Senators Warn Neurotech Companies Are Selling Sensitive Brain Data

Neurotechnology companies are increasingly collecting some of the most sensitive personal data imaginable: neural data directly from users' brains. This data can reveal mental health conditions, emotional states, and cognitive patterns, making it uniquely personal and strategically sensitive. However, unlike traditional medical devices, many consumer-facing neurotech products operate with minimal regulation and limited transparency regarding data handling.

Three Democratic senators—Chuck Schumer, Maria Cantwell, and Ed Markey—have formally urged the Federal Trade Commission (FTC) to investigate neurotech companies for potentially unfair or deceptive practices related to neural data. Their letter highlights the lack of meaningful user consent, vague data policies, and the widespread sharing of neural data with third parties without clear limitations.

Consumer neurotech products range from meditation headsets to devices claiming to enhance lucid dreaming or improve online dating experiences by analyzing instinctive reactions. These devices are not classified as medical devices and thus are not subject to Health Insurance Portability and Accountability Act (HIPAA) protections, which apply to more invasive brain implants like Neuralink.

A 2024 report by the Neurorights Foundation surveyed 30 consumer-facing brain-computer interface companies and found that nearly all have access to users' neural data and provide little to no meaningful restrictions on third-party sharing. Furthermore, only about half allow users to revoke consent for data processing, and fewer than half provide options to delete data, with rights often limited geographically.

The senators' letter calls for the FTC to clarify how existing privacy laws apply to neural data, enforce protections for children, and initiate rulemaking to establish baseline transparency and consent standards for both invasive and noninvasive neurotechnologies. They emphasize the need to limit secondary uses of neural data, such as AI training and behavioral profiling.

While brain implants like Neuralink are regulated under HIPAA as medical devices, many wellness-oriented neurotech products fall into a regulatory gray area. These devices, which users can purchase online without medical supervision, often claim mental health benefits but are not subject to the same data privacy protections, raising concerns about informed consent and data misuse.

Some states are beginning to address these gaps. Colorado updated its Consumer Protection Act in 2024 to include neural data as sensitive biological data, and California amended its Consumer Privacy Act to protect neural data as well. These legislative efforts mark early steps toward comprehensive neural data privacy protections.

Experts emphasize the transformative potential of neurotechnology to improve lives but warn that without robust safeguards, the risks to privacy and autonomy are significant. Transparent data practices, clear consent mechanisms, and regulatory oversight are crucial to ensuring that neurotech advances responsibly and ethically.