Brain Data for Sale, No Rules

Consumer wearable neurotech devices — EEG headbands, transcranial direct current stimulation (tDCS) devices, neural feedback systems — are sold to millions of users but are not classified as medical devices and have no applicable safety standards. No standard exists for neural data privacy, long-term safety of repeated non-invasive brain stimulation, accuracy of brain-state measurement claims, or protection against potential neural harm. A 2024 audit found 96.7% of neurotech companies reserve the right to transfer brain data to third parties, fewer than 20% mention encryption, and only 10% adopt core safety measures.

The consumer neurotechnology market is growing rapidly, with devices that read and potentially influence brain activity entering mass consumer channels (Muse, Emotiv, Flow Neuroscience, dozens of others). "Neural data" — the electrical or hemodynamic signatures of brain activity — is among the most intimate data a person can generate, yet it has no legal definition in most jurisdictions and no dedicated protection framework. As devices become more capable (higher channel count, stimulation plus recording), the asymmetry between device power and regulatory oversight widens.

Existing medical device regulations (FDA 510(k), EU MDR) apply only to devices making medical claims, leaving consumer "wellness" neurotech unregulated. Several jurisdictions have explored neurorights legislation (Chile passed a constitutional amendment in 2021), but enforcement requires technical standards that don't exist. The IEEE P7700 working group is developing recommended practices, but faces three fundamental gaps: (1) no validated metrics exist for measuring the effect of consumer neurodevices on brain function over time, (2) "neural data" is not legally defined, so what the standard would protect is undefined, and (3) the BCI field lacks unified terminology (hence separate project P2731), making interoperable specifications impossible to write.

A tiered safety framework that classifies consumer neurodevices by capability (passive sensing vs. active stimulation, channel count, data resolution) and applies proportionate safety requirements. The key missing science is a validated protocol for assessing cumulative effects of repeated low-level brain stimulation — what level of exposure over what duration constitutes measurable risk.

A team could conduct a comparative analysis of neural data handling practices across commercially available consumer EEG devices, documenting what data is collected, how it's processed, and where it's stored/shared. Alternatively, a team could design and pilot a "neural data transparency label" analogous to nutrition labels. Relevant skills: biomedical engineering, human-computer interaction, privacy/policy analysis.