The fledgling neurotechnology space is filled with products that promise all sorts of utility by reading your brainwaves. Whether they actually accomplish much functionality is debatable, but they are apparently succeeding at monetizing the data they collect from your brain. In a letter sent to the Federal Trade Commission, Democratic Senators Chuck Schumer, Maria Cantwell, and Ed Markey called for an investigation into neurotech companies’ handling of user data, ringing the alarm bells that some deeply sensitive and personal information may be getting sold.
According to the Senators, there is a lack of regulatory guidance as it relates to brain-computer interface (BCI) technologies, which has opened the door to companies collecting and selling user-generated neural data without their clear consent or understanding. “Unlike other personal data, neural data — captured directly from the human brain — can reveal mental health conditions, emotional states, and cognitive patterns, even when anonymized, the Senators wrote. “This information is not only deeply personal; it is also strategically sensitive.”
Here’s the catch when it comes to neurotech: While devices that are considered medical technology, like Elon Musk’s Neuralink, are required to comply with data protection practices under the Health Insurance Portability and Accountability Act (HIPAA), devices that are branded for “wellness” purposes rather than medical ones have considerably fewer restrictions or requirements when it comes to handling user data. Lots of neurotech products occupy this category, promising to help people sleep better or deal with anxiety and stress in a way that isn’t clinical but does often promote (sometimes dubious) scientific backing.
As evidence of just how unclear the current data collection and protection landscape is in the BCI space, the Senators pointed to a 2024 report published by the Neurorights Foundation that looked at the data policies of 30 different neurotech companies with devices available to consumers without the approval of a medical professional. The report found that 29 of the 30 could collect user data and “provide no meaningful limitations to this access.” It also found that only half of the companies allow consumers to revoke consent for data processing, and just 14 allow users to delete their data.
There are some states where there are protections in place for neural data. Last year, Colorado passed a bill expanding the scope of the Colorado Privacy Act to cover biological data. Likewise, California passed a law in September to offer new privacy requirements related to brain data. But those patches of protection are few and far between, and it’s the wild west everywhere else.
The Senators are calling on the FTC to change that by expanding data reporting requirements to cover neural data and establishing new safeguards to protect consumers from having their brain data collected and sold. Whether the currently extremely understaffed and not exactly consumer-friendly FTC under the Trump administration will take that action is yet to be seen.
