How Safari on visionOS Protects Eye-Tracking Privacy

This article provides a complete overview of how the Safari web browser on Apple's visionOS protects user privacy by isolating eye-tracking data from websites. It explains the inherent privacy risks of gaze tracking, how the operating system handles visual hover effects entirely out-of-process, the blocking of traditional JavaScript tracking events, and how gaze coordinates are exclusively transmitted to a webpage only after a user physically pinches their fingers to register a click.

The Privacy Risk of Eye Tracking

Where a person looks reveals deeply personal information, including subconscious preferences, reading speed, cognitive state, and biometric identity. On a traditional computer, websites can continuously track a user's mouse cursor using JavaScript to build behavioral profiles and heatmaps. If websites could similarly track a user's eyes in a spatial computing environment, they could harvest intimate psychological and physiological data without the user's explicit consent.

System-Level Isolation

To prevent unauthorized tracking, visionOS treats eye-tracking coordinates as highly sensitive system data. The cameras and sensors inside the Apple Vision Pro continuously monitor the user's eyes, but this raw data is processed strictly at the operating system level. It is completely walled off from individual applications, including the Safari web browser and the underlying WebKit engine. Because Safari itself does not have continuous access to the raw gaze stream, it cannot pass that information along to the websites a user visits.

Blocking JavaScript Pointer Events

On desktop browsers, moving a mouse across a webpage triggers a continuous stream of JavaScript events, such as mousemove, mouseover, and mouseenter. Websites use these events to know precisely where the cursor is at all times.

In Safari on visionOS, looking around a webpage does not trigger any of these JavaScript events. Even though the user is using their eyes as a pointer, WebKit intentionally suppresses all movement and hover-related scripts. If a website runs a script attempting to poll the current pointer location, the browser returns nothing while the user is simply reading or looking around.

Out-of-Process Hover Effects

Users still need visual feedback to know which link or button they are currently looking at before they click it. Safari achieves this without leaking data to the website through a technique called out-of-process rendering.

When a webpage loads, Safari identifies all interactive elements (like buttons, links, and form fields) and maps their boundaries. It sends this structural map to the visionOS system compositor. When the user's eyes land on a button, the visionOS system—not the webpage—applies a subtle visual highlight (the hover effect) over that element. Because this visual change happens entirely within the operating system's rendering layer, the website remains completely blind to the fact that the user is looking at that specific element. Furthermore, if a website tries to use JavaScript to inspect the visual style of an element to see if it is currently highlighted, Safari hides the active hover state from the script.

The Pinch-to-Click Trigger

A website only receives coordinate data when the user makes a conscious decision to interact with the page. In visionOS, this intent is signaled by pinching the thumb and index finger together.

The exact moment the user pinches, the operating system takes the current gaze coordinates and passes that single data point to Safari. Safari then immediately generates standard web interaction events—specifically pointerdown, pointerup, and click—at those exact coordinates and sends them to the webpage. To the website, this interaction looks identical to a user tapping a screen with their finger on an iPad or iPhone. The website learns what the user clicked, but it never learns what the user looked at before or after that exact moment.