In August 2023, Chile’s Supreme Court did something no court had done before: It ruled that a consumer neurotechnology company had failed to protect a person’s brain data, or neurodata, in violation of their constitutional rights. The way it reached that conclusion should change how neuroscientists think about the neurodata laws now being written.
The plaintiff, physician and former senator Guido Girardi, had bought a wireless electroencephalography (EEG) headset from Emotiv, a San Francisco-based company. Emotiv’s device gave users access to their own recordings only if they bought a “Pro” license; otherwise, the data stayed in the company’s cloud, even after an account was deleted. Under the free license Girardi selected, he didn’t get access to his brain data, and the privacy policy he accepted let the company keep it and share it with third parties for purposes he had never specifically approved. He challenged the company, and the court sided with him. I know the case well, because I was one of the amicus brief contributors who argued on his behalf.
Many scholars considered it a landmark ruling for the progress of “neurorights.” But the detail most people miss is how the court actually reached that decision. Chile had amended its constitution in 2021 to add an explicit neurorights clause—the first country to do so—and yet the court did not decide this case on it. Instead, it grounded the ruling in rights already on the books—physical and mental integrity, and privacy, under Article 19 of Chile’s 1980 constitution. Consent to record data for one purpose, the court decided, is not consent to use it for another. What mainly protected Girardi, in other words, was not so much the fact that the data came from his brain—but rather how they were used.
The court’s decision implies that neurodata in general should be governed more by what is done with it than by the organ it came from. That has direct consequences for basic research. Data recorded in a lab is used for scientific study rather than, say, to profile customers or target ads, so it typically poses lower risks. The safeguards should therefore be lighter, and research data should be able to move from the lab that recorded it to the colleagues and repositories that can build on it (including across borders) with fewer restrictions. The same signal captured by a headset sold online, and sold on again, is a different matter entirely.
As a scientist, you might reasonably ask why laws written for consumer gadgets are your problem at all. They are, because the definitions those laws are settling on could easily spread into the institutions that govern your work, and could eventually shape what you can gather, share and reuse.
W
hy has neurodata governance suddenly become urgent? A short answer is that recording the brain has gotten cheaper. What once required a clinic or a dedicated lab now fits inside a headset sold online. Consumer EEG, wearables and research-grade rigs are producing brain data at a scale and in settings that existing rules never anticipated. The signal that used to stay in the hospital now travels through company clouds and across borders.This neurotechnology shift has fed the powerful intuition that neurodata is different. As Marcello Ienca and his colleagues have argued, it’s among the most direct correlates of our mental states, it sometimes escapes our conscious control, and it can be written to as well as read, opening a path to influence the mind directly. On that reasoning, brain data seems to demand its own special category of protection. This understandable instinct is shaping much of the legislation now taking form.
Consider a concrete case: an EEG dataset recorded from a few dozen participants performing a working-memory task. You might like to share the data with a collaborator abroad, pool them with a partner lab’s recordings, or let a graduate student reuse them for a new question three years from now. This should be simple enough to do, but differences in how neural data is regulated from state to state might present some challenges. For instance, California and Colorado have amended their consumer privacy acts to define brain data by where it comes from—the nervous system—and to list it among sensitive data. Connecticut has added neurodata to the sensitive data covered by its privacy act, and Montana folded “neurotechnology data” into its Genetic Information Privacy Act. On their face, none reach you, because they are written for companies handling consumers’ data, not a lab.
Their definitions, though, may reach you by another route. Think about the position this could put an institutional review board in. It is asked to review a technology it may never have seen before, and the only legal definitions of neurodata available to it were written with consumer products in mind. A conscientious board reaching for the best available definition would be reaching for one built for a different problem. The same is true for a university legal office drafting a data-use agreement or a funder revising its data-sharing policy. I’m not aware of a board that has done so yet; the point is how easily one could. None of this would require the law to apply to you. Just the definition.
Moreover, the definitions of what counts as neurodata are inconsistent. California excludes anything inferred from nonneural information; Colorado does not. Montana excludes pupil dilation and breathing rate as downstream effects, not neural activity; Colorado’s definition has no such exclusions. Connecticut covers only the central nervous system. The same pupillometry channel may be deemed neurodata in Denver and not in Helena. So if a board or a legal office does borrow one of these definitions, which one it picks will decide how your recordings are treated. And if your pilot study uses an EEG headset sold as a consumer product, the law does apply to its manufacturer, which means your recording is bound by the company’s terms before it ever becomes your dataset.
At the U.S. federal level, the picture is still taking shape. The MIND Act, introduced in the Senate in September 2025 and still awaiting committee action, does not impose rules; it directs the Federal Trade Commission to study how neurodata should be governed. Its own text, however, hints at something revealing. It asks the commission to consider categorizing neurodata by sensitivity, applying stricter oversight to high-risk uses and weighing benefits against risks. That’s the beginning of a use-based governance framework.
Picture the same EEG recording under different use cases. If a company uses it as a consumer product to infer a shopper’s mood, the risk to users is high and the societal benefit thin—even nonexistent—so the safeguards should be strict. In clinical studies and basic research, the risks are lower, and researchers use the data to develop knowledge that returns to the scientific community and eventually the public.
Source-based rules treat neuroscientists’ recordings like an ad-tech dataset. Use-based rules regulate basic research at the level of risk it actually poses. No more, no less.
Use-based governance protects basic researchers and those whose data are being used, without freezing science. But the framework will not build itself. It needs interdisciplinary research projects, operational mechanisms and institutional tools capable of turning “govern the use” into standards someone can apply on a Tuesday morning. Scientists who support this kind of framework need to help make it happen. Talk to the scientific societies that draft position statements, the funders that revise data-sharing policies and the legislative committees that take expert testimony. These rooms are rarely filled with people who have recorded an EEG. Show up to one.
