinary empirical experimentation to validate.

74 Calo, 'Against Notice Skepticism,' 1040.

75 Francis  T.  McAndrew and Sara S. Koehnke, 'On the Nature of Creepiness,' New Ideas in Psychology 43 (December 1, 2016): 10-15. https://doi.org/10.1016/j.newideapsych.2016.03.003.

76 Neil Richards, Why Privacy Matters (New York, NY: Oxford University Press, 2022).

77 Richards, Why Privacy Matters

78 Shao-Chin  Hung  and  Marisa  Carrasco,  'Feature-Based  Attention  Enables  Robust,  Long-Lasting  Location Transfer in Human Perceptual Learning,' Scientific  Reports 11,  no.  1  (2021):  13914.  https://doi.org/10.1038/

Thus,  in  the  context  of  eye-track -ing, if future empirical studies could design, test, and apply FBA to increase awareness of eye-track -ing, it could be an effective applica -tion  of  visceral  notice.  Regardless of  the  specific  design  feature,  the goal is to stimulate lasting psycho -logical  responses  to  communicate to users that they are being moni -tored and tracked.

## 5. Objections and Replies

In this section, we will consider seven objections to using visceral notice in the manner detailed above, responding to each in turn.

## 5a. Notice-And-Consent Governance Is Flawed

The first objection is that the traditional notice-and-consent privacy governance model is  fundamentally flawed. Sceptics convincingly argue that the model rarely generates meaningful, informed consent due to factors like length, use of legal jargon, and lack of consumer bargaining power. 80 As a result of these limitations, some critics advocate abandoning the notice-and-consent model and looking for better options.

Philosopher and privacy theorist Daniel Susser provides a compelling response to this objection.  He  contends  that  even  if  the  notice-and-consent  sceptics  are  correct,  notice remains valuable. 81 In  other words, notice and consent issues need to be conceptually de-coupled because consent problems do not negate the utility of every form of notice. Specifically, Susser claims that effectively communicated notices can offer users a range of  direct  and  indirect  benefits,  including  providing 'basic situational awareness' that enables us to be aware of threats and to enlist the help of experts to safeguard against them. 82 For example, advocacy groups could take legal action, run consumer awareness campaigns, exert political pressure, or develop privacy-enhancing technologies. 83

s41598-021-93016-y.

79 Hung and Carrasco, 'Feature-Based Attention'.

80 Woodrow Hartzog, 'Opinions ∙ The Case Against Idealising Control,' European Data Protection Law Review 4, no. 4 (2018): 423-32. https://doi.org/10.21552/edpl/2018/4/5; Jacob Leon Kröger, Otto Hans-Martin Lutz, and Stefan Ullrich, 'The Myth of Individual Control: Mapping the Limitations of Privacy Self-Management,' SSRN Electronic Journal (2021). https://doi.org/10.2139/ssrn.3881776.

81 Daniel Susser, 'Notice After Notice-and-Consent: Why Privacy Disclosures Are Valuable Even If Consent Frameworks Aren't,' SSRN Scholarly Paper (January 1, 2019). https://papers.ssrn.com/abstract=3346167.

Figure 6 Coloured Tendrils

<!-- image -->

Susser's approach to the value of notice reinforces the idea that implementing visceral notice  strategies  in  VR  does  not  equal  endorsing  a  notice-and-consent  model  of  priv -acy protection. Indeed, visceral notice should merely be one governance tool in a more extensive tool kit. In principle, it is compatible with drawing legal red lines, like banning targeted advertising, credit scores, inferences about sexuality, and more, based on eyetracking data.

## 5b. Design Has Varying Impacts

The second objection is that visceral notice strategies are too ambitious because, as Calo notes, different people can have varied responses to design and individual responses to visceral  notice  strategies  can  change.  This  objection  criticizes  a  potential  implementa -tion problem-that visceral notice might only be effective for a limited group of people or that it  if  initially  works,  it  might  lose  its  efficacy  after  repeated  encounters.  Conse -quently, one response is that more research is needed to determine what works, given user diversity and changes to user experience over time, and whether viable changes can  improve  efficacy,  potentially  including  customized  and  adaptable  design  choices. Another response is that the strategies proposed are appropriately ambitious. Visceral notice strategies might not work on everyone, but they have the potential to improve privacy awareness for a statistically significant number of people. The goal is not to pre -sent a perfect design solution but to launch privacy policies as an iterative process-to learn what works and what falls short and enter a virtuous cycle of adaptive change.

