A new frontier of data privacy in the US – your brain

Electronic devices that capture and analyze brain signals are becoming more mainstream, with brain-reading meditation apps, brain-computer video game interfaces and even attention-tracking headphones hitting the consumer market.

Meta, the owner of Facebook and Instagram, last month publicly tested an augmented reality interface where users navigate the world with neurological signals picked up from a wristband.

A law signed by California Governor Gavin Newsom in September will add new layers of protection for the kinds of data these devices capture.

It is one the most significant advances in privacy regulations for this emerging strata of consumer data, said Josh Becker, the state senator who authored the bill.

“This is a new frontier of privacy rights,” he told the Thomson Reuters Foundation.

The law defines neurological data as ”sensitive personal information,” a class of data that includes DNA, precise geolocation and other highly protected data in California.

According to Becker, companies will now have to disclose how they intend to use that data, and Californians will now be able to request companies delete it or direct them to limit sharing it, among other protections.

It will not bar companies from collecting the data or offering products and services that rely on it. “These are common sense restrictions,” he said.

California – the most populous U.S. state and home to Silicon Valley – often sets the bar for national tech policy.

“We hope these new rights become the floor for how authorities look to regulate neural data going forward,” said Jared Gensler, a lawyer with the non-profit Neurorights Foundation, a privacy advocacy group that helped draft the legislation.

BRAIN RIGHTS GO INTERNATIONAL

Efforts to protect neurological data have proliferated in recent years, as electronic devices available directly to consumers become capable of capturing medical-grade brain data similar to what neurologists would use to diagnose patients.

Experts at the Neurorights Foundation and other groups say sensitive data could be used to decode users’ mental states without their permission.

Chile enacted legal and constitutional protection for brain privacy in 2021, and similar rules have been proposed in other Latin American countries, including Mexico, Brazil and Uruguay.

Last year, Chile’s Supreme Court became the first in the world to order a neurotechnology company to delete a user’s data.

The U.N. Educational, Scientific and Cultural Organization (UNESCO) too is taking up the issue.

In August, a panel of UNESCO experts released a new draft of recommendations for how countries around the world should devise legal protections for the brain in the face of rapid technology advances – particularly in artificial intelligence – that enable the reading and decoding of brain information.

STATE BATTLES

The law in California came on the heels of a similar bill in Colorado, which was also backed by the Neurorights Foundation.

In both states, the laws saw pushback from tech industry groups, and there was significant disagreement among experts about what the law should cover.

TechNet, which represents big tech firms like Meta, Apple and Amazon, tried to limit the scope of the California bill to only include data from “central nervous systems.”

But Becker told the Thomson Reuters Foundation that it was important that the law applied to both central and ”peripheral” nervous system data, as neurological signals taken from other parts of the body, such as the wrist, can also provide insight into mental states.

The final version of both bills eventually did include the peripheral nervous system.

But Nita Farahany, a professor at Duke Law School working on the UNESCO framework, said she is concerned that the law is still drawn too narrowly, as it exempts eye tracking and other signals that can be used to decode a person’s thoughts.

That “leaves a huge gap,” she told the Thomson Reuters Foundation.

Becker and the Neurorights Foundation wanted to focus narrowly on neural data, which they say is particularly sensitive.

Increasingly companies are building devices to capture a range of neurological inputs.

Just last month, a neurotechnology company called Neurable released headphones that decode EEG readings of the brain to gauge a user’s focus.

Adam Molner, a co-founder of Neurable, told the Thomson Reuters Foundation that the company already handles data in a way that complies with the California and Colorado laws.

He hopes that future regulations might give consumers even more choice, saying laws that only regulate what should be in a company’s privacy policy have “the potential to create just another checked box,” that consumers pay little attention to.

In September, Meta previewed AR glasses called Orion that read neural signals from users’ wrists. Meta did not respond to a request for comment about how Orion would comply with California law.

Gensler, the lawyer with the Neurorights Foundation, said that the launch of Orion could be one of the first times a major tech platform is forced to comply with a neurological privacy regulation.

Earlier in the year, the Neurorights Foundation released a report analyzing the privacy policies of 30 consumer neurotech devices and found major privacy gaps. Half allowed companies to broadly share a user’s brain data with third parties.