A battle for consumer privacy is emerging as technology devices record our brainwaves.

• Many consumer tech products, not regulated by medical authorities, are capturing brain waves, and major tech companies such as Apple have filed patents for brain-sensing applications.
• The first state in the U.S. to enact a privacy law that safeguards neural data as "sensitive data" is Colorado.
• As the number of consumer tech products that track brain activity grows rapidly, there may be a need for a wave of similar privacy bills to protect users' privacy.

The question of what a thought is is no longer a purely philosophical one. With advancements in technology, our thoughts can be measured and tracked through brainwaves. This breakthrough has made the data commodifiable, with companies in the wearable consumer technologies industry already buying and selling captured brain data, with little protection for users.

The "Colorado Consumer Protection Act" has been updated with a new privacy act that safeguards individuals' personal data. This act is the first of its kind in the country and sets forth specific requirements for entities that process personal data. Additionally, the act includes enhanced protections for sensitive data.

The Colorado act expands the definition of "sensitive data" to include "biological data," encompassing a range of biological, genetic, biochemical, physiological, and neural properties.

Elon Musk's Neuralink is the most well-known example of technology being integrated with the human mind, although it is not the only one in this field. Paradromics is also a competitor, and there are devices that have helped stroke victims regain speech and amputees control prosthetic limbs with their minds. These products require implantation and are protected under HIPAA's privacy regulations. However, the Colorado law is focused on the rapidly expanding consumer technology sector and devices that do not require medical procedures, have no equivalent protections, and can be purchased and used without any medical oversight.

Numerous companies offer wearable technology products that capture brain wave data, which can be found on Amazon. These products include sleep masks, headbands, and biofeedback headsets that optimize deep sleep, promote lucid dreaming, enhance focus, and improve meditation sessions. These devices capture neural data using small electrodes that produce readings of brain activity, with some also deploying electric impulses to influence brain activity.

There are almost no laws governing the management of brain data.

"The lead sponsor of the Colorado bill, Representative Cathy Kipp, stated that we have entered the realm of science fiction and that it is crucial to establish boundaries as science progresses."

'ChatGPT-moment' for consumer brain tech

The NeuroRights Foundation's recent study revealed that out of the thirty wearable technology companies examined, only one imposed meaningful limitations on brainwave access.

"This consumer neurotechnology revolution has been centered on the growing ability to capture and interpret brainwaves," said Dr. Sean Pauzauskie, medical director at The NeuroRights Foundation. Devices using electroencephalography, a readily available tech to consumers, is a "multibillion-dollar market that is set to double over the next five or so years," he said. "Over the next two to five years, it is not implausible that neurotechnology might see a ChatGPT-moment."

The amount of data that can be gathered is influenced by several variables, but the technology is advancing rapidly, and it has the potential to significantly increase the number of applications, with AI becoming more integrated. Apple has already filed patents for brain-sensing AirPods.

"The sanctity of our minds demands that brain data be regulated, according to Rafael Yusuf, professor of biological sciences and director of the NeuroTechnology Center at Columbia University, as well as the Chairman of the NeuroRights Foundation and a leading figure in the neutotech ethics organization Morningside Group. He emphasized that the brain is not just another organ of the body, but rather a unique entity that requires careful consideration and responsible innovation frameworks."

Pauzauskie stated that the worth to companies lies in the interpretation of the brain signals gathered by wearable technologies. For instance, if a person wears brain-sensing earbuds, Nike can not only determine from their browsing history that they looked for runners' shoes but can also determine their level of interest as they browsed.

A wave of biological privacy legislation may be needed

The focus of the Colorado law could result in a trend of similar legislation, with a greater emphasis on the intersection of rapidly developing technologies and the commercialization of user information. Historically, consumer rights and safeguards have not kept pace with technological advancements.

Pauzauskie stated that the best and most recent tech/privacy analogies could be the internet and consumer genetic revolutions, which were largely unchecked.

The Colorado Privacy Act grants brain data the same privacy rights as fingerprints, which presents risks such as hacking, corporate profit motives, constantly evolving privacy agreements, and a lack of laws governing the data.

The technology's limitations and the extent of intrusive data collection are still unknown, according to Professor Farinaz Koushanfar and Associate Professor Duygu Kuzum of the department of Electrical and Computer Engineering at UC San Diego.

Tracking neural data could mean accessing medical information directly, according to a joint statement sent via email.

The vast array of potential outcomes is a cause for concern.

If these laws are implemented, companies may be forced to restructure their organizations and appoint compliance officers, as well as implement risk assessment, auditing, and anonymization methods to meet compliance requirements.

The Colorado law and any future initiatives are crucial in educating consumers and empowering them to safeguard their rights if they are violated.

Pauzauskie stated that the privacy law in Colorado regarding neurotechnology could be an exception, as it prioritizes consumer rights and regulations before any widespread misuse or abuse of data.