## 5c. Nudging

Calo insists that visceral notice should only heighten people's appreciation of privacy risks, not nudge their behaviour. The third objection is that some of the design strategies we propose are too value-laden (e.g., too creepy, too intense, etc.). Consequently, they could nudge some people to undervalue the positive gains eye-tracking offers, and thus manipulatively alter their preferences.

This objection hinges on empirical facts. Further study is needed to determine whether the design strategies will impact a statistically significant number of people. If so, a rea -sonable way to proceed is to propose and test replacements. In other words, not every VR visceral notice strategy has to be a nudge, just because some are. Alternatively, one might reject the anti-nudge criterion as contextually inappropriate. Particularly in the training modules that we propose, a case could be made that nudging is justified because the clear personal benefit of immersive engagement in VR is easier to appreciate than subtle privacy problems (e.g., endowing companies with more power by providing them with intimate personal information), harms that have a societal impact (e.g., eye-tracking data fuelling algorithms that decrease diversity in virtual worlds), and harms that are difficult to quantify (e.g., does using eye-tracking data for product placement or targeted ads diminish autonomy). From this perspective, nudging corrects an unfair epistemic imbalance by emphasizing non-trivial privacy risks that otherwise would be insufficien -tly vivid to trigger due consideration. Furthermore, if nudging is justified, more heavyhanded design choices may be appropriate. This position requires further debate because the allegation of unfairness will be valid in some privacy regimes but not others. To a large extent the fairness of individual risk hinges on what privacy and related protections a regime offers.

82 Susser, 'Notice After Notice-and-Consent,' 13-14.

83 Susser, 'Notice After Notice-and-Consent,' 14-15.

Finally,  Calo  distinguishes  between  facilitation-based  approaches,  which  help  people 'develop  and  consummate  their  intentions,'  and  friction-based  approaches,  which hinder people's ability to act freely and rationally. 84 Although no action is wholly facilita -tion or friction, we can generally discriminate between them based on the intentions and impacts of the nudging and notice in question. The intent of visceral notice is clearly to facilitate choice, and while the empirical impacts remain to be seen, we are hopeful.

## 5d. Too Much Choice

The fourth objection is that if users are allowed to turn off any of the features proposed here, too many will exercise this choice for bad reasons, such as not wanting to see aest -hetically noisy design elements. To avoid this poorly reasoned outcome, users should not be given the latitude to opt out.

Since some users will have good reasons for opting out, such as visual conditions that are incompatible with the visceral notice strategies, the concern about putatively bad reasons does not apply generally. But even if nearly all users opt out of our features, the outcome does not undermine our proposal. First, users would be no worse off than before the visceral notice design features. Second, the choice to turn them off would occur after receiving information concerning the risks inherent to eye-tracking. Indeed, even if the feature were only active for a few minutes, the time it would take for users to notice, wonder what it is, and turn it off, is far more than the time users currently spend reading terms of service agreements.

## 5e. Diminishing Salience

The fifth objection is that the visceral notice strategies outlined here can be, at best, tem -porarily effective. They will lose their salience because elements that are initially novel will become familiar. Once people experience them routinely, the features will lose their attention-grabbing power. 85

84 Ryan Calo, 'Code, Nudge, or Notice?,' Iowa Law Review 99, no. 2 (2013): 773-802. https://doi.org/https://ssrn. com/abstract=2217013.

While it may be the case that people can become accustomed to and tune out traditional privacy notifications (terms of service agreements, for instance), the same logic does not necessarily hold for experiences. As Calo notes, even though we routinely hear cars' engi -nes and no doubt are accustomed to them, the noise continues to be a useful tool for aler -ting people that a vehicle is nearby. 86 Perhaps we associate the car's engine with danger; or maybe the engine's noise is noisy enough that we always notice it.

Future empirical research is required to identify how visceral notice can be effectively applied to eye-tracking and VR privacy. Ideally, visceral notice strategies for eye-tracking would attempt to achieve the same effect as the car engine; thus remaining consistently successful at attracting users' attention. Since the design features suggested in this paper have not been tested for efficacy, we do not know if they will meet this standard. Better results might follow from modified designs or selecting alternatives. Indeed, we cannot discount the possibility that visceral notice strategies need to be renewed frequently that when they become too familiar, they need to change. Additional consideration is required to determine how technology companies can adopt a format that is constantly changing, given how privacy reviews are structured.

