Is Your Brain Data Being Sold? The Emerging Neurotech Frontier
Your browsing history, location, and political preferences have long been monetized by technology companies. Now, a far more intimate frontier is opening: the electrical signals produced by your brain. This is not science fiction but a rapidly expanding consumer market of non-invasive neurotechnology, including wearable headsets and brain activity-reading devices that collect neural data from ordinary users.
Chile's Landmark Ruling on Neural Privacy
In August 2023, Chile's Supreme Court issued the world's first ruling on commercial neurodata, setting a crucial precedent. The case involved Senator Guido Girardi and Emotiv Inc, a San Francisco-based company selling the Insight wireless headset for focus, meditation, and cognitive performance. Girardi discovered that accepting the terms of service granted Emotiv a worldwide, irrevocable, and perpetual license over his brain data, stored in the company's cloud without his access unless he paid for a premium account.
The court ruled that Emotiv violated Girardi's constitutional right to mental integrity, stating that data collected for various purposes cannot be used differently without the owner's knowledge and approval. The Supreme Court ordered the immediate deletion of Girardi's data and prohibited the sale of the Insight device in Chile until privacy policies were revised, though the headsets remain available globally.
The Global Legal Response to Neurodata
This ruling exposed a global problem, with legal pressure mounting worldwide. In the United States, Colorado and California enacted the first state-level privacy laws specifically governing neural data in 2024, with at least six other states following suit. At the federal level, U.S. Senators Chuck Schumer, Maria Cantwell, and Ed Markey announced plans in September 2025 to introduce the Mind Act, Congress's first serious attempt to regulate the neurotechnology industry.
A Market Outpacing Regulation
Emotiv is not alone in this space. Companies like Muse, marketed for meditation and sleep, and Neurosity, aimed at software developers seeking focus, have built a consumer neurotechnology sector projected to double in value to over US$55 billion within a decade. These devices read electroencephalography (EEG) signals through head-worn sensors, with some using photoplethysmography (PPG) sensors to measure heart rate and physiological responses, akin to fitness trackers but for the nervous system.
Unlike step counts, brain signals can reveal attention patterns, stress responses, and emotional reactions that users may not be aware of, raising higher stakes for data privacy. Neural data is not like a credit card number that can be changed if compromised; it can infer emotional and cognitive patterns without conscious disclosure.
The Regulatory Grey Area
Researchers from Lund University highlight that most jurisdictions lack equivalent protections to Chile's constitutional safeguard of mental integrity. Under the EU's General Data Protection Regulation, brain signals could qualify as biometric or health data, but consumer neurotechnology often falls into a regulatory grey area when sold as wellness products rather than medical devices.
Key unresolved questions include:
- What are users consenting to when they accept terms of service for neural headsets?
- How long can neural data be retained?
- Can it be sold to third parties, used to train AI models, or shared with advertisers and insurers?
The Emotiv case revealed that companies can retain neural data for research under anonymisation provisions without user awareness. As the market grows rapidly, driven by competitive advantage, the challenge is whether legal frameworks can keep pace to protect mental privacy in this new data frontier.
