Gesture-based authentication on IoT devices requires balancing security effectiveness with privacy protection. This paper presents a comprehensive comparative analysis of four authentication approaches: statistical baseline, statistical with differential privacy, autoencoder baseline, and autoencoder with differential privacy. We systematically evaluate these methods on gesture data, revealing fundamental differences in their privacy-utility trade-offs. Our statistical baseline using 29 behavioral features achieves 100% accuracy through multi-criteria z-score analysis. When differential privacy is applied through feature reduction to 6 spatial features, fraud detection drops to 93.8%. In contrast, our autoencoder approach maintains all 29 features and achieves 100% accuracy both with and without differential privacy across privacy budgets from \(\varepsilon =0.5\) to \(\varepsilon =5.0\) , suggesting potential for zero privacy-utility trade-off. Building on these insights, we propose a novel hybrid authentication framework combining statistical and deep learning approaches through ensemble decision fusion. Experimental validation demonstrates training time under 10 s and inference time of 43 milliseconds per sample, suitable for real-time IoT deployment.