## 5f. Companies Will Game the System

The sixth objection is that companies that profit from eye-tracking will try to unduly influence the visceral notice design process. Suppose it turns out that the visceral notice features alert people at first eventually fade into the background of their consciousness. In  that  case,  companies  might  make  design  updates  that  aim  at  making  the  benefits of eye-tracking more pronounced - perhaps overstated. As Calo puts it, depending on the incentives, companies may try to use visceral notice designs as tools for 'their own advantage.' 87

This is a considerable objection. Realistically, some companies will look to capitalize on loopholes and policies that can be implemented in many ways. However, it is not a fore -gone conclusion that all companies will behave this way. Some may want to take full advantage of visceral notice strategies to differentiate themselves from competitors who place less value on privacy. Additionally, the companies that would use visceral notice in nefarious ways probably would do so regardless; the question is whether we want privacy advocates, governments, and privacy-friendly corporations to fight for this idea. Lastly, some legal regimes may be able to limit how much latitude companies may have co-opt or undermine visceral notice information.

85 For example, Calo raises the possibility that 'people will begin to tune out even anthropomorphic clues' over time. 'Against Notice Skepticism,' 1058.

86 Calo, 'Against Notice Skepticism,' 1057.

87 Calo, 'Against Notice Skepticism,' 1066.

However even if visceral notice strategies fail to gain traction with companies, another practical  possibility  remains.  Third  parties  may  be  able  to  put  them  to  good  use.  For example, organizations that promote digital literacy could use visceral notice design to enhance privacy education. In short, if visceral notice is, overall, a good idea, it ought to be spread and popularized.

## 5g. Cannot Compel Speech

The seventh objection is that in many countries, companies cannot be compelled to follow the specific design recommendations outlined in this paper. Indeed, even if the law could require companies to communicate privacy risks in VR better, they would retain a fair amount of discretion and latitude to meet this goal. Consequently, the visceral notice proposal is essentially a recommendation for self-regulation, and companies that pursue self-regulation can be counted on to select self-serving privacy-protection options.

Here, as with some of the above replies, we concede that, depending on the jurisdic -tion, companies may need to choose to use visceral notice strategies. Consequently, the incentives that impact choices matter. There may be stronger incentives to minimize user awareness of eye-tracking. Or the incentives might favour feigning interest in visceral notice to game the system. Nevertheless, admitting that incentives matter does not mean visceral notice strategies cannot be appealing. Should there be sufficient public support for privacy-enhancing techniques and a credible concern about backlash for failing to provide them, companies may find visceral notice an attractive option.

## Conclusion

Nearly sixty years ago, in his seminal book, Understanding Media: The Extensions of Man , media theorist Marshall McLuhan offered a prescient warning that puts the old saying about eyes being the window to the soul in a modern capitalist context. 'Once we have surrendered our senses and nervous systems to the private manipulation of those who would try to benefit from taking a lease on our eyes and ears and nerves,' McLuhan writes, 'we don't really have any rights left.' 88 Bleak as today's commercial internet can seem when viewed from the perspective of a privacy advocate, the future of VR remains open. It is  not  predetermined to be a dystopian setting where we surrender our eyes and rights. But given the commercial value of eye-tracking and the poor privacy record of leading big technology companies, we should heed McLuhan's warning. While these technologies are still developing, now is the time to act to formulate governance strate -gies capable of providing adequate privacy protection. We cannot afford to wait.

In this paper, we have proposed visceral notice as a practical and potentially valuable design strategy for communicating the key privacy risks that eye-tracking poses in VR. Since VR has distinctive affordances, and some of them, like eye-tracking, make us vul - nerable to those who would abuse our personal information, it is wise to try to leverage the specific features of the media to help safeguard privacy.

