Analysis limits. The Science feature (Jonathan Moens, 4 November 2026, Vol 394, Issue 6824) was read in full. The 2018 consumer EEG study it cites was checked against the paper, and the legal history against Senate releases and law firm summaries. Science's review of 57 privacy policies is reported as counts and one graphic; the underlying spreadsheet is not published, so the policy numbers below are Science's and could not be recounted. Company figures (Interaxon's 50,000 hours, Piramidal's 4 million hours and its seizure pilot) are self reported. No adversarial model pass was run. No patient material appears in this piece; the one user named is Science's on the record source.
Half an hour before bed, a man in Leicester straps on a headband, lies down, and presses a button. The Muse headband records his brain waves, heart rate and cerebral blood oxygen overnight and hands him a sleep report in the morning. He has used it on and off for four years. What the report did not mention is that his recordings may also have gone into an AI model of the brain that Interaxon, the Canadian company that makes the Muse, has been training on about 50,000 hours of user EEG.
That is the opening of a Science investigation, produced with the Pulitzer Center's AI Accountability Network, into how consumer neurotech companies use what they collect. The core finding is narrow and well documented. Several companies are building "brain foundation models" from user data, and none of the ones Science identified said so in their privacy policies until Science asked. Two of them rewrote their policies within weeks. The broader claims (that brain data is the last frontier of privacy, that AI will soon decode personality from a forehead sensor) rest on expert opinion, and the article is honest enough to quote experts who disagree.
| Element | What Science did |
|---|---|
| Method | Review of privacy policies from 57 consumer oriented companies worldwide that collect EEG data, plus interviews with companies, users, investors and neuroethicists. About a year of reporting. |
| Funding | Science Fund for Investigative Reporting; Pulitzer Center AI Accountability Network |
| Companies on record | Interaxon (Muse), Emotiv, Piramidal, MATRIX (did not respond) |
| What it does not have | A published dataset, a named list of the 57 companies, or any evidence that brain data has been sold or misused |
| Privacy policy finding (57 companies) | Count |
|---|---|
| No privacy policy at all | 4 |
| Policy covering website visitors only | 11 |
| Broader policy that explicitly mentions brain data | about two thirds of the rest |
| Allow sharing of anonymized, aggregated or deidentified data with third parties | all but one |
| Explicitly say they will not sell brain data | 6 |
| Say generally they do not sell personal information | 17 more |
| Prohibit sharing with police, government or courts | 0 |
| Explicitly allow transfer of data in an acquisition | more than two thirds |
| Foundation model builders that disclosed it in the policy (before Science asked) | 0 of 9 |
Interaxon has trained its model on about 50,000 hours of EEG from Muse users, stripped of names and emails, and plans to use "as much of that eligible corpus as possible." Its privacy policy did not say so. After Science pointed it out, the company changed the policy. "We agree users should be explicitly informed," said its chief marketing officer.
What holds upEvery element comes from the company's own mouth, including the admission. The policy change is the article's strongest piece of evidence, because a company does not revise a document it believes was already adequate.
The nuance"Without telling users" means without telling them in the privacy policy. Science notes the foundation model efforts were disclosed elsewhere, in press releases. That is a weak form of notice, and it is still notice. The headline's "harvesting" is fair for the scale and unfair for the tone; the data were collected for a service users wanted and then reused.
Of 57 companies, four had no policy and 11 covered only website visitors. Almost all allow deidentified sharing with third parties, only six rule out selling brain data, and none rule out handing data to authorities.
What holds upThe pattern matches an independent 2024 Neurorights Foundation review of 30 companies, which found that 29 placed no meaningful limits on how they used or sold user data and fewer than half encrypted and deidentified it. Two reviews, two years apart, same picture.
What is missingThe 57 companies are not named, the coding rules are not published, and "about two thirds" leaves the denominator to the reader (roughly 42 companies with a full policy, by subtraction). Silence on police requests is standard boilerplate across consumer tech and says more about lawyers than about neurotech.
Nine consumer neurotech and AI software companies have publicly acknowledged building one. None of the consumer device makers among them disclosed it in their privacy policies. Emotiv trains its "large brain model" partly on data from its higher end devices and, after Science's inquiries, now requires opt in consent.
What holds upThe Emotiv account is specific and confirmed by the company. Emotiv has history here. In August 2023 the Chilean Supreme Court ordered it to delete a former senator's brain data collected without adequate consent.
What is missingOnly three of the nine are named. Readers cannot check the other six.
Consumer headsets use one to six electrodes against 19 to 25 on a clinical cap, cover a small patch of scalp, and see little of the deep structures that handle emotion and memory. Some experts say this limits what can be learned to broad states such as sleep onset. Rafael Yuste says AI analysis of surface signals could be enough to decode "thoughts, emotions, and personality."
What holds upThe hardware description is accurate, and the article gives the skeptics real space. A venture investor calls an all purpose brain model "a very, very long way off." Nita Farahany points out that clicks and eye tracking already reveal as much about mental states as a forehead sensor.
What the headlines inflatedThe decoding claim is a forecast, and Yuste cofounded the Neurorights Foundation, which campaigns on exactly this issue. So does Jared Genser, its general counsel, also quoted. Their views are legitimate. They are also the advocacy side of the story, and the article does not label them that way.
