Anika Begay
Getty Images
The question “What is a thought?” is no longer strictly philosophical. Like everything else measurable, our thoughts are subject to increasingly technical answers, with data captured by tracking brainwaves. This shift also means that data is commodifiable, and captured brain data is already being bought and sold by companies in the wearable consumer technology space, with few protections in place for users.
In response, Colorado recently passed a first-in-the-nation privacy act aimed at protecting these rights. The act is part of the existing Colorado Consumer Protection Act, which aims to protect “the privacy of individuals’ personal information by establishing certain requirements for entities that process personal information [and] includes additional protections for sensitive data.”
The key point of the Colorado law is the expansion of the term “sensitive data” to include “biological data,” meaning numerous biological, genetic, biochemical, physiological, and neural properties.
Elon Musk’s Neuralink is the most famous example of technology being integrated into the human mind, though it is not alone in the field, with Paradromics emerging as a direct competitor, along with devices that have restored speech to stroke victims and helped amputees move prosthetic limbs with their minds. All of these products are medical devices that require implantation and are protected by HIPAA’s stringent privacy requirements. Colorado’s law focuses on the rapidly growing consumer tech space and devices that do not require medical procedures, have no similar protections, and can be purchased and used without medical supervision of any kind.
There are dozens of companies that make products that are wearable technologies that capture brainwaves (aka neural data). On Amazon alone, there are product pages, from sleep masks designed to optimize deep sleep or promote lucid dreaming, to headbands that promise to promote focus, to biofeedback headphones that will take your meditation session to the next level. These products, by design and necessity, capture neural data through the use of small electrodes that produce readings of brain activity, with some delivering electrical pulses to influence brain activity.
The laws in place to manage all this brain data are virtually non-existent.
“We’ve entered the realm of science fiction,” said the bill’s lead sponsor, Colorado Rep. Cathy Kipp. “As with any advance in science, there have to be guardrails.”
‘ChatGPT-moment’ for Consumer Brain Technology
A recent study by the NeuroRights Foundation found that of the thirty companies it examined that produce wearable technologies capable of capturing brain waves, twenty-nine “impose no significant restrictions on this access.”
“This revolution in consumer neurotechnology has been centered on the growing ability to capture and interpret brain waves,” said Dr. Sean Pauzauskie, medical director at the NeuroRights Foundation. Devices that use electroencephalography, a technology readily available to consumers, are “a multibillion-dollar market that is set to double in the next five years or so,” he said. “It’s not unlikely that neurotechnology could have a ChatGPT moment in the next two to five years.”
The amount of data that can be collected depends on several factors, but the technology is advancing rapidly and could lead to an exponential increase in applications, as the technology increasingly incorporates artificial intelligence. Apple has already filed patents for brain-sensing AirPods.
“Brain data is too important to be left unregulated. It reflects the inner workings of our minds,” said Rafael Yusuf, a professor of biological sciences and director of Columbia University’s NeuroTechnology Center, as well as president of the NeuroRights Foundation and a senior figure at the neutotech ethics organization Morningside Group. “The brain is not just another organ in the body,” he added. “We need to engage private actors to ensure they adopt a responsible innovation framework, because the brain is the sanctuary of our minds.”
Pauzauskie said the value for companies lies in interpreting or decoding the brain signals collected by wearable technologies. As a hypothetical example, he said, “If you were wearing brain-sensing earbuds, Nike would not only know that you were browsing for running shoes, but they could now also know how interested you were while you were browsing.”
A wave of biological privacy legislation may be needed
The concern addressed by the Colorado law could lead to a wave of similar legislation, with increased attention to the merging of rapidly advancing technologies and the commodification of user data. In the past, consumer rights and protections have lagged behind innovation.
“The best and most recent analogies between technology and privacy may be those between the Internet and the largely unchecked consumer genetic revolutions,” Pauzauskie said.
A similar arc could follow unchecked advances in the collection and commodification of consumer brain data. Hacking, corporate profit motives, evolving privacy agreements for users, and narrow or nonexistent laws covering the data are all major risks, Pauzauskie said. Under the Colorado Privacy Act, brain data is extended the same privacy rights as fingerprints.
According to Professor Farinaz Koushanfar and Associate Professor Duygu Kuzum of the Department of Electrical and Computer Engineering at the University of California, San Diego, it is still too early to understand the limitations of the technology, as well as the extent of the potentially invasive data collection.
Tracking neural data could mean tracking a wide range of cognitive processes and functions, including thoughts, intentions, and memories, they wrote in a joint emailed statement. On the one hand, tracking neural data could mean directly accessing medical information.
The wide range of possibilities is a problem in itself. “There are still too many unknowns in this field and that is worrying,” they wrote.
If these laws become widespread, companies may have no choice but to rethink their current organizational structure, according to Koushanfar and Kuzum. They may need to establish new compliance officers and implement methods such as risk assessments, third-party audits, and anonymization as mechanisms to establish requirements for covered entities.
From a consumer perspective, the Colorado law and all subsequent efforts are important steps toward better educating consumers and providing them with the tools they need to verify and exercise their rights when they are violated.
“The Privacy Act [in Colorado] “With neurotechnology, this may be a rare exception, where rights and regulations precede any widespread misuse or abuse of consumer data,” Pauzauskie said.