88 Marshall  McLuhan, In  Understanding  Media:  The  Extensions  of  Man (New  York,  Toronto:  McGraw-Hill, 1964).

## Bibliography

- Ahlström, Christer, Katja Kircher, Marcus Nyström, and Benjamin Wolfe. 'Eye Track -ing  in  Driver  Attention  Research-How  Gaze  Data  Interpretations  Influence What We Learn.' Frontiers in Neuroergonomics 2 (2021). https://www.frontiersin.org/ articles/10.3389/fnrgo.2021.778043.
- Arafat, Imtiaz Muhammad, Sharif Mohammad Ferdous, and John Quarles. 'The Effects of Cybersickness on Persons with Multiple Sclerosis.' In Proceedings of the 22nd ACM Conference  on  Virtual  Reality  Software  and  Technology (2016), 51-59. https://doi.org/ https://doi.org/10.1145/2993369.2993383.
- Bailenson, Jeremy. 'Protecting Nonverbal Data Tracked in Virtual Reality.' JAMA Pedi -atrics 172,  no.  10  (2018):  905-6.  https://doi.org/https://doi.org/10.1001/jamapedia -trics.2018.1909.
- Ball, Matthew. The Metaverse: And How It Will Revolutionize Everything. New York: Live -right Publishing Corporation, 2022.
- Bar-Zeev, Avi. 'VR and AR Eye-Tracking Technology Will Usher in a Privacy Dystopia.' Vice (May 28, 2019). https://www.vice.com/en/article/bj9ygv/the-eyes-are-the-prizeeye-tracking-technology-is-advertisings-holy-grail.
- Bergstrom, Jennifer Romano, and Andrew Jonathan Schall. 'Eye Tracking in User Expe -rience  Design.' Amsterdam:  Elsevier ,  2014.  https://doi.org/https://doi.org/10.1016/ C2012-0-06867-6.
- Bhave, Devasheesh P., Laurel H. Teo, and Reeshad S. Dalal. 'Privacy at Work: A Review and a Research Agenda for a Contested Terrain.' Journal of Management 46,  no. 1 (2020): 127-64. https://doi.org/10.1177/0149206319878254.
- Bye, Kent. State of Privacy in XR & Neuro-Tech: Conceptual Frames. YouTube. Presented at the VRARA Global Summit, 2021. https://www.youtube.com/watch?v=pIpD4-gYImU.
- Cakebread, Caroline. 'You're Not Alone, No One Reads Terms of Service Agreements.' Insider (2017). https://www.businessinsider.com/deloitte-study-91-percent-agreeterms-of-service-witho ut-reading-2017-11.
- Calo, Ryan. ' Against Notice Skepticism In Privacy (And Elsewhere).' Notre  Dame  Law Review 1027  (March  21,  2011).  https://papers.ssrn.com/sol3/papers.cfm?abstract\_ id=1790144.
- Calo, Ryan. 'Code, Nudge, or Notice?.' Iowa Law Review 99, no. 2 (2013): 773-802. https:// doi.org/https://ssrn.com/abstract=2217013.
- Chalmers, David J. Reality +: Virtual Worlds and the Problems of Philosophy . New York: W.W. Norton & Company, 2022.
- David-John, Brendan, Diane Hosfelt, Kevin Butler, and Eakta Jain. ' A Privacy-Preserving Approach to Streaming Eye-Tracking Data.' IEEE Transactions on Visualization and Computer Graphics 27 , no. 5 (2021): 2555-65. https://doi.org/10.1109/TVCG.2021.3067787 .
- David-John, Brendan, Sophie Jörg, Sanjeev Koppal, and Eakta Jain. 'The Security-Utility Trade-off  for  Iris  Authentication  and  Eye  Animation  for  Social  Virtual  Avatars.' IEEE Transactions on Visualization and Computer Graphics 26, no. 5 (May 2020): 188090. https://doi.org/10.1109/TVCG.2020.2973052.
- David-John, Brendan, Ao Liu, and Lirong Xia. 'Let It Snow: Adding Pixel Noise to Protect the User's Identity.' 2020. https://www.researchgate.net/publication/341830854\_Let\_ It\_Snow\_Adding\_pixel\_ noise\_to\_protect\_the\_user's\_identity.

