The Legal Vacuum in Cognitive Privacy and Brain Data
There is an entire world emerging—technology capable of interpreting our brainwaves to predict which ads we’ll respond to, lift our moods, or queue the perfect playlist.[1] U.S. patent filings in neurotechnology are soaring,[2] mirroring the surge seen in gene-editing innovations.
Yet while gene-editing tools have sparked fierce public and ethical debate,[3] neurotechnology companies are quietly amassing vast troves of brainwave data with far less scrutiny.[4] What legal or ethical constraints are in place to govern the collection, use, or commercialization of this deeply personal data? Positioned at the intersection of data privacy, intellectual property, and scientific innovation, these questions demand careful and urgent attention.
The Technology
A brain-computer interface (BCI) is a technology that enables direct communication between the brain and external devices, using neural signals to control or interact with technology without the need for physical movement.[5] These include applications controlling robotic prosthetics, speech-generating devices, and controlling video games. As BCIs and neuroadaptive technologies move from clinical settings into consumer markets, a new class of data is rapidly gaining relevance: brain data.
The Brain Data
Generated by devices that monitor, decode, or stimulate neural activity, brain data carries unparalleled sensitivity. It can expose mental health conditions, emotional states, attention patterns, and even imagined speech.[6] Many neurotech companies collect, store, and sometimes share neural data with third parties, often without meaningful user consent.[7]
Despite these risks, brain data often falls into a legal gray area—not clearly protected by existing health or biometric privacy regimes, nor patent law.[8]
Brain Data as a Strategic Asset
The value of brain data stems from its capacity to train adaptive algorithms and personalize neurotechnologies. Devices from companies like Neuralink, OpenBCI, Emotiv, and Kernel are designed not only to provide real-time neurofeedback, but also to learn from user inputs over time.[9] This makes brain data a key asset for improving device performance and unlocking new functionalities.
Unlike traditional medical data, brain data generated by consumer BCIs is not clearly protected under HIPAA.[10] Nor is it squarely covered under biometric privacy laws like Illinois’s BIPA, which focuses more narrowly on fingerprints, face scans, and voiceprints.[11] As a result, brain data functions less as a regulated medical record and more as a commercial asset—similar to the user behavior data hoarded by big tech platforms.[12] This leaves companies with broad discretion to collect and profit from brain data in the form of neural datasets.
Regulatory Direction
The lack of clear legal protections for brain data has sparked calls for a new legal category: cognitive privacy. This term, championed by the Neurorights Initiative and others, refers to the right of individuals to control access to their mental states and neural signals.[13] In 2021, Chile became the first country to sign a constitutional amendment enshrining neurorights by protecting brain activity and data.[14] In the U.S., California in 2024 introduced legislation to regulate the collection and use of brain data by neurotech companies by adding a “consumer’s neural data” to the definition of “personal information” and specifying that “personal information” can exist in “abstract digital” formats.[15]
The Patent Law Gap
Patent law protects inventions, not data. While brain data is not entirely absent from patent law, existing patents primarily focus on brain-computer interfaces (BCIs) or neurotechnologies rather than cognitive data itself.[16]
Under current U.S. doctrine, raw brain data is considered a natural phenomenon, not subject to patent protection under 35 U.S.C. § 101.[17] Courts have routinely held that naturally occurring correlations, such as those between specific brain signals and mental states, are unpatentable unless the claim includes a novel and non-obvious application that transforms the natural phenomenon into a practical, inventive process.[18]
Toward a Coherent Legal Approach
What would a better legal framework look like? One option is to treat brain data similarly to naturally occurring genes—not patentable, but subject to heightened privacy and disclosure standards. Legislation could also mandate informed consent, data minimization, and opt-out rights for users of BCI devices, particularly in non-clinical contexts.[19] This would preserve individual autonomy while allowing for responsible research and innovation.
As neurotechnology continues to evolve, legal systems must grapple with the unprecedented sensitivity and value of brain data. Without proactive legal intervention, this unregulated data frontier could entrench digital inequality and erode mental privacy.[20] In this patent law and regulatory vacuum, companies are quietly building powerful datasets that may define the future of cognitive computing. It is time for lawmakers, scholars, and technologists to recognize brain data as more than a byproduct—and to craft a legal infrastructure that meets the moment.
Kayla Flanders is a 2L Staff Editor for the Cardozo Arts & Entertainment Law Journal.
[1] Sharon Begley, Brain Technology Patents Soar as Companies Get Inside People’s Heads, Reuters (May 6, 2015) https://www.reuters.com/article/business/media-telecom/brain-technology-patents-soar-as-companies-get-inside-peoples-heads-idUSL1N0XV1GR/.
[2] Id.
[3] Mary Todd Bergman, Perspectives on Gene Editing, Harv. Gazette (Jan. 9, 2019) https://news.harvard.edu/gazette/story/2019/01/perspectives-on-gene-editing/ [https://perma.cc/JU5Z-7G5C].
