Brain sensing is being sold as a component to whoever wants to bolt it into headphones, glasses and hats. The moment the sensor disappears into the product, consent disappears with it.
Every attack I ever ran worked better when the target could not see the component I was abusing. Nobody audits the library buried three layers down in the app. Nobody reads the terms for the SDK that shipped inside the thing they actually bought. The front of the product carries a brand people trust. The back of the product carries whatever the brand’s engineers pulled in to hit a deadline. If you want to understand where data really goes, you stop looking at the logo and start looking at the parts list.
I bring exactly that habit to where consumer neurotechnology is heading. The story is not that someone built headphones that read brain activity. That already happened. The story is that brain sensing is now being sold as a part.
Brain sensing is now a line item
In late April, the neurotech startup Neurable announced it was moving to license its brain-sensing technology to other manufacturers [1]. The company’s system combines EEG sensors with AI-based signal processing to analyze brain activity and report on a user’s cognitive performance [1]. According to its own announcement, device makers can integrate that capability into existing hardware “such as headphones, hats, glasses, and headbands, while maintaining full control over product design, user experience, and distribution” [1].
Read that last clause twice. The brand controls the design, the experience and the distribution. The brain-reading capability comes from somewhere else.
Neurable is not alone. At CES in January, the French startup NAOX showed a consumer version of its in-ear EEG, a pair of wireless earbuds called Wave that it says will monitor brain biomarkers while you work, relax and sleep, with app insights on mental health, sleep, cognitive performance and even your “brain’s age” [2]. NAOX said the earbuds would launch toward the end of 2026, and that it is also interested in licensing the technology to audio companies, so the sensors could show up in earbuds sold under other, more established brands [2].
Neurable’s chief executive, Ramses Alcaide, put the ambition plainly when he spoke to TechCrunch: “let’s make this as ubiquitous as heart rate sensors on your wrist” [1]. That is the part worth sitting with. Nobody thinks about the heart rate sensor on their wrist anymore. It is just there. The goal is for brain sensing to become just as invisible.
Invisible is the whole problem
A heart rate is a number. What these products sell is interpretation. Neurable’s partner headphones with Master & Dynamic, the MW75 Neuro LT, are marketed to monitor focus and hand you a numerical score while you work, at a suggested price of $700 [3]. NAOX promises conclusions about your mental health and the age of your brain [2]. These are not raw measurements. They are inferences about the state of your mind, produced by models you cannot inspect, from signals you did not know were being collected until you read the spec sheet.
In security we have a name for a capability that ships inside something else and is not obvious to the person using it. We call it a hidden component, and we treat it as attack surface until proven otherwise. When a mobile app quietly embeds a third-party analytics SDK, the user trusted the app, not the SDK, and the SDK still sees everything the app sees. Licensing brain sensing into ordinary headphones recreates that exact arrangement with the most intimate data a person produces.
The consent problem follows directly. Buying a dedicated EEG headband is a deliberate act. You know what the device is for. Buying a pair of headphones because the sound is good, and discovering later that they carry brain sensors, is a different transaction entirely. The more successful this licensing model becomes, the more neural data collection shifts from something you choose to something you inherit. I watched sensor after sensor arrive on the phone that way. This one will arrive the same way, unless somebody decides otherwise.
Who is the data controller of your brain?
Here is the question nobody on the product page will answer for you. When the headphones come from one company and the brain-sensing stack comes from another, who holds the data, who trains on it, and whose privacy policy governs it?
Alcaide told TechCrunch that the company keeps user data “protected and anonymized” and follows HIPAA standards, going “above and beyond where a lot of startups would be at our stage” [1]. Asked whether Neurable uses people’s neural data to train its AI, he said, “We can with user consent, right?” and added that the company is “not collecting the data, just training on it willy-nilly” [1].
I want to be fair here. That is a better answer than a lot of consumer tech companies would give, and the company is at least saying the right words about consent and encryption. But notice what those statements are: a vendor’s own description of its own practices, delivered in an interview. Nothing in the reporting describes independent verification. And the licensing model adds a layer the interview does not address. When the device carries another company’s brand and another company’s app, the consumer’s relationship is with the brand. Whether the brand’s privacy terms, the sensing vendor’s terms, or some combination actually govern the neural data is precisely the kind of detail that gets decided in contracts the user never sees.
“Anonymized” deserves its own skepticism. I treat any claim that a continuous stream of personal physiological data has been made anonymous as something to verify, not something to accept, and so should you.
