gdpr privacy
Can you legally use eye tracking on your website?
<p>If user visits your website, can you legally use their camera to track where they are looking at and then transform this data to heatmaps? If yes, under what circumstances?</p>
<p>Our company created a web application,  we are in Europe but later we would like to give access to this app to people from all around the world (and track where they are looking at).</p>

<p>Yes, you can use such eye tracking if you obtain consent in a suitable manner. But obtaining consent is going to be very difficult for you.</p>
<p>The processing activity in question occurs within the context of an EU establishment of the data controller. Thus, GDPR applies regardless of where the data subjects are located. Under GDPR, any processing activity needs a clear purpose and a legal basis. Typical legal bases are necessity for performing a contract with the data subject, legal obligations, a legitimate interest, or consent. Conditions for consent are listed in Art 7 GDPR. Once your have a purpose that is covered by a legal basis, you can collect the <em>minimum</em> data necessary to achieve the purpose.</p>
<p>For example, let's assume that the purpose is a scientific study for which gaze tracking is necessary. The study's subjects can be informed about the context of the study, about how the data will be used, and can then be asked for consent for proceeding. Of course, participation in the study is only possible when consent is given. This is perfectly fine as far as the GDPR is concerned.</p>
<p>But things might be more difficult when data is used for a different purpose, for example in order to track user interests in a web shop.</p>
<ul>
<li><p>You do have a legitimate interest in optimizing the website, but this interest likely doesn't outweigh the user's privacy interests. Legitimate interest always requires a careful balancing test. If the user cannot reasonably expect the data collection to happen, that is an indication that consent would be a better legal basis than legitimate interest.</p>
</li>
<li><p>Accessing a camera feed means accessing information stored on the end user's device. Per the ePrivacy directive, this requires consent regardless of whether the information in question is personal data. Cookies, mouse pointer tracking, or eye tracking with a camera are all equivalent in this regard.</p>
</li>
<li><p>Consent must be specific, informed, and freely given. It is an unambiguous indication of the data subject's wishes, and must involve some clear statement or affirmative action. Prior to starting the eye tracking, you must provide sufficient information about what is happening, and must make it possible to easily decline consent. You cannot bundle unrelated consent together (e.g. eye tracking consent + cookie consent). You cannot make access to a service conditional on unrelated consent. E.g. a web shop does not need camera access, but an augmented reality does. Still, consent must be specific so consent for AR purposes can probably not be used to authorize eye tracking, which might need separate consent.</p>
</li>
<li><p>Browsers do not grant camera access by default, and instead show a permission dialogue where the user can allow access or block further requests. This permission dialogue cannot replace your compliance obligations such as providing the necessary information so that the user can make an informed choice.</p>
</li>
<li><p>Since GDPR requires that consent is freely given and can be declined, you might find it difficult to convince anyone to give consent to this fairly invasive tracking procedure. You might be able to incentivize consent e.g. with small discounts on a web shop, but the incentive must remain small enough that there really is a free choice between giving or declining consent.</p>
</li>
</ul>
<p>The EDPB has issued guidelines that are relevant to your scenario. These guidelines are not law, but are well-reasoned official interpretations that are frequently cited by courts.</p>
<ul>
<li><a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="noreferrer">Guidelines 05/2020 on consent</a></li>
<li><a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en" rel="noreferrer">Guidelines 3/2019 on processing of personal data through video devices</a></li>
</ul>
<p>Practically speaking, I doubt you will find eye tracking to be useful. First, you can likely achieve your purposes through less invasive means. Recall that the GDPR only allows you to process the minimum data necessary to achieve a purpose. Second, eye tracking is difficult for technical reasons. Bad lighting and weird angles make it difficult to obtain a useful feed. Cameras might be in different positions relative to the browser window, so that the eye tracking would have to be calibrated before acquiring data. Eye tracking typically involves processing the video feed on the user's device, but this is computationally expensive that will make the website unusable on lower-end devices, in particular mobile devices. And of course, many PCs don't have a camera in the first place.</p>
