Chapter 4 · Middle school
A recording of your brain is information about you. Where does yours go, and who should be allowed to see it?
Data is information that has been recorded. A recording of your brain is data about you, like your photo or your voice. Some data is private: it should be shared only if you choose to share it.
Consent means agreeing to something after you understand what will happen, without being pushed, and knowing you can change your mind. That is why wearing an IntoMind One in these labs is always your choice.
In these labs, your brain data takes a short path: from the electrodes, to the chip in the IntoMind One, to the computer beside you, or in the Mind-Controlled Microcontroller to a small board.
It is never sent over the internet. Nothing is kept unless someone saves a file, with one exception: the custom AI head you teach in the Mind-Controlled Light Switch stays on the IntoMind One until it is removed or replaced.
Try it
On paper, draw the path your brain data takes in these labs. Then draw the path for an imaginary app that sends your recordings to a company's computers to “improve its service.” On both, mark every place where someone else could see your data.
Try it
For each case, decide: yes, no, or only if something is true. Write your reason. Then the class votes, and argues for its answers.
| Who wants to see brain data | Yes, no or only if | Why |
|---|---|---|
| A school that wants every student's alpha number, to see who is paying attention | ||
| A game company that wants to keep players' brain data to make better games | ||
| A doctor helping a patient | ||
| A parent |
What makes a choice real consent?
Where does your brain data go in these labs, and where does it not go?
Pick one case from “Who should see it?” and give your reason.
Chapter 4 · High school
A recording of your brain can reveal things you never chose to share. Where does yours go, what does the law say, and does the mind need rights of its own?
Consent is real when it is informed, voluntary and withdrawable. Informed: the person understands what will happen, and what could go wrong. Voluntary: there is no pressure, and no penalty for saying no. Withdrawable: it can be taken back at any time.
A choice made to avoid losing something isn't consent. That is why wearing an IntoMind One in these labs is always a choice, with a real role for anyone who would rather not.
In these labs, the path is short: the electrodes, the chip in the IntoMind One, and Bluetooth to the computer beside you, or in the Mind-Controlled Microcontroller to a small board. Nothing goes over the internet.
Nothing is kept unless someone saves a file, apart from a custom AI head, which stays on the IntoMind One until it is removed or replaced. That design, computing on the device and keeping only what someone chooses to keep, is itself a privacy decision.
Try it
Draw the path your brain data takes in these labs. Then draw the path for an imaginary app that sends recordings to a company's servers to “improve its service.” On both, mark every place someone else could see the data, and every place it could be kept.
Neural data is personal data, and some argue it is more personal than most: it can reveal things about health, attention and mood that a person never chose to share, and methods not yet invented may draw more out of a recording made today.
The law has begun to treat it that way. In 2021, Chile amended its constitution to protect brain activity and the information that comes from it. In the United States, Colorado and California added neural data to their privacy laws in 2024, and other states have followed.
Try it
Read the privacy policy of a real consumer EEG product. Find each answer, and compare it with these labs.
| The product | These labs | |
|---|---|---|
| What it collects | ||
| Where the data goes | ||
| Who it is shared with | ||
| How long it is kept | ||
| How to delete it |
Some neuroscientists and lawyers argue for neurorights: new human rights to mental privacy, to keep one's own mental identity, and to freedom of thought, in a world of devices that read the brain. Others argue that existing rights to privacy, freedom of thought and bodily integrity already cover all of this, if they are applied well.
Try it
Two sides: “The mind needs new rights of its own,” and “Existing rights are enough.” Each side prepares three arguments, and one answer to the other side's strongest point.
| Our side's case | |
|---|---|
| Argument 1 | |
| Argument 2 | |
| Argument 3 | |
| Their strongest point, and our answer |
A teacher offers extra credit for wearing the device. Is the choice still voluntary? Why?
Why might brain data deserve more protection than other personal data?
Give the strongest argument against creating new neurorights, then answer it.
UNESCO (2025). Recommendation on the Ethics of Neurotechnology.
Yuste, R., and others (2017). Four ethical priorities for neurotechnologies and AI. Nature.
Chapter 4 · College
What makes consent to wear an EEG device real, what can a model infer from brain data that nobody chose to share, and who decides what may be done with it?
Consent is real when it is informed, voluntary and revocable: the person knows what will be recorded and what will happen to it, nothing rides on the answer, and they can stop at any time. That is why no grade here depends on wearing the device or on anyone's numbers.
