A new policy frontier is emerging inside the skull
Neurotechnology has long been associated with medicine: cochlear implants, deep-brain stimulation for movement disorders, epilepsy monitoring and experimental brain-computer interfaces for people with paralysis. But the policy perimeter is widening. Wearable electroencephalography, attention-monitoring systems, consumer neurofeedback tools and machine-learning models that extract increasingly subtle patterns from neural and physiological signals are pushing brain-related data beyond hospitals and laboratories.
This matters because neural data is not simply another biometric. A fingerprint identifies a person; a brain signal may also reveal fluctuating states such as fatigue, stress, intention, emotional valence or disease risk, depending on the context and the quality of the system. Even where today’s tools remain noisy and limited, the direction of travel is clear: more signals, more inference and more commercial and institutional appetite to use them.
Neural data is unusual not only because it can identify a person, but because it may be used to infer what they feel, intend or may do next.
The result is a convergence of three debates that were once separate: the technical development of brain-computer interfaces; the legal discussion around privacy, consent and discrimination; and the philosophical claim that people should enjoy a zone of mental self-determination often described as cognitive liberty. Together they make neurotech one of the most consequential governance questions of the coming decade.
What neurotechnology now includes
The term neurotechnology covers a broad set of tools that record, stimulate or decode activity in the brain or nervous system. At one end are invasive systems implanted in or on the brain, typically in clinical research or specialised treatment. At the other are non-invasive systems such as electroencephalography headsets, eye-tracking paired with physiological sensors, and combinations of brain and bodily data used to classify cognitive states.
Brain-computer interfaces are a subset of this broader field. They create a direct communication pathway between neural activity and an external system, allowing users to control a cursor, robotic arm or synthesised speech, or enabling clinicians to monitor neural function. The most transformative medical work is aimed at restoring lost function for people with paralysis, severe speech impairment or neurological disease. Peer-reviewed research in institutions such as Stanford University and reports in journals such as Nature and The Lancet Digital Health show genuine progress in speech decoding, cursor control and closed-loop stimulation.
Yet the policy challenge does not depend on science-fiction levels of mind-reading. Governance questions arise much earlier, when a device can probabilistically infer concentration, drowsiness, stress response or susceptibility to a stimulus. In transport, defence, education and employment, such inferences may affect real decisions about safety, productivity, discipline or access. That makes the relevant issue less the spectacular scenario of perfect thought decoding than the mundane reality of imperfect but actionable inference.
Why brain data is different
Many regulators already treat health data and biometrics as sensitive. But brain data complicates existing categories. The OECD, in its Recommendation on Responsible Innovation in Neurotechnology, notes that neurotechnology can generate data that is highly personal and potentially predictive, raising concerns about autonomy, privacy and agency. The problem is not merely collection; it is downstream interpretation.
A heart-rate monitor may indicate exertion. An electroencephalography trace, especially when combined with software, contextual metadata and other sensors, may be used to estimate whether a person is attentive, cognitively overloaded or responding to a particular stimulus. Such estimates are contestable and error-prone, but they are attractive to institutions because they appear to offer a route into otherwise inaccessible internal states.
This is why scholars and rights advocates increasingly distinguish mental privacy from ordinary informational privacy. Ordinary privacy frameworks focus on personal data broadly defined, but mental privacy centres on protection against unauthorised access to, or inference about, neural states and processes. It also intersects with liberty interests: if employers, schools, insurers or public authorities can pressure people to submit to neural monitoring, consent becomes structurally fragile.
Neural data is unusual not only because it can identify a person, but because it may be used to infer what they feel, intend or may do next.
The rise of neurorights
The language of neurorights has entered mainstream policy discussion over the past five years. While formulations vary, the cluster usually includes mental privacy, personal identity, free will or agency, fair access to cognitive enhancement and protection from algorithmic bias based on neural data. The idea has been advanced by researchers, ethicists and some lawmakers as a way to clarify what is at stake when technology reaches inside cognition itself.
UNESCO’s work on the ethics of neurotechnology and the Council of Europe’s studies on human rights and neurotechnologies both suggest that current human-rights instruments remain relevant but may need interpretation or supplementation. The right to privacy, freedom of thought, bodily integrity, non-discrimination and informed consent all have obvious bearing. The open question is whether these rights are sufficiently concrete when applied to neural signals and neurodata markets.