The customer list matters too
There is one more detail from the reporting that I cannot skip. Futurism noted that Neurable holds a $1.2 million research partnership with the Pentagon to study whether its wearable BCI can track the cognitive fitness of Air Force service members [3]. James Giordano, the former chief of neuroethics at Georgetown University Medical Center, told the Military Times that “one could certainly imagine how enforced use of such devices could create a very dystopian basis for behavioral control” [3].
I am not suggesting anything improper about that research. Studying fatigue and cognitive load in people doing dangerous work is legitimate. But it illustrates where consumer framing breaks down. Once a technology can score attention, the most motivated buyers of that score are not individuals trying to be more productive. They are institutions that want to measure the people who work for them. A focus score is a wellness feature when you choose to look at it. It is a surveillance metric when someone else does.
The law is ahead of the products in a few places
The good news is that some American legislatures saw this coming. The Neurorights Foundation, which campaigns on the issue, lays out the sequence. Colorado amended its privacy act to treat neural data as sensitive data, and that took effect in August 2024 [4]. California extended its consumer privacy law to cover neural data as sensitive personal information, effective January 1, 2025 [4]. Connecticut followed with its own amendment, and Montana added neural data to its Genetic Information Privacy Act, with a definition of “mental augmentation” that the foundation describes as the first in US law, in force since October 1, 2025 [4]. The foundation’s advocacy framing is its own, but the dates and bills are checkable facts.
California may go further. A bill now awaiting the governor, AB 1883, would bar employers from using workplace surveillance tools that employ AI to collect neural data or recognize an individual’s emotional state, with civil penalties of up to $500 per violation [5]. The governor has until September 30 to sign or veto the remaining bills on his desk [5].
That is real progress, but it has limits. These laws mostly classify neural data and require consent for its use. They do not solve the component problem. Consent is only meaningful when the person knows a brain sensor is in the product, knows which company’s models are reading it, and knows which company’s terms apply. A consent screen buried in a headphone app does not deliver that.
What I would demand before putting one on
I am not anti-neurotech. Some of the most important work in this field restores capability to people who lost it, and better, cheaper sensors will help them. But as these parts spread into ordinary gear, a few things should be non-negotiable.
The sensor should be disclosed on the box, not in the fine print. If a product contains brain-sensing hardware, a buyer should know that before paying, the same way you would want to know a speaker contains a microphone.
The data path should be named. Consumers deserve to know which company processes their neural signals, where, and under which privacy terms, especially when the brand on the box and the vendor doing the reading are different companies.
Training on neural data should be a separate, explicit choice, not a clause inside the terms of service for a pair of headphones.
The inferences should be treated as sensitive as the signals. A focus score, a mood estimate or a “brain age” is still data about your mind, whatever it looks like on screen.
And the accuracy claims should earn their keep. Futurism noted a lack of critical reviews for the $700 focus headphones and the long-standing difficulty non-invasive BCI has with noise and signal degradation [3]. An inference that might be wrong is not harmless. It is a wrong record about your mind that someone may act on.
The parts list is the product
For thirty years the lesson has been the same. The risk rarely lives in the thing people think they bought. It lives in the component nobody examined, the dependency nobody tracked, the capability that shipped because it was cheap to include.
Brain sensing is about to become exactly that kind of component. If we let it slip into our gear as quietly as the heart rate sensor slipped onto our wrists, we will wake up in a world where reading minds is a default feature of consumer electronics, governed by contracts between companies we never dealt with. Read the parts list now, while it is still short enough to read.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
References
- Lucas Ropek, “BCI startup Neurable looks to license its ‘mind-reading’ tech for consumer wearables,” TechCrunch, April 28, 2026. techcrunch.com
- Daniel Cooper, “NAOX’s wireless earbuds have a built-in EEG to monitor your brain health,” Engadget, January 5, 2026. engadget.com
- Joe Wilkins, “Startup Says It Can Read Your Brain Signals Using a Pair of Headphones,” Futurism, April 29, 2026. futurism.com
- The Neurorights Foundation, “Advocacy: United States,” neurorightsfoundation.org, accessed September 23, 2026. neurorightsfoundation.org
- Alysa Z. Hutnik, Aaron J. Burstein and Joseph Cahill, “California’s 2026 Legislative Session Wraps: A Wave of Privacy and AI Bills Reaches the Governor, with Key Child Safety and AI Measures Signed into Law,” Kelley Drye Ad Law Access, September 14, 2026. kelleydrye.com