- David-John,  Brendan,  Candace  Peacock,  Ting  Zhang,  T.  Scott  Murdison,  Hrvoje Benko, and Tanya R. Jonker. 'Towards Gaze-Based Prediction of the Intent to Int -eract in Virtual Reality.' ETRA Short Papers, ACM Symposium on Eye Tracking Research  and  Applications,  May  2021,  article  2. https://doi.org/https://dl.acm.org/ doi/10.1145/3448018.3458008.
- Dick, Ellysse. 'Balancing User Privacy and Innovation in Augmented and Virtual Rea -lity.'  Information  Technology  and  Innovation  Foundation  (ITIF),  March  4,  2021. https://itif.org/publications/2021/03/04/balancing-user-privacy-and-innovation-aug -mented-and-virtual-reality/.
- Eggers, Dave. The Every . London: Penguin Press, 2021.
- Elgarf, Maha, Slim Abdennadher, and Menna Elshahawy. 'I-Interact: A Virtual Reality Serious Game for Eye Contact Improvement for Children with Social Impairment.' In Serious Games ,  edited by Mariano Alcañiz, Stefan Göbel, Minhua Ma, Manuel Fradinho Oliveira, Jannicke Baalsrud Hauge, and Tim Marsh, 10622:146-57. Cham: Springer International Publishing, 2017. https://doi.org/10.1007/978-3-319-70111-0\_14.
- Erbilek,  M.,  M.  Fairhurst,  and  M.C.D.C.  Abreu.  ' Age  Prediction  from  Iris  Biometrics.' In 5th  International  Conference  on  Imaging  for  Crime  Detection  and  Prevention  (ICDP 2013) , 1-5. London, UK: Institution of Engineering and Technology, 2013. https://doi. org/10.1049/ic.2013.0258.
- Eskildsen,  Anton  Mølbjerg,  and  Dan  Witzner  Hansen.  ' Analysis  of  Iris  Obfuscation: Generalising  Eye  Information  Processes  for  Privacy  Studies  in  Eye  Tracking.' In ACM Symposium on Eye Tracking Research and Applications ,  1-10.  ETRA '21 Full Papers. New York, NY, USA: Association for Computing Machinery, 2021. https:// doi.org/10.1145/3448017.3457385.
- Frischmann,  Brett  M.,  and  Evan  Selinger. Re-Engineering  Humanity .  Cambridge:  Cam -bridge University Press, 2019.
- Furht,  Borko,  ed.  'Immersive  Virtual  Reality.'  In Encyclopedia  of  Multimedia ,  345-46. Boston, MA: Springer US, 2008. https://doi.org/10.1007/978-0-387-78414-4\_85.
- Goldinger, Stephen D., Yi He, and Megan H. Papesh. 'Deficits in Cross-Race Face Lea -rning:  Insights  from  Eye  Movements  and  Pupillometry.' Journal  of  Experimental Psychology:  Learning,  Memory,  and  Cognition 35, no. 5 (2009): 1105-22. https://doi. org/10.1037/a0016548.
- Haensel, Jennifer X., Tim J. Smith, and Atsushi Senju. 'Cultural Differences in Mutual Gaze during Face-to-Face Interactions: A Dual Head-Mounted Eye-Tracking Study.' Visual Cognition 30, no. 1-2 (February 7 , 2022): 100-115. https://doi.org/10.1080/135062 85.2021.1928354.
- Hartzog, Woodrow. 'Opinions ∙ The Case Against Idealising Control.' European Data Pro -tection Law Review 4, no. 4 (2018): 423-32. https://doi.org/10.21552/edpl/2018/4/5.
- Hayden, Scott. 'Varjo's Enthusiast Grade VR Headset Is Getting a Brain-Computer Inter -face.' Road to VR (blog), May 31, 2022. https://www.roadtovr.com/varjos-aero-openbrain-computer-bci/.
- Heller, Brittan. 'Reimagining Reality: Human Rights and Immersive Technology.' Carr Center Discussion Paper Series, 2020-008, Harvard Kennedy School, June 12, 2020.
- Heller,  Brittan.  'Watching  Androids  Dream  of  Electric  Sheep:  Immersive  Technology, Biometric Psychography, and the Law.' Vanderbilt Journal of Entertainment & Techno -

- logy Law 23, no. 1 (December 1, 2020): 1. https://scholarship.law.vanderbilt.edu/jetlaw/ vol23/iss1/1.
- Heller, Brittan, and Avi Bar-Zeev. 'The Problems with Immersive Advertising: In AR/VR, Nobody Knows You Are an Ad.' Journal of Online Trust and Safety 1, no. 1 (October 28, 2021). https://doi.org/10.54501/jots.v1i1.21.
- Hills, Peter J., and J. Michael Pake. 'Eye-Tracking the Own-Race Bias in Face Recognition: Revealing the Perceptual and Socio-Cognitive Mechanisms.' Cognition 129,  no.  3 (2013): 586-97 . https://doi.org/10.1016/j.cognition.2013.08.012.
- Hung, Shao-Chin, and Marisa Carrasco. 'Feature-Based Attention Enables Robust, LongLasting Location Transfer in Human Perceptual Learning.' Scientific Reports 11, no. 1 (2021): 13914. https://doi.org/10.1038/s41598-021-93016-y.
- Hutt, Stephen, Angela E.B. Stewart, Julie Gregg, Stephen Mattingly, and Sidney K. D'Mello. 'Feasibility of Longitudinal Eye-Gaze Tracking in the Workplace.' Proceedings of the ACM on Human-Computer Interaction 6, no. ETRA (May 13, 2022): 148:1-148:21. https:// doi.org/10.1145/3530889.
- Ion, Florence. 'Meta's Smartwatch Is Dead Before It Can Even Compete (Report).' Giz -modo, June 9, 2022. https://gizmodo.com/meta-facebook-smartwatch-ar-glasses-por -tal-cancelled-de-1849041987.
- Jaloza, Lisa Brown. 'Inside Facebook Reality Labs: Wrist-Based Interaction for the next Computing Platform.' Tech at Meta, March 18, 2021. https://tech.fb.com/ar-vr/2021/03/ inside-facebook-reality-labs-wrist-based-interaction-for-the-next-computing-plat -form/.
- Jerome, Joseph, and Jeremy Greenberg. 'Privacy & Autonomy Considerations in Emer -ging, Immersive Digital Worlds.' AUGMENTED REALITY + VIRTUAL REALITY, The Future of Privacy Forum, April 2021. https://fpf.org/wp-content/uploads/2021/04/ FPF-ARVR-Report-4.16.21-Digital.pdf.
- John, Brendan, Sanjeev Koppal, and Eakta Jain. 'EyeVEIL: Degrading Iris Authentication in Eye Tracking Headsets.' 2019. https://jainlab.cise.ufl.edu/documents/2019\_ETRA\_ pre\_print\_eyeVEIL.pdf.
- Kaltheuner,  Frederike.  ' An  Interview  with  Arvind  Narayanan.' In Fake  AI ,  edited  by Frederike Kaltheuner. Manchester: Meatspace Press, 2021. https://fakeaibook.com.
- Kaminski,  Margot.  'Regulating  Real-World  Surveillance.' Washington  Law  Review ,  1 (January 2015). https://scholar.law.colorado.edu/faculty-articles/405.
- Kardan, Omid, Laura Shneidman, Sheila Krogh-Jespersen, Suzanne Gaskins, Marc G. Berman,  and  Amanda  Woodward.  'Cultural  and  Developmental  Influences  on Overt Visual Attention to Videos.' Scientific Reports 7 , no. 1 (2017): 11264. https://doi. org/10.1038/s41598-017-11570-w.
- Katsini, Christina, Yasmeen Abdrabou, George E. Raptis, Mohamed Khamis, and Florian Alt. 'The Role of Eye Gaze in Security and Privacy Applications: Survey and Future HCI Research Directions.' In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems , 1-21. CHI '20. New York, NY, USA: Association for Compu -ting Machinery, 2020. https://doi.org/10.1145/3313831.3376840.
- Khamis, Mohamed, Florian Alt, and Andreas Bulling. 'The Past, Present, and Future of Gaze-Enabled Handheld Mobile Devices: Survey and Lessons Learned.' In Pro -ceedings of the 20th International Conference on Human-Computer Interaction with Mobile

