The Scramble for Your Brain Data: Consumer EEG Headsets Feed AI Without Your Consent

An investigative article in the journal Science has revealed that neurotechnology companies are collecting tens of millions of hours of brain data from consumers and using it to train artificial intelligence systems — without explicitly informing users about this purpose. The report, conducted over the course of a year, examines the privacy policies of 57 companies that collect electroencephalographic (EEG) signals and demonstrates that most operate in a regulatory vacuum.

The Adnan Jinnah case

Adnan Jinnah, a professor of neurology at the University of California, acquired a Muse headset from the Canadian company Interaxon five years ago when he began having trouble sleeping. The device, which fits across the forehead and uses between one and six electrodes to monitor electrical activity in the front region of the brain, promised to help users improve focus and sleep through real-time feedback. Jinnah used the device every night for years, generating a substantial volume of data. What he did not know — and was never told — is that his brain signals may have been used to train an artificial intelligence system he never even heard of.

Interaxon is building a "brain foundation model," an concept analogous to large language models like ChatGPT, but trained on neural data rather than text. When fed enormous amounts of data, these models recognize key patterns of brain activity, allowing them to infer emotional states, attention levels, and even sleep characteristics. So far, Interaxon has trained its model on about 50,000 hours of EEG data from Muse headset users.

"I suppose it is very similar to when big tech companies consume your data," Jinnah said after being informed. "But I think users should be consulted before."

The scale of the phenomenon

Interaxon is not alone. A year-long investigation by Science examined dozens of consumer-facing privacy policies and spoke with neurotechnology experts, company representatives, and users to understand how consumers' brain data is being used around the world. The result is a largely unregulated global ecosystem, in which tens of millions of hours of EEG data have already been collected by consumer neurotechnology companies.

Nine neurotechnology and artificial intelligence software companies have publicly acknowledged building a brain foundation model; others may be doing so quietly. Reviewing the privacy policies of the 57 companies, the authors found that four had no policy at all, which could constitute a violation of data privacy laws. Eleven had policies focused only on website visitor data. Among the 42 that had broad policies, about 64% explicitly mentioned collecting brain data. Of those that mentioned it, approximately 69% allowed corporate transfers of data if the company were acquired, and 88% allowed data to be shared with authorities, such as police, government, or courts, upon request. Only about 14% explicitly prohibited the sale of brain data; the rest did not specify.

Initially, none of the consumer companies building a brain model explicitly disclosed this purpose in their privacy policies, although the efforts had been disclosed in press releases. After Science pointed out the issue, Interaxon updated its privacy policy. "We agree users should be explicitly informed," said Klement Kumentas, the company's privacy director. "But for Jinnah and potentially thousands of other users like him, it was too late: the training had already happened, without his explicit, informed consent. When user data is embedded into an AI system, it becomes virtually impossible to remove."

Scientific limitations and false promises

Consumer headsets are stripped-down versions of equipment used in clinical settings. Professional headsets typically collect data using 19 to 25 electrodes distributed across the skull, while consumer wearables have between one and six, covering only a limited part of the brain region of interest. The quality of the data is often insufficient for serious medical applications.

A study published in 2018 examined the scientific evidence behind the claims of consumer EEG companies that providing users with real-time information about their brain waves can help them improve concentration, sleep, and other behaviors. Of more than 3,000 publications cited by these companies, only 11 used gold-standard research methods, and 10 of them found no real benefits compared to control conditions.

Even if the data are limited, experts warn that this does not make the problem irrelevant. "When you start collecting brain data, you're crossing into the final frontier," said Michael Jones, an attorney specializing in privacy. "There is really nothing beyond that when it comes to our privacy."

The regulatory landscape

The situation is particularly worrying because the consumer neurotechnology market is growing at commercial scale. In 2026, it is estimated that more than 400 million consumer EEG units have been shipped globally. In Brazil, similar devices are becoming popular rapidly, without the Brazilian legal framework — the General Data Protection Law (LGPD) — having detailed specifications on neural data handling, unlike what happens in some American states.

Chile was the first country to explicitly prohibit the commercial collection of brain data without explicit consent. In August 2023, the Chilean Supreme Court ruled in favor of Senator Guido Girardi, ordering Emotiv to delete all brain data collected from his five-channel Insight device and directing regulators to review the sale and use of the device in the country. The case set a precedent: the senator had discovered that by accepting the terms of service, he was granting Emotiv a worldwide, irrevocable, and perpetual license over his brain data.

In the United States, Colorado and California were the first to include neural data as sensitive personal information in their consumer protection laws, allowing people to request access or deletion of this data. At least six other American states are moving in the same direction. At the federal level, American senators announced plans to introduce the "Mind Act" — Congress's first serious attempt to regulate the processing of brain data. In China, companies are already collecting hundreds of thousands of hours of EEG data from truck drivers and construction workers, in some cases without anonymization, raising additional privacy concerns.

UNESCO adopted, in 2025, a global Recommendation on the Ethics of Neurotechnology, emphasizing safeguards around consent, privacy, security, and autonomy. But practical adoption remains slow and fragmented. Until Congresses and parliaments act, brain data will continue to operate in a gray zone between health laws, consumer protection, and data privacy — an environment that companies like Interaxon seem to exploit efficiently. And meanwhile, every headset sold represents more hours of brain data feeding AI models whose purposes users rarely comprehend.

Sources: Science / AAAS, Neurorights Foundation, Neuroethics (Springer Nature)

✓ Independent sources cross-checked and verified before publishing