In her lab at Oregon Health and Science University in Portland, Oregon, speech-language pathologist Melanie Fried-Oken has seen the development of assistive communication devices and brain-computer interfaces (BCIs).

She specializes in helping individuals with neurologic conditions that interfere with their ability to speak and write, such as locked-in syndrome and amyotrophic lateral sclerosis. While options have improved, they continue to lag far behind what people with these disabilities need.

Eye-tracking software allows individuals to select words on a computer screen simply by looking at them, but even state-of-the-art equipment can be clunky and difficult to use. Many patients resort to a repertoire of canned responses, Fried-Oken says. Even the most adept user can only speak about one word per minute using this software compared with the 150-300 words during unassisted human speech.

Potential Could Be ‘Magical’

Which is why she is so excited about the potential of both implantable and wearable BCIs.

“What the technology is doing is giving you so many options for communicating. It’s learning what your words are, and this has been a huge leap in the field. To me, it’s just magical,” she says.

BCIs range from headphones that claim to biohack your brainpower to surgically implanted devices such as Neuralink that aim to restore speech and other functions for people with neurologic conditions.

What all of these devices share is their collection of large amounts of brain data. Amassing this data is required for the products to work, says Sara Goering, a philosopher and bioethicist at the University of Washington in Seattle. It’s not unlike how Google and Meta gather massive datasets about their sites’ users, says Goering. It’s how they may know we prefer cat photos to cooking tips.

However, Big Tech has gotten into hot water with authorities for misusing and selling this customer data. It makes no sense to assume that, industry promises to the contrary, BCI manufacturers would behave any differently, Goering says.

“People don’t know what they’re actually giving away when they agree to services,” Goering says. “It’s not about what you have to hide; it’s about your control over who has access to your innermost territory, your inner thoughts and feelings. That’s what intimacy is all about — you determine who has access to that.”

The tech companies marketing BCIs claim that privacy is important to them, but their track record in other areas has left consumer data vulnerable, says Walter Johnson, Postdoctoral Fellow at the Center for Law and the Biosciences at Stanford Law School, Stanford, California.

This skepticism and uncertainty are major drivers behind the push by groups, including the NeuroRights Foundation, New York City, to better protect neural data from exploitation by corporations, advertisers, governments, and hackers. 

“This isn’t just a future problem. It’s a today problem,” he says.

While memory-erasing or cognition-enhancing effects remain the stuff of fiction, Stephen Damianos, executive director of the NeuroRights Foundation, says that the growing capabilities of these devices are forcing neuroscientists and ethicists alike to scramble to protect our neural privacy.

“It’s a perfect storm where consumers and users of the products don’t really know what data are being collected about them and how that will change over time,” Damianos says.

Potentially Revealing Data

Neural data — information collected from and about the brain and peripheral nervous system — is so special and intrinsic to who we are that it deserves special protection beyond typical data privacy laws, Nita Farahany, a legal scholar and ethicist at Duke University, Durham, North Carolina, and other experts argue.

“To protect mental privacy, we have to more broadly look at the different ways that modern technologies are able to make inferences about our brain and mental states in ways that weren’t before possible,” Farahany says. She points out that the data could reveal a diagnosis of epilepsy or depression, predict future risk for neurocognitive decline, or even reveal otherwise hidden aspects of our personalities.

Whatever their use, Fried-Oken wants to ensure that BCI developers and manufacturers listen to the needs and concerns of potential users like her patients. These patients could provide input not just on privacy but also on factors such as usability. Not including these perspectives would be unethical, she says, especially because users will be sharing personal, intimate details of their brain’s inner workings.

Ryan Field, CEO and chief technology officer (CTO) of the neurotech company Kernel, Los Angeles, is bullish about the possibilities of these technologies. Kernel’s Flow2 helmet measures brain activity via functional near-infrared spectroscopy that estimates changes in cortical blood flow that occur in response to neurons firing. Like other BCI companies, Kernel is piggybacking on advances in neuroscience that make it possible for devices to detect, record, and decode brain activity at a level of granularity that is unprecedented, Field says.

Such breakthroughs may one day make today’s robo-speech platforms obsolete, he says. Kernel’s products are currently limited to research settings to predict patient responses to treatment, but Field envisions a potential range of brain-based diagnostic and therapeutic devices for everything from major depression to dementia.

“In the case of neuropsychiatric conditions, there aren’t clinical measurements that can drive which treatments are administered. We see an opportunity to help change that,” Field says.

How each device operates varies, but all of them use artificial intelligence and machine learning to record and analyze patterns of brain activity. Some “translate” brain wave patterns into speech or analyze them to assess mood, wakefulness, and other characteristics. Other products offer the potential to modulate brain activity by helping users fall asleep more quickly or by improving their mood.

Ten years ago, as BCI platforms were beginning to take off, Rafael Yuste, neuroscientist at Columbia University, New York City, noted that even in its infancy, the potential of BCIs was being matched by their potential perils.

Neural Data Definitions

In May 2017, Yuste convened what became known as the Morningside Group to discuss the ethical issues. In a paper in Nature, he and his coauthors distilled the group’s discussions into four areas of concern:

• privacy and consent — fully understanding and choosing the data shared with others;
• agency — ensuring devices don’t make you act in ways incongruent with yourself;
• augmentation — protecting individuals from feeling they need to “augment” their brain to be socially accepted; and
• bias — making sure the technology doesn’t privilege certain groups over others.

