A brand new battle for privateness is underway as technological gadgets document our mind waves

Istock | Getty Images

The question “what is a thought?” is no longer exclusively a philosophical one. Like everything else that is measurable, our thoughts are increasingly being answered technologically, with the data captured by tracking brain waves. This breakthrough also means the data is commercializable, and captured brain data is already being bought and sold by companies in the wearable consumer technology space, with few protections for users.

In response, Colorado recently passed a first-in-the-nation privacy law designed to protect these rights. The law falls under the existing Colorado Consumer Protection Act, which aims to “protect the privacy of individuals' personal information by establishing certain requirements for businesses that process personal information.” [and] includes additional protection for sensitive data.”

The key concept in Colorado’s law is the expansion of the term “sensitive data” to include “biological data” – including numerous biological, genetic, biochemical, physiological and neural characteristics.

Elon Musk's Neuralink is the most well-known example of technology being embedded in the human brain. However, it is not the only product in this field. Paradromics is a close competitor, along with devices that have given stroke patients speech back and helped amputees move prosthetics with their minds. All of these products are medical devices that must be implanted and are protected by the strict privacy rules of HIPAA. Colorado's law focuses on the fast-growing field of consumer technology and devices that do not require medical intervention, do not have comparable protections, and can be purchased and used without medical supervision of any kind.

There are dozens of companies making wearable technology that captures brainwaves (also known as neural data). On Amazon alone, there are pages of products, from sleep masks that claim to optimize deep sleep or promote lucid dreaming, to headbands that promise to improve concentration, to biofeedback headsets that take your meditation session to the next level. These products, by design and necessity, capture neural data through the use of small electrodes that provide readings of brain activity, with some delivering electrical pulses to influence brain activity.

There are virtually no laws governing how to handle all this brain data.

“We've entered the world of science fiction here,” said the bill's lead sponsor in Colorado, Rep. Cathy Kipp. “As with all advances in science, there have to be guardrails.”

“ChatGPT moment” for consumer brain technology

A recent study by the NeuroRights Foundation found that 29 of 30 companies examined that make wearable brainwave recording technologies “do not impose any significant restrictions on this access.”

“This revolution in consumer neurotechnology is centered around the increasing ability to capture and interpret brain waves,” said Dr. Sean Pauzauskie, medical director of the NeuroRights Foundation. Electroencephalography devices, a technology readily available to consumers, are “a multibillion-dollar market that will double in the next five years,” he said. “In the next two to five years, it's not unlikely that neurotechnology could have a ChatGPT moment.”

How much data can be collected depends on several factors, but the technology is evolving rapidly and could lead to an exponential increase in applications, with the technology increasingly incorporating AI. Apple has already filed patents for AirPods that feature brain sensors.

“Brain data is too important to remain unregulated. It reflects the inner workings of our minds,” said Rafael Yusuf, a professor of biological sciences and director of Columbia University's NeuroTechnology Center, as well as chairman of the NeuroRights Foundation and a leading figure in the neurotech ethics organization Morningside Group. “The brain is not just another organ in the body,” he added. “We need to engage private actors to ensure they create a framework for responsible innovation, because the brain is the sanctuary of our minds.”

According to Pauzauskie, the value for companies lies in interpreting or decoding the brain signals captured by wearable technologies. As a hypothetical example, he gave: “If you were wearing earbuds with brain sensors, Nike would not only know from your browsing history that you were looking for running shoes, but could now also know how interested you were while browsing.”

A wave of laws protecting biological privacy may be needed

The issue raised by the Colorado law could lead to a wave of similar legislation that pays increased attention to the convergence of rapidly evolving technologies and the commercialization of user data. In the past, consumer rights and protections have lagged behind innovation.

“Perhaps the best and most current analogies on the topic of technology and privacy are the Internet and the consumer genetic revolution, which has largely gone unchecked,” Pauzauskie said.

A similar development could occur if progress continues unabated in the collection and commercialization of consumer brain data. Hacking, corporate profiteering, constantly changing privacy agreements for users and little to no laws protecting that data are all major risks, Pauzauskie said. Under the Colorado Privacy Act, brain data is subject to the same privacy rights as fingerprints.

According to Professor Farinaz Koushanfar and Associate Professor Duygu Kuzum of UC San Diego's Department of Electrical and Computer Engineering, it is still too early to understand the limitations of the technology and the extent of potentially invasive data collection.

Tracking neural data could mean tracking a wide range of cognitive processes and functions, including thoughts, intentions and memories, they wrote in a joint statement sent via email. In extreme cases, tracking neural data could mean directly accessing medical information.

The sheer range of possibilities alone poses a problem. “There are still too many unknowns in this area and that is worrying,” they write.

If these laws become widespread, Koushanfar and Kuzum say companies may have no choice but to revise their current organizational structure. They may need to appoint new compliance officers and implement methods such as risk assessment, third-party audits and anonymization as mechanisms for setting requirements for the entities involved.

On the consumer side, Colorado's law and all subsequent efforts represent important steps to better educate users and give them the tools they need to review their rights and assert them if they experience a violation.

“The Data Protection Act [in Colorado] in the field of neurotechnology could represent a rare exception where rights and regulations prevail over any widespread abuse or misuse of consumer data,” Pauzauskie said.