- Devices and Services , 1-17 . MobileHCI '18. New York, NY, USA: Association for Com -puting Machinery, 2018. https://doi.org/10.1145/3229434.3229452.
- Kim, Nancy S. Consentability: Consent and Its Limits. Cambridge: Cambridge University Press, 2019.
- Kim, Yeji. 'Virtual Reality Data and Its Privacy Regulatory Challenges: A Call to Move Beyond Text-Based Informed Consent.' California Law Review , February 2022. https:// www.californialawreview.org/print/virtual-reality-data-and-its-privacy-regula -tory-challenges-a-call-to-move-beyond-text-based-informed-consent/.
- Kröger, Jacob Leon, Otto Hans-Martin Lutz, and Florian Müller. 'What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking.' In Privacy and Identity Management. Data for Better Living: AI and Privacy , edited by Michael Friede -wald, Melek Önen, Eva Lievens, Stephan Krenn, and Samuel Fricker, 576:226-41. Cham:  Springer  International  Publishing,  2020.  https://doi.org/10.1007/978-3-03042504-3\_15.
- Kröger, Jacob Leon, Otto Hans-Martin Lutz, and Philip Raschke. 'Privacy Implications of Voice and Speech Analysis - Information Disclosure by Inference.' In Privacy and Identity Management. Data for Better Living: AI and Privacy , edited by Michael Friede -wald, Melek Önen, Eva Lievens, Stephan Krenn, and Samuel Fricker, 576:242-58. Cham:  Springer  International  Publishing,  2020.  https://doi.org/10.1007/978-3-03042504-3\_16.
- Kröger, Jacob Leon, Otto Hans-Martin Lutz, and Stefan Ullrich. 'The Myth of Individual Control:  Mapping the Limitations of Privacy Self-Management.' SSRN Electronic Journal (2021). https://doi.org/10.2139/ssrn.3881776.
- Kröger, Jacob Leon, Philip Raschke, and Towhidur Rahman Bhuiyan. 'Privacy Impli -cations of Accelerometer Data: A Review of Possible Inferences.' In Proceedings of the  3rd  International  Conference  on  Cryptography,  Security  and  Privacy ,  81-87 .  ICCSP '19.  New York, NY, USA: Association for Computing Machinery, 2019. https://doi. org/10.1145/3309074.3309076.
- Lengyel,  Gabor,  Kevin  Carlberg,  Majed  Samad,  and  Tanya  Jonker.  'Predicting  Visual Attention Using the Hidden Structure in Eye-Gaze Dynamics.' 2021. https://tanya -jonker.com/assets/publications/Lengyal\_et\_al\_2021\_EMICS.pdf.
- Liu, Ao, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain.  'Differential  Privacy  for  Eye-Tracking  Data.'  In Proceedings  of  the  11th  ACM Symposium on Eye Tracking Research & Applications ,  1-10. ETRA '19. New York, NY: Association for Computing Machinery, 2019. https://doi.org/10.1145/3314111.3319823.
- Madary, Michael, and Thomas K. Metzinger. 'Real Virtuality: A Code of Ethical Conduct. Recommendations for Good Scientific Practice and the Consumers of VR-Techno -logy.' Frontiers in Robotics and AI 3 (2016). https://www.frontiersin.org/articles/10.3389/ frobt.2016.00003.
- McAndrew,  Francis  T.,  and  Sara  S.  Koehnke.  'On  the  Nature  of  Creepiness.' New Ideas  in  Psychology 43 (December 1, 2016): 10-15. https://doi.org/10.1016/j.newidea -psych.2016.03.003.
- McGill,  Mark.  'EXTENDED  REALITY  (XR)  AND  THE  EROSION  OF  ANONYMITY AND PRIVACY.' THE IEEE GLOBAL INITIATIVE ON ETHICS OF EXTENDED REALITY (XR) REPORT. The Institute of Electrical and Electronics Engineers Stan -

