brain data for

sale, no rules

Notes made while writing and checking this brief, shown as written. They use working shorthand.

Distinct from `health-bci-implant-longevity-abandonment` (which covers implantable BCI manufacturer abandonment — a different problem about implant support lifecycle). This brief covers non-invasive consumer devices and the regulatory/measurement void they operate in. IEEE is the standards body active here, with P7700 (developed by the IEEE Brain technical community, sponsored by the IEEE Society on Social Implications of Technology), P2794, and P2731 (both under the IEEE Engineering in Medicine and Biology Society) all in development.

Reconciliation 2026-08-21: Triage flagged IEEE P7700 as likely nonexistent — verification shows the opposite: P7700 is a real, active IEEE project ("Recommended Practice for the Responsible Design and Development of Neurotechnologies," PAR approved 2022-09-21, https://standards.ieee.org/ieee/7700/11038/; working group at https://sagroups.ieee.org/7700, chaired by Laura Y. Cabrera, covered in IEEE Spectrum, https://spectrum.ieee.org/amp/ieee-safety-guidelines-neurotech-2675070237). Only the title was imprecise ("Responsible Design of" → "the Responsible Design and Development of") — corrected on the Source line, with the PAR URL added. P2794 confirmed as an active PAR approved 2022-12-03 ("Draft Trial-Use Standard for Reporting Standards for in vivo Neural Interface Research (RSNIR)," https://standards.ieee.org/ieee/2794/11108/), and P2731 confirmed still an active PAR (approved 2018-09-27), not a published standard (https://standards.ieee.org/ieee/2731/7383/) — so "all in development" above stands as of 2026-08-21. The "2024 audit" is Genser, Damianos & Yuste, "Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies," The Neurorights Foundation, April 2024 (30 companies; full report PDF read). Two of its three statistics needed correction: "fewer than 20% mention encryption" → the report says exactly six of 30 (20%) mention encryption; and the 10% figure refers to the three companies stating they engage in all of the report's assessed safety measures (de-identification, encryption, breach notification), now stated as such. The 96.7% figure confirmed verbatim ("29 of the 30 companies (96.67%) can and may transfer data to third parties") — the brief's "reserve the right to transfer brain data" rephrased to the report's actual data scope. Chile's 2021 constitutional amendment confirmed (Law No. 21.383 amending Article 19 — the first constitutional-level protection of brain activity and derived information). All Source-line URLs verified live 2026-08-21.

