Neurotechnology encompasses any device that can directly read, measure, or manipulate brain data. Some invasive forms of neurotechnology, like deep brain stimulation (DBS), are implanted directly into the brain to treat the symptoms of Parkinson disease, depression, obsessive-compulsive disorder, and other diseases [5].

These forms of neurotechnology are regulated as medical devices, while consumer-facing devices are largely unregulated in countries like the United States.

“I became very concerned with this [neurorights] through our own experiments with mice,” Yuste told JMIR. “About a decade ago, we were able to decode the activity of the visual cortex and manipulate it selectively using laser-based technology.”

While invasive brain implants or “mind-reading” devices aren’t hitting the consumer market anytime soon, many noninvasive consumer electronics—like Muse or Emotiv—are already on the market. These devices measure electroencephalographic (EEG) brain data to help measure and potentially improve sleep and mental health. Researchers are also developing “mind-controlled” drones using consumer-grade EEG headsets [6]. In 2023, Apple also received approval on its patent for AirPod-like earbuds with built-in electrodes that could theoretically measure and collect EEGs [7].

Marcello Ienca, a professor who studies the ethics of artificial intelligence (AI) and neuroscience at the Technical University of Munich and the Swiss Federal Institute of Technology Lausanne, also believes this raises new problems. “The potential for intervening into brain function, either by recording activity from the brain, or for writing into the brain using neurostimulation techniques, opens challenges that are substantial from a human rights perspective, and that can be well understood as human rights challenges,” he told JMIR.

In response to the development of this technology, Yuste and other experts believe that new “neurorights” relating to brain data are needed [8,9].

Other experts are more skeptical of neurorights. “While there is rough consensus on the potential risks of certain technologies that interact with the human body or the brain, there is no consensus on the notion that those risks are certain or well-defined, that those risks are current and actual instead of potential and speculative,” Gálvez said. “Some of the most publicly visible support comes accompanied by highly exaggerated claims about the capabilities of these technologies.”

Gálvez is concerned that the debate on neurorights displaces attention and discussion from other fundamental rights and data protection regulations.

The Neurorights Foundation analyzed seven existing international human rights treaties and determined that they included insufficient protections for brain data, concluding that amendments or new rights were needed to protect brain data [10].

Nita Farahany, a legal scholar and bioscience professor at Duke University who wrote The Battle for Your Brain, also thinks that new rights are needed. She argues for a broader approach through the lens of “cognitive liberty,” which would protect self-determination, freedom of thought, and mental privacy. Farahany told JMIR that cognitive liberty could provide broad protections against technologies that can predict cognitive states, even if they don’t directly measure neural data.

“If the biometric data is being used to make inferences about a person's mental state, it deserves a higher level of protection,” she said.

Ienca told JMIR that he’s agnostic about the right approach to protecting these rights—whether reinterpreting existing rights or introducing new ones.

Several legal experts told JMIR they don’t think this new framework is needed.

Susie Alegre, a human rights lawyer, author of the book Freedom to Think, and a senior fellow at the Center for International Governance Innovation, told JMIR that adding new rights or amending existing ones doesn’t make sense. “The big problem is that when you say we need new rights, then you are firstly saying the rights we have don't cover this, and therefore, it's a kind of a free pass,” she said. “Fundamentally, I don’t understand advocating for new rights without testing the boundaries of existing rights in court.”

The Neurorights Foundation recently surveyed 30 user agreements from direct-to-consumer neurotechnology companies. Clicking “I agree” on 29 of these agreements would give the neurotechnology company any rights to the data, which would allow them to sell it to a third party. Yuste called these user agreements “predatory.”

“There are no rules; the company is taking everything,” he said. “That's why we're working with many countries and international organizations to protect brain data.” Ultimately, he believes that brain data should be protected as stringently as medical data.

Following the constitutional provisions in Chile, which Yuste and the Neurorights Foundation helped influence, other countries like Uruguay, Brazil, and Mexico have all either proposed or pushed through constitutional amendments that would provide similar protections.

However, experts, including Miralles, say these provisions are unnecessary as the constitutional protections in Latin America sufficiently encompass brain data and can restrict the use of medical neurotechnologies because of how the law is written [4].

Miralles and Pablo Contreras, a law professor at the Central University of Chile, argued that the neurorights provision was irrelevant to the Emotiv case, arguing that the company deleted the data in conjunction with existing data protection laws [13]. “Most constitutions on the continent recognize the right to privacy, and almost all countries have laws on personal data protection inspired by the GDPR,” she said. “Needless to say, the entire hypothesis of this legislation is based on a science fiction fantasy idea.”

Gálvez told JMIR that there were concerns the constitutional provision led to “altering the functions of public health authorities and the application of data protection law, introducing confusion to the legal landscape.”

Meanwhile, in the United States, the Neurorights Foundation also worked alongside the Colorado Medical Society to sponsor bill HB24-1058 to protect brain activity and brain data.

Other states have enacted broader laws to protect other types of biometric data that technology companies collect. Illinois’s Biometric Information Privacy Act, for example, requires private entities collecting biometric data to inform people about what kind of data is being collected, how it’s stored, and how it’s used.

“I think that's a good start, but I would go further than it does,” Farahany said, adding that cognitive biometric data should, for example, be kept on the device where it is collected and not sent to an external company.

In the European Union, Alegre explained that there are already laws and regulations protecting people’s data from exploitation, but the problem involves enforcing and regulating these rules, adding that “the biggest problem is it's very hard to take a tech company to court.”

JMIR News & Perspectives articles are written by journalists. They are not peer-reviewed but rigorously fact-checked. We invite freelance journalists to pitch us original ideas.