Your browsing history, your location, your political preferences. For years, tech companies have found ways to turn personal data into profit. Now, a new and far more intimate frontier is opening: the electrical signals produced by your brain.
This is not science fiction. Nor is it about brain implants for paralysed patients or experimental medical procedures. A fast-growing consumer market of non-invasive neurotechnology – wearable headsets, brain activity-reading headbands, focus-enhancing devices – is already here, already being sold and already collecting neural data from ordinary users. But the legal and ethical frameworks to govern it are struggling to keep up.
A landmark case from Chile shows why this matters.
In August 2023, Chile’s Supreme Court issued the world’s first ruling on commercial neurodata. The case involved Sen. Guido Girardi and Emotiv Inc, a San Francisco company selling the Insight wireless headset – a consumer device marketed for focus, meditation and cognitive performance.
When Girardi began using it, he discovered that accepting the terms of service meant granting Emotiv a worldwide, irrevocable and perpetual licence over his brain data. Unless he paid for a premium account, that data would be stored in Emotiv’s cloud with no way for him to access or export his own neural records.
The Chilean Supreme Court ruled that Emotiv had violated Girardi’s constitutional right to mental integrity, concluding: “The data obtained from Insight users … overlooks the preliminary requirement to have express consent for its use for scientific research purposes. Information collected for various purposes cannot be used differently without its owner’s knowledge and approval.”
The Supreme Court ordered the company to delete Girardi’s data immediately and prohibited sale of the Insight device in Chile until its privacy policies were revised. The headsets remain on sale in other countries around the world.
The ruling was a first. But the problem it exposed is global – and the legal pressure is building. In the US, Colorado and California enacted the first state-level privacy laws specifically governing neural data in 2024, and at least six other states are now moving in the same direction.
At the federal level, U.S. Senators Chuck Schumer, Maria Cantwell and Ed Markey announced plans in September 2025 to introduce the Mind Act – Congress’s first serious attempt to bring the neurotechnology industry under a dedicated regulatory framework.
A market growing faster than its rules
Emotiv is far from alone. Companies such as Muse (marketed for meditation and sleep) and Neurosity (aimed at software developers seeking focus) have built a consumer neurotechnology sector that is projected to double in value to more than US$55 billion (£42 billion) within a decade. It is attracting investment from some of the world’s wealthiest technology figures.
These devices read electroencephalography (EEG) signals – the brain’s electrical activity – through sensors worn on the head. Some go further, using photoplethysmography (PPG) sensors to measure heart rate and physiological responses. Think of this like a fitness tracker – but instead of counting steps, it is reading signals from your nervous system and, in some cases, inferring your cognitive or emotional states from them.
When fitness trackers first appeared, few people thought carefully about where their heart rate data was going, who could access it, or what it could be used to infer. Neural data raises those same questions – at considerably higher stakes. Unlike step counts, brain signals can potentially reveal attention patterns, stress responses and emotional reactions that users themselves may not be aware of.
Where the law has not yet caught up
We research these issues as part of the interdisciplinary group at Lund University, which brings together law, neuroscience, medicine, ethics and economics.
The Emotiv case turned on Chile’s constitutional protection of mental integrity – a provision the country had specifically enshrined in 2021. Most jurisdictions have no equivalent. The question of how neural data fits into existing legal frameworks remains open.
Under the EU’s General Data Protection Regulation, brain signals could potentially qualify as biometric or health data, both of which attract stronger protections. But consumer neurotechnology, when sold as wellness products rather than medical devices, often falls into a regulatory grey area, sitting awkwardly between health law, consumer protection and data privacy rules.
What remains unresolved across most of the world are the basic questions. What are users consenting to when they accept terms of service for a neural headset? How long can that data be retained? Can it be sold to third parties, used to train AI models, or shared with advertisers and insurers?
The Emotiv case showed that, in one instance at least, a company had retained a user’s neural data for research purposes under anonymisation provisions, without that user having any meaningful awareness of what was being collected or why.
The stakes here are higher than with most forms of personal data. Neural signals are not like a credit card number that can be changed if compromised. Generated by your brain in real time, they can increasingly be used to infer things about you that you have not chosen to disclose – such as emotional responses, cognitive patterns, and other reactions you may not consciously be aware of.
Chile has showed that courts can act. Legislators in several jurisdictions are beginning to follow. The harder question is whether the frameworks being built are moving fast enough to match a market that, in the quest for competitive advantage, does not want to hang about waiting for them.
