Consumer EEG makers have been training AI on users’ brainwaves, and the privacy policies mostly did not say so. The fix is not a better opt-out. It is consent that comes before the data ever leaves the headband.
There is a trick every attacker learns early, and every defender learns eventually. You do not need the label to know whose data it is. Strip the username off a session token and it still opens the account. Strip the hostname off a log and the timing, the habits, the typos still tell you exactly who was sitting at the keyboard. In my old life, half the job was rebuilding identity from the things people swore were anonymous.
So when I read that consumer brain-wearable companies have been feeding users’ EEG recordings into AI models under the banner of “de-identified” data, I did not feel surprise. I felt recognition. We have been here before with every other kind of telemetry. This time the telemetry comes off the inside of your skull.
What the reporting found
The original investigation was published by Science in early November, reported by Jonathan Moens with support from the Pulitzer Center’s AI Accountability Network [1][2]. I want to be upfront about something: I could not get the Science article itself to load, so everything I say about its findings comes from two independent outlets that reported on it, and I am citing them rather than pretending I read the source. If Science’s own text differs, Science wins.
According to that coverage, the investigation reviewed the privacy policies of 57 consumer EEG companies. Four had no policy at all, and 11 had one that only covered visitors to their website. Of the rest, all but one allowed sharing with third parties in anonymized, aggregated, or de-identified form. Only six explicitly promised not to sell brain data. More than two-thirds allowed the data to move to a buyer if the company was acquired, and every company either allowed sharing with police, government, or courts on request or simply did not say [1].
Then the part that made the headlines. Nine companies publicly say they are building a brain foundation model, a large AI model trained on huge volumes of neural recordings. At first, none of the consumer neurotech companies building one disclosed that in their privacy policies [1].
Interaxon, the Canadian company behind the Muse headband, told Science it trained its model on roughly 50,000 hours of EEG from users, with names and email addresses removed first [1][2]. Its policy did not spell that out until Science asked. Afterward it was updated to say de-identified session data may be used to improve algorithms and machine-learning models, “including foundation models” [2]. Emotiv told Science it trains what it calls a Large Brain Model partly on data from users of its higher-end devices, and its current policy says it uses pseudonymised neural data with explicit opt-in consent [1]. Gadget Review, reading Emotiv’s terms, reports that withdrawing consent stops future data from being used but does not pull data back out of a model that has already been trained [2].
Read that last line again. That is the whole story in one sentence.
The label is doing all the work
Every one of those policies leans on one word. De-identified. Anonymised. Pseudonymised. Aggregated. The word is load-bearing because it moves the data from one bucket to another. Identified data needs your permission. De-identified data, in most of these documents, does not. The minute the name comes off, the recording walks out of the consent regime and into the training set.
In security we have a name for that move. It is a classification downgrade. Somebody takes a sensitive asset, strips the marking, and suddenly it can go places the marked version never could. We treat unauthorized downgrades as incidents. In consumer neurotech, the downgrade is the business model, and it happens automatically, at ingestion, by policy.
Here is where I want to be careful, because overclaiming is how you lose the argument. I cannot point you to a study proving that every consumer EEG trace can be tied back to the person who produced it, and I am not going to pretend I can. What I can tell you is that the people writing the law in at least one state already decided not to rely on the label. Colorado’s 2024 law, which made neural data sensitive data under the state’s privacy act, includes a legislative finding that “the collection of neural data always involves involuntary disclosure of information” [5]. That is a finding by lawmakers, not a peer-reviewed result. It is still the right instinct. You cannot choose what your brain emits while you wear the band. You can only choose whether you wear it.
And identity is not even the main risk here. A model trained on tens of thousands of hours of brain activity does not need to know your name to learn things about people like you. The value of a foundation model is precisely what it can infer about the next person whose signal it sees. De-identification protects the row. It does nothing for the inference.
Consent that arrives after the fact is not consent
The Emotiv detail matters because it shows the shape of the trap even when a company does the more responsible thing and asks for opt-in. Once training happens, withdrawal is one-way. You can stop contributing tomorrow. You cannot un-teach what the model already learned from you yesterday [2]. Any system where the revoke button only works going forward is a system where the first yes is effectively permanent.
That is why I do not think the answer is a better opt-out toggle buried in a settings menu. The answer is putting the decision before the data leaves the device, and making training its own decision instead of a clause folded into “improving our services.”