A 2018 study found that of more than 3,000 publications cited by consumer EEG companies, only 11 used gold standard methods, and 10 of those found no benefit over a control.
What the paper showsWexler and Thibault reviewed 18 consumer EEG companies. The 3,000 figure is the body of neurofeedback literature claiming benefits for attention, cognition and insomnia, which the companies lean on. Eleven of those experiments were double blind with a sham control, and ten found sham and real neurofeedback equivalent. Only one of the 18 devices had been validated against research grade EEG.
The nuance"Cited by these companies" slightly overstates it; the companies point to a literature, not a bibliography of 3,000 papers. The paper's sharper finding, that 17 of 18 devices had no public validation at all, did not make the article.
Piramidal, trained on more than 4 million hours of public and hospital EEG, fine tuned its model on Cleveland Clinic data and correctly identified nine of ten seizures in a pilot.
What is missingTen events is an anecdote with a denominator. No false alarm rate, no comparison with existing seizure detection software, no publication. Clinicians judge seizure detectors by how often they cry wolf, and that number is absent.
The more consequential thread is consent. Piramidal draws on open research corpora such as Temple University's EEG Corpus (60,000 recordings). Patients consented to research, and Farahany notes they did not contemplate AI training. The CEO's answer, that these patients are "waiting for something to be built like that," is an argument about what patients would want, offered by the person who benefits from the answer.
Chile protected brain data in its constitution in 2021 and its Supreme Court ruled against Emotiv in 2023. Colorado and California have added neural data to state privacy laws. A bill from Senator Schumer would have the FTC study gaps and propose a framework.
What the record showsAccurate. Colorado amended its law in April 2024 and California in September 2024, and Montana and Connecticut followed in 2025. The federal bill is the MIND Act, introduced in September 2025 by Senators Cantwell, Schumer and Markey.
The nuanceThe MIND Act directs a study. It regulates nothing. And HIPAA, which governs the same EEG in a hospital, does not reach a headband bought online.
The neurotechnology market is worth about $19.19 billion this year and should reach nearly $33 billion by 2034. Apple has patented EEG earbuds and Meta sells a Neural Band.
What the reader is not toldThe figure is an unsourced market research estimate, and "neurotechnology" in those reports usually includes implants, neurostimulators and hospital equipment. The consumer headband slice is a fraction. A patent is not a product. The Meta band reads muscle signals at the wrist. It counts as neural data under California's definition, which covers peripheral nerves, but it is not reading anyone's brain.
Jonathan Moens is a science journalist based in Rome, and this is careful work. He got companies on the record, extracted two policy changes, quoted a user in his own words, and gave the skeptics their paragraphs. The weakest sourcing is on the alarm side. Several of the strongest quotes come from people whose organizations exist to argue this point, and the piece does not flag it.
The investigation documents a consent failure. It does not document harm. Farahany, the most cited ethicist in the field, says she has not heard of a single company selling brain data. The live risks the article names are acquisition (a careful startup bought by a less careful buyer), blockchain data markets that pay people to rent out their sleep, and Chinese workplaces recording EEG from truck drivers and construction workers, sometimes without anonymization. Those are plausible and mostly prospective.
One copyediting slip: Piramidal's CEO is Dimitris Fotis Sakellariou in one paragraph and "Sakalleriou" in the next.
The reason the data is worth collecting is the same reason it is hard to give away. Hospital EEG archives are built from sick people, and a consumer company holds something medicine has never had, years of nightly recordings from people who are mostly well, which makes it the best candidate yet for a working model of normal. That normal comes with an asterisk, since the people who buy a $250 meditation headband are younger, wealthier and healthier than the rest of us, so any baseline it sets will treat the rest of us as the outlier. And brain waves seem to be as personal as a fingerprint (researchers can tell individuals apart from EEG, even from sensors in the ear), so "stripped of names and emails" may not mean anonymous at all.
A forehead sensor cannot read your thoughts. It can be read into a model, and until a reporter called, the paperwork never mentioned it. Two companies fixed their policies in a paragraph. The 50,000 hours already in the model are staying there.
Sources
Primary: Moens J. "The scramble for your brain data." Science, 4 Nov 2026; 394(6824). doi 10.1126/science.zp18ht9. science.org
Companion feature: Moens J. "Are brain-scanning hard hats a safety dream, or a privacy nightmare?" Science, 5 Nov 2026. science.org
Consumer EEG evidence: Wexler A, Thibault R. "Mind-Reading or Misleading? Assessing Direct-to-Consumer EEG Devices Marketed for Wellness." Journal of Cognitive Enhancement, 2018. link.springer.com
Prior policy review: Neurorights Foundation, "Safeguarding Brain Data," April 2024, as reported by STAT. statnews.com · report PDF
MIND Act: Senate Commerce Committee release, September 2025. commerce.senate.gov
State neural data laws: Arnold & Porter, "Neural Data Privacy Regulation," July 2025. arnoldporter.com · CSIS, "When Thought Becomes Data." csis.org
Apple EEG earbud patent: US20230225659A1. patents.google.com
UN report on neurotechnology and human rights: A/81/351, October 2026. docs.un.org
EEG as a biometric: Nakamura T, Goverdovsky V, Mandic DP. "In-ear EEG biometrics for feasible and readily collectable real-world person authentication." arXiv 1705.03742, 2017. arxiv.org