- dards Association (IEEE SA), November 2021. https://standards.ieee.org/wp-content/ uploads/import/governance/iccom/extended-reality- anonymity-privacy.pdf.
- McLuhan, Marshall. In Understanding Media: The Extensions of Man .  New York, Toronto: McGraw-Hill, 1964.
- Mikhailenko,  Maria,  Nadezhda  Maksimenko,  and  Mikhail  Kurushkin.  'Eye-Tracking in  Immersive  Virtual  Reality  for  Education:  A  Review  of  the  Current  Progress and  Applications.' Frontiers  in  Education 7 (2022). https://www.frontiersin.org/ articles/10.3389/feduc.2022.697032.
- Moss,  Felix  Joseph,  Roland  Baddeley,  and  Nishan  Canagarajah.  'Eye  Movements  to Natural Images as a Function of Sex and Personality.' Edited by Luis M. Marti -nez. PLoS ONE 7 , no. 11 (November 30, 2012): e47870. https://doi.org/10.1371/journal. pone.0047870.
- Mozilla  Foundation.  'New  Anthology  'Fake  AI'  Ruthlessly  Debunks  Ai  Hype,  Snake Oil, and Pseudoscience.' December 14, 2021. https://foundation.mozilla.org/en/blog/ new-anthology-fake-ai-ruthlessly-debunks-ai-hype-snake-oil-and-pseudoscience/.
- Nair, Vivek, Gonzalo Munilla Garrido, and Dawn Song. 'Exploring the Unprecedented Privacy  Risks  of  the  Metaverse.'  arXiv,  July  26,  2022.  https://doi.org/10.48550/ arXiv.2207.13176.
- Nair, Vivek, Gonzalo Munilla Garrido, and Dawn Song. 'Going Incognito in the Meta -verse.' arXiv, August 19, 2022. https://doi.org/10.48550/arXiv.2208.05604.
- Pahi, Suchismita, and Calli Schroeder. 'Extended Privacy for Extended Reality: XR Tech -nology Has 99 Problems and Privacy Is Several of Them.' SSRN Scholarly Paper. Rochester, NY, August 28, 2022. https://doi.org/10.2139/ssrn.4202913.
- Pearlman, Kavya. 'XRSI - XR Safety Initiative  |  Help  Build  Safe  Immersive  Environ -ments'. XRSI - XR Safety Initiative, December 20, 2021. https://xrsi.org/.
- Peck, Tabitha C., Laura E. Sockol, and Sarah M. Hancock. 'Mind the Gap: The Underre -presentation of Female Participants and Authors in Virtual Reality Research.' IEEE Transactions on Visualization and Computer Graphics 26, no. 5 (2020): 1945-54. https:// doi.org/10.1109/TVCG.2020.2973498.
- Richards, Neil. Why Privacy Matters . New York, NY: Oxford University Press, 2022.
- Richards, Neil M., and Woodrow Hartzog. 'A Duty of Loyalty for Privacy Law.' SSRN Scholarly Paper. Rochester, NY, July 3, 2020. https://doi.org/10.2139/ssrn.3642217 .
- Richards,  Neil  M.,  and  Woodrow  Hartzog.  'The  Pathologies  of  Digital  Consent.' SSRN  Scholarly  Paper.  Rochester,  NY,  April  11,  2019.  https://papers.ssrn.com/ abstract=3370433.
- Robertson, Adi. 'The Meta Quest Pro Is a Cutting-Edge Headset Looking for an Audience.' The Verge (October 11, 2022). https://www.theverge.com/23393115/meta-quest-pro-vrheadset-hands-on-specs-price.
- Selinger,  Evan,  and  Woodrow  Hartzog.  'The  Inconsentability  of  Facial  Surveillance.' SSRN  Scholarly  Paper.  Rochester,  NY,  March  19,  2020.  https://papers.ssrn.com/ abstract=3557508.
- Selinger,  Evan,  and  Kyle  Whyte.  'Is  There  a  Right  Way  to  Nudge?  The  Practice  and Ethics of Choice Architecture: Practice and Ethics of Choice Architecture.' Sociology Compass 5, no. 10 (2011): 923-35. https://doi.org/10.1111/j.1751-9020.2011.00413.x.