The paper set out a series of recommendations that would allow humanity to harness the benefits of BCIs while protecting users against potential harms. The NeuroRights Foundation grew out of this work, Damianos says. But the group immediately began running into issues. 

One stumbling block is how to define neural data. Some argue that it should solely include data about the nervous system that can be gathered by neurotechnology, whereas others argue that any sort of biosensor can gather information about our brains’ workings and needs protection.

“This is our number one issue right now,” says Sean Pauzauskie, neurologist and medical director at the NeuroRights Foundation. The foundation helped create the definition used in a California neural privacy bill passed in September 2024, which categorizes neural data as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system and that is not inferred from nonneural information.”

This is a narrower view of neural privacy, Pauzauskie admits, and focuses more on the “neural” aspect than the more general “privacy” one. The organization has also worked with legislators in Colorado and Montana to pass analogous laws.

Other experts, however, say that a broader definition of neural privacy would make protections more robust, even if they provide less specificity about exactly what type of data can and can’t be collected. Each definition has trade-offs. Broader rules potentially offer more protection but at the cost of stifling innovation. More granular rules could leave lawmakers playing catch-up as technology takes off in ways that weren’t predicted. 

Neuroprivacy Laws in Place

In 2021, Chile amended its constitution to specifically protect neurodata and mental privacy, the first country in the world to do so. In the US, there are currently no federal laws addressing the topic, but requests for such guidance are growing.

In April 2025, several Democratic lawmakers asked the Federal Trade Commission to ensure that brain data being collected by devices wouldn’t be sold or otherwise exploited without formal user consent. Two months later, in June, the American Medical Association also submitted an official request for neural privacy protection.

“If you don’t want your data being uploaded to the cloud and aggregated into some dataset, that ought to be your right,” Pauzauskie says.

He isn’t alone in advocating for national legislation on neural privacy. Damianos emphasizes that the intensely personal nature of this information demands extra caution.

“These data are uniquely sensitive in terms of what they can reveal about an individual,” Damianos says. “If we call your geolocational or financial data sensitive and require heightened protections, we also want information that can reveal data about your mental health or cognition to have the same level of protection.”

For Goering, the rules provide a beginning framework for ethicists and experts to begin creating better privacy protections for consumers. In the past few years, wearable BCIs in the form of headphones and headbands have come on the market promising everything from improving mood to enhancing memory. Neurable’s Neuro Headphones ($699) promise to “biohack your brainpower,” using EEG waves to help users be more efficient at work, reduce stress, and even reduce signs of aging. Emotiv’s MW20 earphones ($399-$499) offer similar wellness promises.

NeuroRights’ Pauzauskie expressed enthusiasm about these products; Goering and Fried-Oken, less so.

“There are lots of devices on the market that I think don't have a lot of great evidence behind them for what they claim to do,” Goering says.

Scientists emphasize that currently available products can’t read our minds, but many wellness BCIs capture a vague sense of mood and whether we are “activated” (ie, angry or stressed) or more relaxed. Implantable devices will be able to acquire far more data, but even those detect and interpret brain waves. They can’t currently decode our innermost thoughts, Goering says, although that hasn’t dampened both concern and hype around the possibility that the tech could eventually convert our thoughts into a continuous stream of text.

Fried-Oken has been working with tech companies to help them include patients and other end users in their discussions around privacy. Regulatory work is crucial, she says, but so is input from consumers.

She conducted several qualitative and quantitative studies to understand how future users of brain-to-speech technology prioritize trade-offs in privacy and functionality. The results show that preferences are decidedly not one size fits all. Some want to protect their neural data at all costs, not wanting to share it with manufacturers even if it would improve their personal user experience. Others don’t have an issue sharing their neural data if it eases their ability to communicate. Many were willing to share some types of data under some conditions, but not others.

To Fried-Oken, the take-home message is that clarity, consistency, and customizability are key for individuals to make true informed consent about using BCIs. Robust legislation is required to preserve that consent, she says.

“I want to make sure choices are available for an individual within the devices. And the only way that the developers are going to know what possible choices to have is by including end users,” Fried-Oken says.

In her eyes, involving both patients and researchers in crafting rules is key to ensuring the technology is safe.

“I hope the issue is not in the hands of legislators. I hope it’s in the hands of the scientists,” she says.

Even as countries and states debate these approaches, Goering says that moving forward will need far more than the wave of a magic wand. From defining what neural data is to determining whether its protection should be covered under specific medical privacy rules, broader consumer privacy protection, or as a larger human right, she says the field needs to pull in a range of perspectives to clarify the best path for moving forward.

One consensus that is emerging is the need for a special layer of protection for our mental privacy.

“This is a really important thing to protect because it’s one of our most intimate modes of knowing ourselves and figuring out who we let into our private realm. It’s access to what we’re thinking and/or feeling,” Goering says.

Farahany is on the advisory board for OpenBCI; Field is the CEO and CTO at Kernel and owns shares in the company; and Fried-Oken recently retired. Goering, Johnson, Pauzauskie, and Yuste reported having no relevant disclosures.