health · digital · family: the regulator demands evidence that cannot exist
brain data forsale, no rules
Consumer neurotechnology unregulated brain data gap
Problem statement
Consumer wearable neurotech devices — EEG headbands, transcranial direct current stimulation (tDCS) devices, neural feedback systems — are sold to millions of users but are not classified as medical devices and have no applicable safety standards. No standard exists for neural data privacy, long-term safety of repeated non-invasive brain stimulation, accuracy of brain-state measurement claims, or protection against potential neural harm. A 2024 audit of 30 consumer neurotechnology companies found that 29 of 30 (96.7%) can and may transfer user data — which may include neural data — to third parties, only 20% mention encryption of data in their policies, and only 10% engage in all of the audit's assessed data-safety measures (de-identification, encryption, and breach notification).
Why this matters
The consumer neurotechnology market is growing rapidly, with devices that read and potentially influence brain activity entering mass consumer channels (Muse, Emotiv, Flow Neuroscience, dozens of others). "Neural data" — the electrical or hemodynamic signatures of brain activity — is among the most intimate data a person can generate, yet it has no legal definition in most jurisdictions and no dedicated protection framework. As devices become more capable (higher channel count, stimulation plus recording), the asymmetry between device power and regulatory oversight widens.
What’s been tried and why it hasn’t worked
Existing medical device regulations (FDA 510(k), EU MDR) apply only to devices making medical claims, leaving consumer "wellness" neurotech unregulated. Several jurisdictions have explored neurorights legislation (Chile passed a constitutional amendment in 2021), but enforcement requires technical standards that don't exist. The IEEE P7700 working group is developing recommended practices, but faces three fundamental gaps: (1) no validated metrics exist for measuring the effect of consumer neurodevices on brain function over time, (2) "neural data" is not legally defined, so what the standard would protect is undefined, and (3) the BCI field lacks unified terminology (hence separate project P2731), making interoperable specifications impossible to write.
What would unlock progress
A tiered safety framework that classifies consumer neurodevices by capability (passive sensing vs. active stimulation, channel count, data resolution) and applies proportionate safety requirements. The key missing science is a validated protocol for assessing cumulative effects of repeated low-level brain stimulation — what level of exposure over what duration constitutes measurable risk.
Entry points for student teams
A team could conduct a comparative analysis of neural data handling practices across commercially available consumer EEG devices, documenting what data is collected, how it's processed, and where it's stored/shared. Alternatively, a team could design and pilot a "neural data transparency label" analogous to nutrition labels. Relevant skills: biomedical engineering, human-computer interaction, privacy/policy analysis.
Genome — every gene is a door
Structural cousins — same reason stuck, other fields
Sources
IEEE P7700, "Recommended Practice for the Responsible Design and Development of Neurotechnologies," active PAR approved 2022-09-21, IEEE P2794, "Draft Trial-Use Standard for Reporting Standards for in vivo Neural Interface Research (RSNIR)," active PAR approved 2022-12-03, IEEE P2731, "Standard for a Unified Terminology for Brain-Computer Interfaces," active PAR, Genser, Jared, Stephen Damianos, and Rafael Yuste (April 2024), "Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies," The Neurorights Foundation, Accessed 2026-08-21. go to source 1 ↗ go to source 2 ↗ go to source 3 ↗ go to source 4 ↗
verification notes (working record)
The collection team’s own sourcing notes for this brief, kept verbatim:
Distinct from `health-bci-implant-longevity-abandonment` (which covers implantable BCI manufacturer abandonment — a different problem about implant support lifecycle). This brief covers non-invasive consumer devices and the regulatory/measurement void they operate in. The IEEE Brain Initiative is the primary standards body activity, with P7700, P2794, and P2731 all in development.
Reconciliation 2026-08-21: Triage flagged IEEE P7700 as likely nonexistent — verification shows the opposite: P7700 is a real, active IEEE project ("Recommended Practice for the Responsible Design and Development of Neurotechnologies," PAR approved 2022-09-21, https://standards.ieee.org/ieee/7700/11038/; working group at https://sagroups.ieee.org/7700, chaired by Laura Y. Cabrera, covered in IEEE Spectrum, https://spectrum.ieee.org/amp/ieee-safety-guidelines-neurotech-2675070237). Only the title was imprecise ("Responsible Design of" → "the Responsible Design and Development of") — corrected on the Source line, with the PAR URL added. P2794 confirmed as an active PAR approved 2022-12-03 ("Draft Trial-Use Standard for Reporting Standards for in vivo Neural Interface Research (RSNIR)," https://standards.ieee.org/ieee/2794/11108/), and P2731 confirmed still an active PAR (approved 2018-09-27), not a published standard (https://standards.ieee.org/ieee/2731/7383/) — so "all in development" above stands as of 2026-08-21. The "2024 audit" is Genser, Damianos & Yuste, "Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies," The Neurorights Foundation, April 2024 (30 companies; full report PDF read). Two of its three statistics needed correction: "fewer than 20% mention encryption" → the report says exactly six of 30 (20%) mention encryption; and the 10% figure refers to the three companies stating they engage in all of the report's assessed safety measures (de-identification, encryption, breach notification), now stated as such. The 96.7% figure confirmed verbatim ("29 of the 30 companies (96.67%) can and may transfer data to third parties") — the brief's "reserve the right to transfer brain data" rephrased to the report's actual data scope. Chile's 2021 constitutional amendment confirmed (Law No. 21.383 amending Article 19 — the first constitutional-level protection of brain activity and derived information). All Source-line URLs verified live 2026-08-21.