A new frontier of intimacy
Every generation imagines it is confronting an unprecedented technology of power. In the case of neurotechnology, that instinct may be justified. Neural interfaces, including brain-computer interfaces (BCIs), promise to restore communication for people with paralysis, improve treatment for neurological disease and deepen scientific understanding of cognition. The therapeutic case is substantial and should not be trivialised. Yet the same systems that decode intention, attention, mood or motor planning also create a new class of information: data drawn directly, however imperfectly, from the brain and nervous system.
This matters because neurodata are not merely another digital exhaust. They are entangled with identity, vulnerability, preference and agency. Even when current tools remain noisy, partial and highly task-specific, their trajectory is clear enough to raise a political question before a purely technical one: who should be allowed to access, infer, store, trade or compel information about the workings of a person’s mind?
The most important debate in neurotechnology is no longer whether minds can be read perfectly; it is whether imperfect access to mental states will be normalised before rights catch up.
That is the proper terrain of cognitive liberty: the idea that people should have meaningful freedom over their own mental processes, identity and decision-making, including protection against unwarranted intrusion or manipulation. The concept is often presented as futuristic. In fact, its urgency is practical and present.
From assistive medicine to ambient monitoring
The public image of BCIs is still dominated by dramatic clinical use-cases: a patient controlling a cursor, producing speech from neural signals or moving a robotic arm. Such applications deserve support. Research backed by leading institutions has shown measurable progress in decoding attempted speech, handwriting and movement from cortical activity. These are serious achievements with life-changing implications for people with severe motor impairments.
But the governance challenge is broader than implanted devices in hospitals. Neurotechnology increasingly includes non-invasive systems such as electroencephalography headsets, wearable sensors, attention monitors and affective computing tools that claim to infer fatigue, engagement or emotional state. Some are pitched for workplaces, schools, transport and gaming. Others sit at the edge of wellness and consumer electronics, where medical safeguards are weaker and data practices less transparent.
This migration from clinic to everyday life changes the regulatory equation. In medicine, there are at least established traditions of consent, ethics review and risk-benefit analysis. In consumer contexts, those disciplines can dissolve into terms and conditions. A user may click "agree" without understanding whether signals are stored locally, processed in the cloud, combined with other behavioural data or repurposed to train machine-learning systems. Once that architecture is in place, the distinction between assistance and surveillance can become alarmingly thin.
Why neurodata are different
Some critics argue that worries about neurorights are overstated because neurodata remain crude. Brain signals are noisy, interpretation is probabilistic and many claims outstrip scientific validity. All true. Yet governance cannot wait for perfect decoding. Privacy law has long recognised that inference can be powerful even when it is uncertain. Credit scoring, predictive policing and behavioural advertising do not require omniscience to shape lives. Neurodata add another layer because they may reveal, or appear to reveal, cognitive states that people have never chosen to express.
That raises at least four distinct concerns. First, mental privacy: protection against unauthorised access to neural signals and derived inferences. Secondly, cognitive liberty: freedom to think, attend and decide without coercive monitoring or manipulation. Thirdly, mental integrity: protection against interventions that alter neural functioning without valid consent or legitimate justification. Fourthly, psychological continuity: safeguarding a person’s sense of identity against intrusive technological interference. These categories are not identical, but together they form the emerging grammar of neurorights.
The most important debate in neurotechnology is no longer whether minds can be read perfectly; it is whether imperfect access to mental states will be normalised before rights catch up.
The Organisation for Economic Co-operation and Development has already acknowledged the need for responsible innovation in neurotechnology. UNESCO’s Recommendation on the Ethics of Artificial Intelligence, while broader in scope, also points to human rights, dignity and agency as central principles for data-intensive systems. The conceptual building blocks exist. What remains underdeveloped is the legal architecture that treats neurodata not simply as health data, not simply as biometrics, but as information connected to freedom of thought itself.
The law is not ready
Existing legal frameworks provide partial cover. Data protection regimes can address consent, purpose limitation, security and access rights. Medical device regulation can govern safety and efficacy. Human-rights law already protects privacy, dignity and, in many jurisdictions, freedom of thought. But partial cover is not the same as adequacy.
Freedom of thought has historically been treated as almost absolute in principle but under-specified in practice, largely because states and firms lacked routine tools to probe mental states directly. That premise is weakening. The UN Human Rights Council’s advisory work and interventions by legal scholars have begun to examine whether neurotechnology requires clearer interpretation of existing rights or entirely new protections. Chile’s constitutional and legislative initiatives on neurorights helped bring the issue into mainstream policy discussion, even if implementation questions remain unresolved.