Data minimization is privacy in practice: collect only what the purpose needs, keep it only as long as it needs, and process it where it is produced. The demos do all three. The IntoMind One computes its embeddings and runs its heads on its own chip, nothing is sent over the internet, and nothing is kept unless someone saves a file. A custom AI head is the exception: it stays on the device until it is removed or replaced.
A model can infer from neural data things the person never disclosed: an age, a sex, signs of a condition, how attentive they were. An inference doesn't have to be accurate to do harm. A weak classifier's confident-looking score about one person can be recorded, shared and acted on, and the person has no way to contest a number about their brain.
EEG also identifies people. Patterns in a recording are individual enough to link it back to its owner from another recording of them, so removing a name doesn't make it anonymous.
The law has begun to treat neural data as sensitive. Chile amended its constitution in 2021 to protect brain activity and the information that comes from it. In the United States, Colorado and California added neural data to their privacy laws in 2024, and other states have followed. In the European Union, the GDPR gives special protection to health data and to biometric data used to identify a person, which covers much of what EEG can reveal.
Research with people's brain data, as opposed to teaching with it, needs an ethics board's review before it starts, consent written for the research, and a data management plan: what is collected, where it is stored, who can see it, how it is protected, and when it is deleted.
Some neuroscientists and lawyers argue for neurorights: new human rights to mental privacy, to one's own mental identity, and to freedom of thought, in a world of devices that read the brain. Others answer that existing rights to privacy, freedom of thought and bodily integrity already cover all of this, if they are applied well. UNESCO's Recommendation on the Ethics of Neurotechnology, adopted in 2025, is guidance for governments on all of this, not law.
Try it
Write the data plan for a project of your own, such as your capstone, as an ethics board would want to read it.
| Your data plan | Your group's answer |
|---|---|
| What we will record, and from whom | |
| How we will ask for consent, and how someone withdraws | |
| The least we need to keep, and why | |
| Where it is stored, and who can see it | |
| How it is protected | |
| When it is deleted, and how we will show it was | |
| What we will never infer from it |
A classifier for attention scores an AUC of 0.6. Why could deploying it in classrooms harm students, even though it is weak?
Why is removing names not enough to make an EEG recording anonymous?
A professor offers course credit for taking part in an EEG study. When is that acceptable?
Your project only needs to know whether a custom AI head beats chance. Which data must you keep, and which can you avoid keeping?
Give the strongest argument against creating new neurorights, then answer it.
Yuste, R., and others (2017). Four ethical priorities for neurotechnologies and AI. Nature.
Ienca, M., and Andorno, R. (2017). Towards new human rights in the age of neuroscience and neurotechnology. Life Sciences, Society and Policy.
Campisi, P., and La Rocca, D. (2014). Brain waves for automatic biometric-based user recognition. IEEE Transactions on Information Forensics and Security.
UNESCO (2025). Recommendation on the Ethics of Neurotechnology.
Chapter 4 · Graduate
What can be inferred from brain data and from what is derived from it, what do research ethics and the law require of a study that records it, and where do the rules run out?
The Belmont Report (1979) rests research with people on three principles: respect for persons, which asks for informed and voluntary consent, beneficence, which weighs risks against benefits, and justice, which asks who bears the burdens and who gains. In the United States, the Common Rule, 45 CFR 46 as revised in 2018, turns them into requirements for federally funded research and for most universities' research of any kind: review by an institutional review board before it begins, and consent that opens with a concise presentation of the key information, then covers the purpose and procedures, the risks and benefits, the alternatives, confidentiality, whom to contact, that taking part is voluntary, and whether the data may be used for future research.
Research, in the rule's words, is a systematic investigation designed to develop or contribute to generalizable knowledge. A lab in a course usually isn't. A study the class means to publish usually is, and its review comes before the first recording, not after. Consent is hardest to make free where the person asking also grades: for the choice to be free, nobody's grade can depend on wearing a device or on their numbers, and saying no has to be possible without anyone knowing.
A recording carries more than its purpose. EEG identifies its owner well enough to authenticate them against another recording, as Marcel and Millán (2007) showed and Campisi and La Rocca (2014) review, so removing a name doesn't anonymize it. It carries states, such as drowsiness, and signs of some conditions. And it carries traits weakly: on studies they never saw, the IntoMind One's age and sex heads score an AUC of about 0.6 for sex and do no better than the mean age, which is weak for a decision about one person and still something nobody agreed to reveal.