Nita Farahany at Duke said companies should get “a specific and separate consent” for AI training [1]. Cristin Welle at the University of Colorado Anschutz put it even more simply to KFF Health News: training AI on neural data “should be an opt-in, not a given” [3]. The federal MIND Act, introduced in the Senate in September 2025, points the same way. Among the things it asks the Federal Trade Commission to recommend is “separate, conspicuous consent mechanisms for the use of such data in developing or deploying computational models” [6].
The trouble is that the MIND Act is a study bill. It directs the FTC to report and recommend, and its binding provisions apply to federal agency procurement, not to the companies selling headbands [6]. Lawyers at Davis Wright Tremaine noted in May that it “has not advanced in the current Congress” and that they did not expect it to in an election year [4]. They also pointed out that HIPAA does not reach direct-to-consumer devices and that definitions of neural data vary from state to state [4]. So right now the honest description of American brain data law is a patchwork of state privacy acts sitting on top of a federal study that has not moved.
The other side of the argument
To be fair to the companies, there is a real case on their side. Sleep staging, meditation feedback, and fatigue detection get better with more data, and users benefit when they do. Emotiv’s opt-in model is better than silence. And Sean Pauzauskie of the Neurorights Foundation told KFF something I think is fair, that the state laws protect neural data itself, not the AI that uses it [3]. Regulation aimed at the input does not automatically govern the model.
But that cuts both ways. If the law protects the recording and not the model, then the model is where the protection ends. A trained model is a durable derivative of everyone who fed it. It can be sold with the company. It can be subpoenaed. It can be repurposed. The coverage of China in the same reporting shows how fast a “wellness” signal becomes an operational one: one company there gives traffic police real-time access to truck drivers’ brainwave readings, under a national standard that took effect in June [1]. Nobody bought those helmets to have their fatigue scores read by the police. That is what happens when a signal escapes the purpose it was collected for.
And notice the gap the lawyers flagged. Davis Wright Tremaine found no major provider that prohibits using device outputs in employment, insurance, or custody decisions [4]. Put that next to models trained on population-scale brain data and you can see where the pressure is going to come from.
What should change
If I were writing the rules, I would start with four things, and none of them require new science.
Training should be a named purpose that requires its own consent, given before collection, separate from the terms you click to make the device work. Not a toggle you discover later.
Policies should say plainly whether a user’s recordings are in a trained model, which model, and what withdrawal can and cannot undo. If the honest answer is “withdrawal only stops future use,” say it in those words.
A trained model should travel under the same restrictions as the data that built it. If the raw recordings cannot be sold, handed over on request, or transferred in an acquisition without consent, neither can the model built from them.
And “de-identified” should stop being a free pass. Treat neural data as sensitive whether or not the name is attached, which is where Colorado has already landed [5].
The bottom line
I spend my working life watching people trust labels that attackers ignore. Anonymous. Internal. Read-only. Temporary. Every one of those words has been the first line of a breach report. De-identified is going to be the next one, and the data behind it is the most personal signal a human being produces.
Your brain does not have a privacy setting. The company on the other end of the headband does. Make it decide before it trains, not after.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
References
- Inside BCI (edited by Velco Dar). “Brain-wearable makers left AI training on users’ brain data out of their privacy policies, Science finds.” Inside BCI, November 7, 2026. insidebci.com
- Alex Barrientos. “Your Sleep Tracker Has Been Using Your Brain Waves To Train AI Without Telling You.” Gadget Review, November 9, 2026. gadgetreview.com
- Kate Ruder. “States Pass Privacy Laws To Protect Brain Data Collected by Devices.” KFF Health News, July 23, 2025. kffhealthnews.org
- Wendy Kearns, Elyse Sparks, Nancy Libin and Jeremy Ben Merkelson. “All the World’s Neural Data, No Common Rule.” Davis Wright Tremaine Privacy and Security Law Blog, May 28, 2026. dwt.com
- Colorado General Assembly. “HB24-1058: Concerning protecting the privacy of individuals’ biological data, and, in connection therewith, protecting the privacy of neural data and expanding the scope of the Colorado Privacy Act” (signed act). 2024. content.leg.colorado.gov
- U.S. Senate. “S. 2925, Management of Individuals’ Neural Data Act of 2025 (MIND Act of 2025),” introduced September 29, 2025, 119th Congress. congress.gov