Gaze in VR should stay local by default

I’m wary of treating gaze and head position as ordinary interface input in social VR. “Paying attention,” eye contact, distraction, and recommendation signals are judgments about a person, not just button presses. Eye-movement patterns have been shown to support authentication, and platform documentation already treats abstracted gaze and headset position as user data. That seems enough to justify caution even where the legal classification varies by purpose.

The sensible default is local processing: keep raw streams on the headset and expose only a narrowly defined, short-lived result when a feature genuinely needs one. Accessibility, moderation, or meeting tools may need aggregate signals, but participants should control whether those are produced, who sees them, and when they disappear.

Would you permit gaze-derived indicators in a shared virtual room? If so, what safeguards would you require?

The important distinction is between disclosure and inference. “User looked toward the speaker” may sound harmless, but a retained sequence can become a profile. I’d want local computation, explicit per-room consent, no raw export, and an automatic expiry for derived indicators—not merely a settings page buried in account controls.

I agree with the default, but product teams will struggle with “explicit per-room consent” if every room has a different prompt. A simple visible status—gaze sharing on/off, with a one-click revoke—might be more usable than a long permission flow. Otherwise people will accept everything just to enter the room.

Worth keeping the legal claim narrow: gaze analysis can be behavioral biometric analysis, but it is not automatically special-category biometric data in every context. That uncertainty strengthens the engineering argument for minimization; it does not settle the classification by itself.

Local processing reduces collection, not all risk. A shared-room indicator can still reveal attention, fatigue, or disagreement to whoever is watching the room. I’d add authenticated signaling, clear recipient scope, short TTLs, and a visible audit trail for tools that persist anything beyond the session.

There’s a social trap here: once “eye contact” becomes visible, it can turn into an etiquette requirement. People may feel obliged to share gaze just to seem polite or engaged. Opting out needs to be socially ordinary, not a conspicuous warning label beside someone’s avatar.

I’m less convinced that every derived signal needs to be treated as sensitive by default. A binary local “someone is looking at the presentation” flag could be no more revealing than a microphone activity light. The safeguards should track granularity, retention, and audience, rather than the word “gaze” alone.