Brain-wearable makers left AI training on users' brain data out of their privacy policies, Science finds

By Inside BCI · Edited by Velco Dar · November 7, 2026

Adnan Jinnah wears a Muse headband to bed to track his sleep. He did not know his brain-wave recordings may also have trained an AI model of the brain, until Science told him.

What Science found

Science published a yearlong investigation by journalist Jonathan Moens on 4 and 5 November 2026, produced with the Pulitzer Center’s AI Accountability Network. It reviewed the privacy policies of 57 consumer companies around the world that collect EEG data, the brain signals recorded from the scalp.

Four had no privacy policy at all and 11 had a policy covering only website visitors. Of the companies with privacy policies, all but one allow data to be shared with third parties in anonymised, aggregated or de-identified form, often without saying whether that includes brain data. Only six said explicitly that they would not sell users’ brain data. More than two-thirds explicitly allow data to pass to a new owner if the company is acquired, and every company either permitted sharing with police, government or courts on request or did not say.

Nine consumer neurotechnology and AI software companies have publicly said they are building a brain foundation model, an AI model trained on large amounts of brain data that can be adapted to many tasks. Initially, none of the consumer neurotechnology companies building one disclosed it in their privacy policies.

The companies

Interaxon, the Canadian maker of the Muse headband, told Science it has trained its model on about 50,000 hours of EEG data from users, stripped of names and emails, and plans to use more. Its privacy policy did not explicitly say user data might train AI brain models. After Science raised it, Interaxon updated the policy; it now says de-identified data is used to train machine-learning models, including foundation models. Science notes that data embedded in an AI system is near-impossible to remove.

Emotiv told Science it trains its Large Brain Model partly on data from users of its higher-end devices. After Science’s inquiries, it updated its privacy policy. The current version, effective 6 August 2026, says that, with users’ explicit opt-in consent, it uses pseudonymised neural data to train its Large Brain Model.

Nita Farahany, professor of law and philosophy at Duke University, said companies that want to train AI on user data should get “a specific and separate consent” for that purpose.

Brain-scanning hard hats in China

A companion Science article looks at fatigue monitoring at work. Huanao Security (Beijing) Technology’s NeuroHua helmets, which record brain activity alongside movement and blood oxygen, are used on dozens of high-risk construction sites in China, including metro lines in Guangzhou, Chongqing and Beijing. Around 2,000 are in use and have collected more than 300,000 hours of EEG data, and the company hopes to reach 10,000 by the end of the year. Huanao says employees must consent, that clients store the data on their own servers, and that it does not keep raw EEG data but, with a client’s consent, uses anonymised data sets for research.

A subsidiary of Shanghai Diyi Technology, known as Deayea, fits truck drivers in Shanxi province with brain-monitoring caps, and Deayea gives local traffic police real-time access to the brain-wave data alongside camera footage and drivers’ names, worker IDs and locations. On 1 June, GA/T 2372-2026, a recommended Ministry of Public Security industry standard, took effect, letting police investigating road accidents use an EEG fatigue reading as one way to identify fatigued driving. Science reports it is the first to formally recognise EEG for assessing driver fatigue, and that Deayea helped draft it. The devices have spread in part because they are classed as brain-computer interfaces, an industry China is promoting.

Outside China, the SmartCap, owned since 2021 by Canada’s Wenco International Mining Systems, collects EEG from five sensors on the forehead and has been used at mines and construction projects from Ghana and Mexico to Australia. Wenco says only a fatigue score leaves the device, and that about 85 per cent of its alerts come from 5 per cent of workers.

What Dargentic Intelligence found in Issue 02

The second issue of the Dargentic Intelligence Report, Brain-Computer Interfaces: The Infrastructure Race, looked at the same question from the side of the companies building brain models, with data to 30 September 2026. On page 16, “Who Owns the Brain Data That Trains AI”, it reviewed four holders of training recordings. Hemispheric reported more than 250,000 hours of EEG and behavioural recordings from more than 100,000 people for its Descartes model, with no participant terms disclosed. Conduit has gathered about 10,000 hours itself, paying volunteers $50 for a two-hour session in a headset recording brain signals, voice and text; it has not published its consent form, and its privacy policy says study data trains AI and that deletion may not reach data built into models. Meta’s Brain2Qwerty v2 decoder was trained on recordings from nine volunteers, and Zyphra’s ZUNA model on about 2 million channel-hours from 208 public datasets.

The report’s view was that the companies that treat the people supplying recordings as licensors, with clear consent, a share of the upside and a way out, will be the ones able to keep collecting. It advised brands, studios and platforms with engaged audiences to write neural-data terms before recording anything, covering what is captured, who may train on it and how a user withdraws.

InsideBCI is published by Dargentic Intelligence.

Why it matters

For investors and acquirers, brain data is becoming a balance-sheet asset. Interaxon’s chief marketing officer told Science the company’s brain data is its most valuable part, and more than two-thirds of the companies Science reviewed explicitly allow user data to pass to a new owner. For employers, fatigue-monitoring systems put brain data in the hands of supervisors and, in China, police. Several US states, including Colorado and California, have added neural data to the sensitive data covered by their privacy laws, and the MIND Act, introduced in September 2025 by Senators Chuck Schumer, Maria Cantwell and Ed Markey, would direct the Federal Trade Commission to study how existing law covers neural data and describe a regulatory framework. Chile’s Supreme Court ordered Emotiv in 2023 to delete a former senator’s brain data.

Not disclosed

Science did not publish the full list of the 57 companies it reviewed. Interaxon has not said how many users’ recordings were used to train its model or whether users can now opt out. Deayea did not respond to Science’s requests for comment.

What to watch

Whether other neurotechnology companies update their privacy policies to disclose foundation-model training.

Whether US state attorneys general or the Federal Trade Commission act on undisclosed use of neural data.

Whether China’s June fatigue-driving standard leads more transport operators to fit EEG monitors to drivers.

Sources

Primary:

Cross-reference to prior InsideBCI coverage:

policy neural-data Science Interaxon Muse Emotiv brain-foundation-models privacy China Huanao-Security Deayea Wenco SmartCap workplace-monitoring