[4] Ms. Smith, Company with No Privacy Policy to Collect Brainwave Data on 1.2 million Students, CSO Online (Dec. 5, 2017) https://www.csoonline.com/article/563813/company-with-no-privacy-policy-to-collect-brainwave-data-on-1-2-million-students.html#:~:text=Yet%20here%20we%20go%20again,the%20world’s%20biggest%20brainwave%20database.%E2%80%9D [https://perma.cc/X8QM-TTJ2]. (“BrainCo headbands will collect biometric brainwave data on over 1 million students to ultimately create “the world’s biggest brainwave database.”); Id.
[5] Hongyu Zhang Et Al., Brain–Computer Interfaces: The Innovative Key to Unlocking Neurological Conditions,Nat. Lib. of Med.(Aug. 14, 2014) https://pmc.ncbi.nlm.nih.gov/articles/PMC11392146/ [https://perma.cc/4YQL-UL5M].
[6] Nita A. Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy, Scientific American (Mar. 27, 2023) https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/ [https://perma.cc/ZH3N-Q3GQ].
[7] Jared Genser Et Al., Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies, Neurorights Foundation, https://perseus-strategies.com/wp-content/uploads/2024/04/FINAL_Consumer_Neurotechnology_Report_Neurorights_Foundation_April-1.pdf [https://perma.cc/58BL-WB8F].
[8] Abeer Malik, Mind over Machine: Navigating the Legal and Ethical Frontier of Neurotech,The Petrie-Flom Center(Feb. 27, 2025) https://petrieflom.law.harvard.edu/2025/02/27/mind-over-machine-navigating-the-legal-and-ethical-frontier-of-neurotech/ [https://perma.cc/SZX5-KHSS].
[9] Antonio Regalado, Brain Implants Could Be the Next Computer Mouse, MIT Tech. Rev. (Oct 27. 2021) https://www.technologyreview.com/2021/10/27/1036821/brain-computer-interface-implant-mouse/; Yeison Nolberto Cardona-Álvarez, et al, A Novel OpenBCI Framework for EEG-Based Neurophysiological Experiments, National Library of Medicine (Apr. 6, 2023)
https://pubmed.ncbi.nlm.nih.gov/37050823/ [https://perma.cc/A9TV-ATHL]; https://www.emotiv.com/blogs/tutorials/eeg-neurofeedback-beginners-guide?srsltid=AfmBOoom_Vlz2wtWktmKgT3s-2hei-zaEe8Wl35vY4EQ6WeODzB6Cmse [https://perma.cc/JM77-RKYW].
[10] Malik, supra note 8; 42 U.S.C. § 1320d.
[11] Daniel S. Brennan, With Great Data Comes Great Responsibility: The Illinois Biometric Information Privacy Act and the Construction Industry, Laurie & Brennan (Mar. 5, 2018) https://www.lauriebrennan.com/blog/with-great-data-comes-great-responsibility-the-illinois-biometric-information-privacy-act-and-the-construction-industry/ [https://perma.cc/8XK7-L6GB]; 740 Ill. Comp. Stat. Ann. § 14/10.
[12] Johana Bhuiyan, Social Media and Online Video Firms are Conducting ‘Vast Surveillance’ on Users, FTC Finds, The Guardian (Sept. 19, 2024) https://www.theguardian.com/technology/2024/sep/19/social-media-companies-surveillance-ftc [https://perma.cc/5VNZ-NFG6].
[13] The Neurorights Foundation, Human Rights for the Age of Neurotechnology, (last visited Apr. 15, 2024) https://neurorightsfoundation.org/ [https://perma.cc/BG5U-3PSG].
[14] The Neurorights Foundation, Neurorights in Chile, (last visited Apr. 15, 2024) https://neurorightsfoundation.org/chile [https://perma.cc/2GJN-M4UW].
[15] California Amends CCPA to Cover Neural Data and Clarify Scope of Personal Information, Hunton (Oct. 2, 2024) https://www.hunton.com/privacy-and-information-security-law/california-amends-ccpa-to-cover-neural-data-and-clarify-scope-of-personal-information#:~:text=1008%20and%20S.B.,as%20%E2%80%9Cabstract%20digital%E2%80%9D%20formats [https://perma.cc/3WAM-4ERT].
[16] U.S. Patent No. 8,565,883 B2 (filed Nov. 30, 2012) (issued Oct. 22, 2013) (claiming a method and apparatus for improving cognitive function within a human).
[17] U.S. Patent & Trademark Office, Manual of Patent Examining Procedure § 2106 (9th ed. 2024).
[18] Mayo v. Prometheus, 566 U.S. 66 (2012).
[19] Brad Brooks, First Law Protecting Consumers’ Brainwaves Signed by Colorado Governor, Reuters (Apr. 17, 2024), https://www.reuters.com/technology/first-law-protecting-consumers-brainwaves-signed-by-colorado-governor-2024-04-18/
[20] Sharon Begley, Brain Technology Patents Soar as Companies Get Inside People’s Heads, Reuters (May 6, 2015), https://www.reuters.com/article/business/media-telecom/brain-technology-patents-soar-as-companies-get-inside-peoples-heads-idUSL1N0XV1GR/.