- Stark, Luke, and Jevan Hutson. 'Physiognomic Artificial Intelligence.' Fordham Intellectual Property, Media and Entertainment Law Journal 32, no. 4 (January 1, 2022): 922. https:// ir.lawnet.fordham.edu/iplj/vol32/iss4/2.
- Surden, Harry. 'Structural Rights in Privacy.' SMU Law Review , January 1, 2007 . https:// scholar.law.colorado.edu/faculty-articles/346.
- Susser, Daniel. 'Notice After Notice-and-Consent: Why Privacy Disclosures Are Valuable Even If Consent Frameworks Aren't.' SSRN Scholarly Paper. Rochester, NY, January 1, 2019. https://papers.ssrn.com/abstract=3346167 .
- Syrjämäki, Aleksi H., Poika Isokoski, Veikko Surakka, Tytti P . Pasanen, and Jari K. Hieta -nen. 'Eye Contact in Virtual Reality - A Psychophysiological Study.' Computers in Human Behavior 112 (2020): 106454. https://doi.org/10.1016/j.chb.2020.106454.
- Tobii. 'Use Eye Tracking to Improve Training and Skills Assessment.' 2022. https://www. tobii.com/solutions/training-and-skills-assessment/.
- Valliappan, Nachiappan, Na Dai, Ethan Steinberg, Junfeng He, Kantwon Rogers, Venky Ramachandran, Pingmei Xu, et al. ' Accelerating Eye Movement Research via Accu -rate  and  Affordable  Smartphone  Eye  Tracking.' Nature  Communications 11,  no.  1 (September 11, 2020): 4553. https://doi.org/10.1038/s41467-020-18360-5.
- Wenzlaff, Frederike, Peer Briken, and Arne Dekker. 'Video-Based Eye Tracking in Sex Research: A Systematic Literature Review.' The Journal of Sex Research 53, no. 8 (Octo -ber 12, 2016): 1008-19. https://doi.org/10.1080/00224499.2015.1107524.
- Wheeler, Tom. 'If the Metaverse Is Left Unregulated, Companies Will Track Your Gaze and Emotions.' Time . Accessed  September 26, 2022. https://time.com/6188956/meta -verse-is-left-unregulated-companies-will-track-gaze-emotions/.
- Williams, Niall L., and Tabitha C. Peck. 'Estimation of Rotation Gain Thresholds Consi -dering FOV, Gender, and Distractors.' IEEE Transactions on Visualization and Compu -ter Graphics 25, no. 11 (2019): 3158-68. https://doi.org/10.1109/TVCG.2019.2932213.
- Wu, Esther Xiu Wen, Bruno Laeng, and Svein Magnussen. 'Through the Eyes of the Own-Race Bias: Eye-Tracking and Pupillometry during Face Recognition.' Social Neuroscience 7 , no. 2 (2012): 202-16. https://doi.org/10.1080/17470919.2011.596946.
- Yuan, Miaolong, Gim Guan Chua, Farzam Farbiz, and Susanto Rahardja. 'Eye Contact with  a  Virtual  Character  Using  a  Vision-Based  Head  Tracker.'  In Computer  and Information Sciences , edited by Erol Gelenbe, Ricardo Lent, Georgia Sakellari, Ahmet Sacan, Hakki Toroslu, and Adnan Yazici, 62:217-25. Dordrecht: Springer Nether -lands, 2011. https://doi.org/10.1007/978-90-481-9794-1\_43.
- Zheng,  Ting,  Christoph  H.  Glock,  and  Eric  H.  Grosse.  'Opportunities  for  Using  Eye Tracking Technology in Manufacturing and Logistics: Systematic Literature Review and Research Agenda.' Computers & Industrial Engineering 171 (September 1, 2022): 108444. https://doi.org/10.1016/j.cie.2022.108444.