The gap is especially visible in employment, education and criminal justice. Could a worker be nudged, formally or informally, to wear a device that tracks fatigue or attention? Could schools adopt systems claiming to monitor concentration? Could courts or police seek access to neural evidence, however speculative, in the name of risk assessment or truth-finding? Existing law offers inconsistent answers. In such domains, rights are often eroded not by dramatic coercion but by asymmetry: the weaker party is told participation is voluntary when refusal carries a cost.
If freedom of thought is to mean anything in a neurotechnical age, it cannot stop at protecting beliefs after they are formed; it must also protect the space in which thought is still private, unfinished and vulnerable.
Consent is necessary and insufficient
Much technology governance rests on consent. In neurotechnology, consent remains essential but is plainly inadequate on its own. Neural systems often operate through complex pipelines of collection, filtering, modelling and inference. Even specialists may disagree on what a signal means; ordinary users are in no position to assess all downstream uses. Moreover, neurodata can generate secondary insights that were not foreseeable when initially collected. A signal recorded for assistive communication today might, under a different model tomorrow, be used to infer stress, impulse control or susceptibility to distraction.
This is a familiar problem in data governance, but it is sharper here because of the intimacy of the source. Meaningful consent requires understandable explanations, narrow purpose limitation and genuine ability to withdraw. It also requires alternatives. A patient who needs a communication interface, or a worker whose employer treats monitoring as a condition of performance, is not negotiating from equal power. In those cases, formal consent can mask substantive compulsion.
That is why neurodata governance should include non-waivable protections: strict limits on secondary use, prohibitions on sale or opaque transfer, heightened security duties, independent auditing and strong rights to deletion where clinically feasible. In the most sensitive settings, certain uses should simply be off-limits regardless of consent—especially where they involve coercive monitoring, discriminatory profiling or attempts to detect inner states for policing, hiring or educational sorting.
The manipulation problem
Privacy is only half the issue. The other half is influence. Systems that detect cognitive or emotional states can, in principle, be paired with systems designed to steer them. This need not involve science-fiction scenarios of direct mind control. More mundane forms of adaptation may prove more consequential: interfaces that respond to detected frustration, advertising calibrated to moments of lowered resistance, educational tools that optimise engagement by continuously shaping attention, or workplace systems that nudge pace and compliance.
If freedom of thought is to mean anything in a neurotechnical age, it cannot stop at protecting beliefs after they are formed; it must also protect the space in which thought is still private, unfinished and vulnerable.
Digital platforms already modulate behaviour through recommendation, friction and reward. Neurotechnology could intensify this by making feedback loops more intimate and less visible. Even imperfect signals may improve the timing of intervention. A regime of continuous cognitive optimisation may sound benign, particularly in settings framed around productivity, safety or wellbeing. But autonomy can be diminished by systems that constantly infer when a person is most persuadable, distractible or mentally depleted.
The appropriate response is not to forbid adaptive technologies outright. It is to draw distinctions between assistance and exploitation. Therapeutic neurostimulation under clinical oversight is not equivalent to behavioural steering for commercial gain. An accessibility device that helps a user communicate is not equivalent to an employer dashboard scoring concentration. Governance must focus on purpose, power and context, not only on technical mechanism.
Security is a civil-liberties issue
Cybersecurity is often treated as a technical afterthought in debates about emerging technologies. In neurotechnology, it should be seen as a core matter of liberty. Devices that record or stimulate neural activity create attack surfaces with unusual stakes. The risks range from theft of sensitive data to malicious interference with device functioning. For implanted systems, safety implications are obvious. For non-invasive tools, the concern is less dramatic but still serious: breaches could expose intimate behavioural signatures or allow unauthorised model development based on neural patterns.
Here, security by design should be mandatory rather than aspirational. Encryption, local processing where possible, data minimisation, strict access controls and vulnerability disclosure frameworks ought to be baseline requirements. Regulators should also insist on clear rules for software updates, retention periods and incident reporting. It is difficult to speak credibly about mental privacy while tolerating weak security standards around the devices and platforms that mediate it.
Importantly, security failures in neurotechnology would not be distributed evenly. As with other digital systems, the people most dependent on assistive tools could bear the greatest risk while having the least market power. A rights-based framework must therefore protect both early adopters in consumer contexts and patients whose reliance on neurotechnology is not discretionary.