The governance gap is not a lack of values; it is a lack of operational rules for how thought-adjacent data may be collected, inferred from and used.
The strongest case for neurorights is therefore practical rather than rhetorical. It aims to force legal systems to confront edge cases that older categories struggle to manage: whether inferred mental states deserve the same protection as raw neural signals; whether refusal to wear a monitoring device can be punished in asymmetrical relationships; and whether manipulative neurostimulation should trigger special scrutiny even when framed as optimisation or wellness.
Chile opened the debate, but the world is still undecided
Chile is often cited because it became the first country to explicitly amend its constitution to address brain activity and information derived from it, and later adopted legislation on neuroprotection. The move was symbolically significant: it signalled that mental integrity and the safeguarding of neural data could be matters of constitutional concern, not merely technical regulation.
But symbolism is easier than implementation. Around the world, there is still no settled template. In the European Union, relevant protections are distributed across data protection law, medical-device regulation, the Charter of Fundamental Rights and emerging digital regulation. In the United States, oversight is fragmented among sectoral privacy law, federal and state consumer protection, medical regulation and employment law. Elsewhere, governance remains patchy or largely undeveloped.
This fragmentation has consequences. A neural interface used in hospital settings may face rigorous review, while a consumer or workplace device claiming to monitor stress or attention may encounter a much looser regime. The same person’s brain-related data could therefore move between clinical, commercial and employment contexts under very different rules. That is one reason many analysts argue for governance based on function and risk rather than the old distinction between medical and non-medical use alone.
From treatment to surveillance risk
The therapeutic promise of neurotechnology is real and should not be obscured. Implanted and non-invasive interfaces could expand communication for people with severe disabilities, improve neurological treatment and personalise rehabilitation. The ethical imperative to support such research is strong.
But the same underlying capacities can migrate into surveillance settings. Monitoring attention in classrooms, fatigue in transport, emotional response in advertising or cognitive load in security-sensitive occupations may be presented as efficiency or safety measures. In some settings there are legitimate interests in reducing harm, particularly where fatigue can kill. Yet legitimacy depends on necessity, proportionality, scientific validity, oversight and the availability of less intrusive alternatives.
The concern is not simply that institutions may know more. It is that they may reshape behaviour through continuous internal-state monitoring. If workers or students know they are being assessed not only on outputs but on inferred attention or affect, they may experience pressure to conform at the level of cognition itself. That pressure cuts close to freedom of thought, even where no law explicitly names it as such.
The governance gap is not a lack of values; it is a lack of operational rules for how thought-adjacent data may be collected, inferred from and used.
Consent is too weak on its own
Most digital governance still leans heavily on notice and consent. In neurotechnology, that approach is particularly brittle. First, many users will not understand what can be inferred from their signals now or in future as decoding improves. Secondly, consent in employment, education, insurance or care relationships may be nominal rather than freely given. Thirdly, neural data can be repurposed in ways that exceed the user’s reasonable expectations.
Data protection authorities have long recognised that power imbalance undermines valid consent. Neurotechnology intensifies the problem because the stakes involve not only disclosure of information but possible exposure of intimate mental traits and vulnerabilities. A person may agree to a device for one purpose, such as fatigue detection, without anticipating secondary uses such as performance evaluation, behavioural profiling or model training.
This points to a broader regulatory lesson. Governance should not rely primarily on individual bargaining. It should establish hard boundaries around certain uses, strong requirements for necessity and evidence, strict purpose limitation, short retention periods, independent auditing and rights to challenge automated inferences. In especially sensitive contexts, some uses may need prohibition rather than disclosure.
The inferential economy is the real issue
Public discussion often focuses on raw brain recordings, but the most important policy battleground may be inference. A great deal of value in digital systems comes not from what is directly observed but from what is predicted. Neurodata governance must therefore address models and outputs, not only inputs.
If a system infers that a person is disengaged, impulsive, pain-sensitive or neurologically atypical, those labels can travel into decisions on hiring, insurance, education or policing. Whether the inference is accurate in a scientific sense may matter less in practice than whether an institution treats it as operationally useful. This is familiar from other areas of algorithmic governance, but neurotechnology adds a more intimate substrate.