What is derived from a recording carries some of the same. An embedding, the encoder's 76 numbers for every four seconds, is built to keep what describes the signal, so it can be as identifying as the signal. A custom AI head is 156 bytes: a name field, the encoder's identity, 76 one-byte weights, a bias, a scale and a hash. It holds no recording, but its weights are the direction in which one person's two states differ, and run on another recording of them, it says when they are in one.
Research EEG is not clinical EEG, and four dry channels can't be read for a diagnosis. A protocol says in advance what happens if a recording looks abnormal, as brain imaging research learned to do for its incidental findings (Illes and others, 2006).
In the European Union, the General Data Protection Regulation gives special protection to data concerning health and to biometric data processed to identify a person, which covers much of what EEG can reveal. Chile amended its constitution in 2021 to protect brain activity and the information drawn from it, and its Supreme Court applied that protection in 2023, in a case about a consumer EEG headset (Cornejo-Plaza, Cippitani and Pasquino, 2024). In the United States, Colorado and California added neural data to their privacy laws in 2024, and other states have followed. UNESCO's Recommendation on the Ethics of Neurotechnology (2025) is guidance for governments, not law.
Ienca and Andorno (2017) proposed four new rights: to cognitive liberty, to mental privacy, to mental integrity and to psychological continuity. Yuste and others (2017) set out four priorities for neurotechnology and AI: privacy and consent, agency and identity, augmentation, and bias. Bublitz (2022) argues that new rights earn their place only with precise content that existing rights to privacy, to freedom of thought and to bodily integrity lack, and that much of the proposals' substance can be had by interpreting those well.
In the demos, nothing goes over the internet, and nothing is kept unless someone saves it: a recording with its checksums, a training file of embeddings and labels, a head, or a fractal's picture, which shows only an alpha frequency and a date. A head stays on the IntoMind One until it is removed or replaced.
Analysis
Write the protocol for a study of your own, such as your capstone, as a review board would want to read it, and draft its consent's key information.
| Item | Your group's answer |
|---|---|
| Is it research, by the Common Rule's definition, and who reviews it? | |
| The key information a participant reads first | |
| Risks, including what could be inferred that nobody agreed to | |
| How someone declines or stops without anyone in the class knowing | |
| What is recorded, and what is derived: embeddings, heads, scores | |
| What is kept, where, who sees it, and when it is deleted | |
| What could be shared, in what form, and the consent that needs | |
| What happens if a recording looks abnormal | |
| What you will never infer from it |
A group plans to post its capstone's embeddings, 76 numbers for every four seconds, in a public repository, with names removed. What could go wrong, and what would you require first?
Is a custom AI head personal data?
Draft the key information for the Mind-Controlled Light Switch as a study, in no more than five sentences.
Your capstone will test whether a head trained one day works the next, and the class wants to publish it. Who must approve what, and when?
State the strongest form of Bublitz's argument, then say what a right to mental privacy would have to protect that data protection law doesn't.
National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research (1979). The Belmont Report: ethical principles and guidelines for the protection of human subjects of research.
Protection of Human Subjects, 45 CFR 46, as revised in 2018.
Regulation (EU) 2016/679, the General Data Protection Regulation.
Illes, J., and others (2006). Incidental findings in brain imaging research. Science.
Marcel, S., and Millán, J. del R. (2007). Person authentication using brainwaves (EEG) and maximum a posteriori model adaptation. IEEE Transactions on Pattern Analysis and Machine Intelligence.
Campisi, P., and La Rocca, D. (2014). Brain waves for automatic biometric-based user recognition. IEEE Transactions on Information Forensics and Security.
Ienca, M., and Andorno, R. (2017). Towards new human rights in the age of neuroscience and neurotechnology. Life Sciences, Society and Policy.
Yuste, R., and others (2017). Four ethical priorities for neurotechnologies and AI. Nature.
Bublitz, J. C. (2022). Novel neurorights: from nonsense to substance. Neuroethics.
Cornejo-Plaza, M. I., Cippitani, R., and Pasquino, V. (2024). Chilean Supreme Court ruling on the protection of brain activity: neurorights, personal data protection, and neurodata. Frontiers in Psychology.
UNESCO (2025). Recommendation on the Ethics of Neurotechnology.