Reconciliation 2026-09-30: Whole write-up read against every source it names, all fetched 2026-09-30. Read in full: the three IEEE project pages on the Source line (https://standards.ieee.org/ieee/7700/11038/, https://standards.ieee.org/ieee/2794/11108/, https://standards.ieee.org/ieee/2731/7383/); the P7700 working group page (https://sagroups.ieee.org/7700/); the IEEE Spectrum article named in the note above (Kathy Pretz, "IEEE Considers Safety Guidelines for Neurotech Consumer Products," 02 Feb 2026; the /amp/ address now redirects to https://spectrum.ieee.org/ieee-safety-guidelines-neurotech); the Neurorights Foundation reports page (https://www.neurorightsfoundation.org/research/reports); and the full 100-page report PDF that page links to (https://perseus-strategies.com/wp-content/uploads/FINAL_Consumer_Neurotechnology_Report_Neurorights_Foundation_April-1.pdf). Changes: (1) "sold to millions of users" is not in any source. The report says the scale of the companies' reach "is unclear" and the largest user count it quotes is Muse, over 200,000; it says the devices are "increasingly marketed to consumers," and the text now says that. (2) "have no applicable safety standards" and "No standard exists for neural data privacy, long-term safety of repeated non-invasive brain stimulation, accuracy of brain-state measurement claims, or protection against potential neural harm" went further than the sources. What they say is: the products are not medical devices and are "not subject to the same forms of regulation" (Spectrum); the market "lacks industry-wide standards for privacy practices" (report); "there are no socio-technical standards for manufacturers to follow" (Spectrum); the long-term effects of consumer headbands "aren't known" (Spectrum); and "there is little evidence to support the marketing claims of consumer EEG companies regarding altering mental states and behavior" (Wexler and Reiner, quoted in the report). The two sentences now say those things, with the Wexler and Reiner qualifier kept. (3) The report's analysis is limited to companies' policy documents, and its 10% figure counts companies that "state that they engage in" all three data-safety measures. The text now says the audit was of privacy policies and user agreements, and "engage in" became "state that they engage in." (4) "It has no legal definition in most jurisdictions and no dedicated protection framework" is not in the sources. The report says existing data-protection instruments "may require further interpretation or amendment to ensure that neural data falls unambiguously within their protections," and that "there are currently no international frameworks that adequately protect against the harms posed by neurotechnologies"; the sentence now follows that wording. (5) "Higher channel count, stimulation plus recording" and a widening "asymmetry between device power and regulatory oversight" are not in the sources. The report says higher-resolution scans, larger datasets and generative AI decoding mean "the sensitivity of neural data will only deepen"; the sentence now says that. (6) "FDA 510(k), EU MDR" are not named in any source. The report says products intended to treat medical conditions are regulated by the FDA in the United States, and that most consumer companies avoid classification as medical devices by limiting their claims to wellness; it describes the consumer use as subject to "almost no regulation at all." The sentence now names the FDA only and says "largely unregulated." (7) "Enforcement requires technical standards that don't exist" is not in the sources, and the report describes enforcement happening: in 2023 Chile's Supreme Court ordered EMOTIV to delete a citizen's brain data. The clause now carries the Spectrum statement that there are no socio-technical standards for manufacturers to follow. (8) The "three fundamental gaps" were presented as what the P7700 working group faces; no source frames them that way, and each was stated more strongly than the sources. They now read as three gaps that remain: long-term effects are not known (Spectrum); companies use many different terminologies for neural data and a global consensus on its definition would be helpful (report, footnote 138); and ambiguous terms "hinder cross-sector innovation" and "mainstream deployment" (the P2731 project page), in place of "no validated metrics exist," "not legally defined," and "impossible to write." (9) Under What Would Unlock Progress, "a validated protocol for assessing cumulative effects of repeated low-level brain stimulation" as the key missing science is not in the sources; the sentence now rests on the Spectrum statement that long-term effects are not known, and on the P7700 chair's framing there: short-term use may carry no significant consequences, "but what are the effects over time?" The earlier tail, "what level of exposure over what duration constitutes measurable risk," is not in the sources and was dropped. The tiered framework in that section is this write-up's own proposal, not a finding of the sources. (10) The first paragraph of these notes said "the IEEE Brain Initiative is the primary standards body activity" for all three projects. The pages show P7700 sponsored by the IEEE Society on Social Implications of Technology (Spectrum says the IEEE Brain technical community is developing it), and P2794 and P2731 under the IEEE Engineering in Medicine and Biology Society; the sentence now says that. Confirmed in the sources and left as written: the Source line (P7700 title and PAR approval 2022-09-21; P2794 title and PAR approval 2022-12-03; P2731 an active PAR; report authors, title, publisher and April 2024 date); all three projects still listed as Active PAR; Laura Cabrera as P7700 working group chair; 30 companies; 29 of 30 (96.67%) "can and may transfer data to third parties"; six of 30 (20%) mention encryption; three of 30 (10%) on all three measures; Muse, EMOTIV and Flow Neuroscience among the 30 companies surveyed; EEG, tDCS and neurofeedback products; the market "growing quickly"; Chile's 2021 constitutional amendment. Two things to know: the IEEE page lists P2731 as "IEEE Draft Standard for a Unified Terminology for Brain-Computer Interfaces" (the Source line omits "Draft"; left as is), and the Spectrum article, dated February 2026, reports that UNESCO "in November adopted the first global ethical standard for neurotechnologies" and that the P7700 chair anticipates the standard "will be published early next year." Could not be checked: the law number and article cited for Chile in the note above (Law No. 21.383, Article 19), which appear in none of the sources named on this page. No title changed. Genome tags untouched. A second reader went over all ten repairs on the same day against the same sources, fetched independently; the second reader tightened the wording of changes (2), (4), (8) and (9) to the sources' own terms, and the wording above is the final one.