Cognitive liberty will stand or fall on whether the law governs inference, not merely the sensor.
Regulation should therefore ask several questions at once: what signal is collected; what inferences are drawn; how robust those inferences are across populations; what decisions they inform; and what rights a person has to contest them. Without that chain-of-use approach, legal protection may stop at the point of collection while the most consequential harms arise later in classification and deployment.
What existing law can and cannot do
Current legal frameworks offer a partial toolkit. Data protection regimes can classify neural data as sensitive, impose purpose limitation, require lawful bases for processing and create rights of access and deletion. Medical-device law can address safety and effectiveness where products make clinical claims. Human-rights law can constrain coercive state use and protect bodily and mental integrity. Consumer protection law can challenge deceptive claims about what devices actually measure.
These are not trivial instruments. In many jurisdictions they can already be used to police some neurotech practices. But they leave notable gaps. Not all neurotechnology is medical. Not all inferred mental-state data is clearly classified. Not all high-risk uses are transparent enough for individuals to know they are happening. And not all harms involve traditional privacy breaches; some concern manipulation, dependence, discrimination or erosion of agency.
That is why several institutions, including the OECD and UNESCO, have emphasised anticipatory governance. The goal is not to wait for a mature consumer neurodata market before setting norms. It is to define guardrails early, when standards for procurement, research ethics, interoperability and data stewardship are still being formed.
Cognitive liberty will stand or fall on whether the law governs inference, not merely the sensor.
A practical agenda for neurodata governance
What would credible governance look like? First, laws and standards should define neural data broadly enough to include not only raw recordings from the brain and nervous system but also derived features and inferences about mental states where those are used to make decisions about people.
Secondly, high-risk uses should be subject to impact assessment before deployment. That means documenting scientific validity, error rates, demographic performance, intended purpose, retention, onward sharing and redress mechanisms. Thirdly, especially asymmetrical settings such as workplaces, schools, prisons, migration control and insurance deserve heightened scrutiny or categorical restrictions because consent is weakest and incentives to overreach are strong.
Fourthly, governance should separate therapeutic innovation from extractive data practices. Clinical uses that restore communication or movement should not be slowed by regulatory confusion created by low-evidence consumer systems. A tiered model based on invasiveness, inferential sensitivity and decision impact would be more coherent than a one-size-fits-all regime.
Finally, technical standards matter. Privacy-preserving design, on-device processing where feasible, data minimisation, secure deletion, independent benchmarking and clear labelling of system limits are all part of governance, not afterthoughts. In a field where claims can outrun evidence, epistemic discipline is itself a form of rights protection.
The geopolitical dimension is easy to miss
Neurotechnology is also becoming a strategic field. Governments see potential in rehabilitation medicine, ageing societies, defence applications and high-value research ecosystems. This can produce a familiar tension: states want to accelerate innovation while also preserving public trust and civil liberties.
That tension makes governance design especially important. Weak rules may encourage short-term experimentation but undermine legitimacy if scandal follows. Overly blunt restrictions may hamper beneficial clinical progress. The most durable approach is likely to be one that protects non-negotiable rights while allowing tightly governed therapeutic and scientific uses.
International coordination will matter because data flows, research collaboration and device markets are cross-border. If jurisdictions diverge sharply on neural data classification, lawful use and export controls, both compliance burdens and rights arbitrage will grow. Soft-law instruments from multilateral bodies are not enough on their own, but they can help align definitions and minimum standards.
The next decade will define cognitive liberty in practice
The debate over cognitive liberty can sometimes sound abstract, but its practical content is becoming clearer. It concerns whether people can refuse neural monitoring without penalty, whether intimate inferences receive special protection, whether manipulative or coercive uses are constrained, and whether beneficial medical innovation proceeds under trustworthy rules.
No legal system starts from zero. Privacy, dignity, bodily integrity and freedom of thought are already embedded in many constitutions and treaties. The task now is to translate those principles into operational limits for devices, data and decision-making. That requires regulators, courts, researchers and standards bodies to treat neurodata as more than another stream in the digital economy.
The deepest question is simple. As tools for reading and shaping cognition improve, will societies protect the mind as a domain of exceptional freedom, or allow it to become merely the next layer of extractable data? Neurotechnology has not yet settled that question. Policy still can.
