People buying a brain-sensing wearable to track sleep or concentration may be contributing to something larger than their own daily report. A Science investigation found that consumer neurotechnology companies developing AI brain models initially failed to describe that purpose in their privacy policies, even while discussing the projects elsewhere.
The November 4 investigation reviewed 57 consumer EEG companies worldwide. Science reported that four had no privacy policy and 11 had policies covering website visitors rather than the brain-data service. Those figures describe disclosure problems across the sample, not a finding that all 57 companies trained AI models on customer recordings.
Current documents tell a more specific story than the claim that companies still universally omit AI training. Emotiv’s privacy policy now explicitly describes opt-in processing for its Large Brain Model. It also draws a consequential line between stopping future data use and removing a contribution from a model already trained.
Jonathan Moens’s investigation for Science reported that Interaxon, maker of Muse headbands, and Emotiv updated disclosures after the publication raised questions. Interaxon told Science that it used user recordings with personal identifiers removed. Emotiv said its model drew partly on recordings from users of higher-end devices, alongside other sources.
The issue is not simply whether a company publishes a privacy document. A buyer can agree to the processing needed to deliver a sleep report without necessarily understanding that recordings might help develop a reusable AI model. Science quoted Duke University law and philosophy professor Nita Farahany as calling for “specific and separate consent” for training.
The Emotiv privacy policy reviewed by Eastern Herald says explicit opt-in consent is required to process pseudonymized neural data and telemetry to train, evaluate, refine and commercialize its Large Brain Model and related algorithms. Pseudonymization uses a coded reference instead of directly identifying account information; the company’s policy expressly treats pseudonymized information as personal information.
That matters because removing a name is not the same claim as making a recording permanently anonymous. Emotiv describes an account identifier and a separate coded identifier associated with recordings. Its own wording distinguishes that arrangement from data genuinely de-identified or aggregated so that it can no longer be associated with a person.
The policy also links model development to Emotiv-IQ, an optional suite of personalised analytics. It says that when a user requests that service, processing and pooling neural data into the model is necessary to generate the requested metrics. Users can disable Emotiv-IQ in account settings. That is a stated service design, not independent evidence that every consent screen explains the relationship adequately.
The company’s licence agreement makes the next limit explicit. Disabling Emotiv-IQ halts future ingestion into model training, it says, but does not remove contributions already incorporated into a trained model because individual contributions cannot be isolated from its weights once training is complete.
Withdrawing consent therefore has a forward-looking effect in the process Emotiv describes. That is different from deleting a recording or closing an account, and different again from reversing every effect of an earlier training run. The wording should not be extended into a claim that removing training influences is impossible for every model or every company.
The licence agreement also describes prospective and retrospective analysis of recordings held in the cloud. New algorithms developed from pooled datasets may be applied to historical recordings. That gives customers another decision to understand: agreeing to store data can leave it available for later analysis, under the uses and consent arrangements set out in the documents.
A separate Emotiv consumer-health policy effective November 9 covers residents of jurisdictions with specific consumer-health privacy statutes, including Washington and Nevada. It lists raw biosignals and EEG recordings alongside derived metrics such as attention, cognitive load and fatigue. It again describes model training as subject to explicit opt-in consent.
That policy says Emotiv does not sell consumer-health or neural data to third parties. It distinguishes that position from services powered by the model, where partners receive outputs on their own data rather than customers’ health data. The distinction is important: licensing a trained model and selling a person’s raw recording are not the same transaction. Neither should be alleged solely because the other is mentioned.
Interaxon’s published legal page contains a different illustration of how terminology shapes permissions. Its end-user licence separates personally identifiable user-generated data from non-personally identifiable data, and grants broad, perpetual rights to use and commercially exploit the latter. The licence section is marked as last updated in April 2019; it is not a substitute for reconstructing the company’s later privacy-policy changes.
A broad licence clause does not, by itself, show what an individual customer understood, what a consent screen displayed or which recordings entered a particular model. Those questions require evidence beyond the existence of legal text. Eastern Herald has not reviewed users’ consent logs or independently audited either company’s training datasets.
There are also limits to the technology. Science’s experts cautioned against treating consumer EEG wearables as devices that can simply read a person’s private thoughts. The disclosure question does not depend on that stronger claim: customers can still have an interest in controlling how recordings and inferred metrics are reused.
The documents reviewed here describe current published terms, not an independently verified history of every earlier version. Emotiv’s main policy displays an August 6 effective date, while the separate consumer-health notice displays November 9. Those dates alone do not establish when each individual clause was added.
Science’s findings concern what companies disclosed during its investigation. The policies now visible show why a later clarification does not settle every earlier consent question: a customer can stop a future upload without receiving a promise that an already-trained model has forgotten their contribution.