Neurorights should not become a slogan
The appeal of "neurorights" is that it names a genuine gap. The danger is that it becomes a fashionable label without operational content. Adding a new right to a declaration is easier than deciding how hospitals should share neural datasets, whether insurers may demand access, or what evidentiary standard should apply before authorities can seek neural information in legal proceedings.
A serious neurorights agenda should begin with three practical tests. First, necessity: is collecting or processing neurodata genuinely required for the stated purpose? Secondly, proportionality: are the intrusions narrowly tailored and less invasive alternatives unavailable? Thirdly, contestability: can individuals understand, challenge and refuse inferences or decisions made from their neurodata? Those tests are familiar from other areas of rights law, but they need explicit application here.
There is also a risk of exceptionalism. Not every device that touches the head is a portal into the soul, and overclaiming may discredit legitimate concerns. Policymakers should distinguish rigorously between validated capabilities and speculative marketing. Yet scepticism about hype should not become complacency about power. Civil liberties are often easiest to protect before a technology becomes infrastructural.
The choice is not between innovation and rights. It is between building neurotechnology on constitutional principles now or trying to retrofit them after commercial and institutional habits harden.
What good governance would look like
The choice is not between innovation and rights. It is between building neurotechnology on constitutional principles now or trying to retrofit them after commercial and institutional habits harden.
Good neurodata governance should be layered. At the legal level, jurisdictions should clarify that neural data and reliable inferences drawn from them receive heightened protection, with special scrutiny for uses outside care and research. Data protection authorities should issue guidance on classification, lawful bases for processing and restrictions on secondary use. Sector regulators in health, employment and education should set context-specific rules rather than assuming generic privacy law will suffice.
At the institutional level, ethics review should extend beyond traditional clinical research to high-impact deployments in workplaces, classrooms and public services. Procurement rules can help by requiring explainability, security guarantees, evidence of validity and prohibitions on repurposing. Independent audits should examine not just safety, but bias, inferential overreach and the gap between claimed and demonstrated capability.
At the technical level, privacy-preserving design deserves more investment: on-device processing, federated approaches where appropriate, granular permissions and architectures that separate raw signals from user identity wherever possible. Researchers should publish limits alongside results, making clear what a system cannot infer as well as what it can. In an area so prone to exaggeration, epistemic humility is a governance tool.
A global issue, not a niche one
Neurotechnology policy can sound like a specialist concern for ethicists, neurologists and engineers. It is not. Questions of mental privacy and cognitive liberty cut across democratic governance, labour rights, disability rights and international human rights law. They also have a geopolitical dimension. States will not approach neurodata identically; some will favour permissive innovation, others stronger public safeguards, others still may see strategic advantage in expansive surveillance powers.
That divergence creates pressure for international norms. The OECD’s work on responsible innovation, UNESCO’s ethical framework and sustained engagement by the Council of Europe and UN bodies point in the right direction. The objective should not be premature global uniformity. It should be convergence around minimum principles: the mind is not just another data source; freedom of thought includes protection against undue extraction and manipulation of mental information; and the burden of justification should lie with those seeking access to neural signals, not with individuals trying to defend their inner lives.
Such principles would also help avoid a two-tier future in which affluent citizens can buy privacy while more vulnerable groups are exposed to experimental monitoring in schools, warehouses, call centres or border regimes. Rights worth having must travel across class and context.
The real test of a free society
There is a tendency to discuss neurotechnology as if its central question were technical feasibility. Can signals be decoded more accurately? Can interfaces become less invasive? Can stimulation become more precise? These are important questions, especially for medicine. But the deeper test is political and moral. A free society has always depended on a protected interior realm in which people can think, hesitate, imagine and dissent without compulsory exposure.
Neurotechnology does not abolish that realm. For now, at least, it does not render minds transparent. But it does make the boundary more contestable. That is enough to demand foresight. The aim should be neither panic nor permissiveness. It should be constitutional seriousness about a class of technologies that reaches closer than previous digital systems to the biological substrate of thought.
If societies wait for a spectacular abuse before acting, they will have misunderstood how rights are usually lost. Not all infringements arrive as crises. Many begin as conveniences, safety measures, wellness tools or productivity aids. By the time their cumulative effect becomes obvious, dependency and normalisation are already in place.
The wise course is therefore plain: support therapeutic innovation, insist on scientific honesty and build robust protections for mental privacy, cognitive liberty and neurodata governance before invasive norms become ordinary. The future of neurotechnology need not be illiberal. But neither will liberty survive by assumption.
