Sleep trackers feed brainwave data to AI models without explicit user consent, investigation finds

The investigation, reported by Science, examined multiple companies in the consumer neurotechnology space and found that they have accumulated tens of millions of hours of brainwave data. Several are using those recordings to develop so-called brain foundation models.

Interaxon, the Canadian company behind the Muse sleep and meditation headband, is one example. Its headbands monitor electrical activity in the brain while users sleep, producing reports to help them track rest and identify changes in sleeping patterns. Interaxon has trained an AI model on about 50,000 hours of EEG recordings and says it strips identifying information, names, email addresses, and addresses, before using the data. “We aim to use as much of that eligible corpus as possible,” Nadia Kumentas, its Chief Marketing Officer, said.

Until Science approached the company, its privacy policy did not explicitly disclose that customers' brain recordings could be used to train foundation models. Interaxon has since updated the policy, with Kumentas acknowledging, “We agree users should be explicitly informed.” For customers whose recordings had already been used, the change came after the fact, potentially exposing the company to lawsuits.

The investigation found that more than two-thirds of the studied companies explicitly allowed corporate transfers of user data without consent. That could become significant if a small neurotechnology firm is acquired, potentially putting accumulated neural recordings in the hands of a new owner. Colorado and California have amended their consumer privacy laws to cover neural data, but other states lag behind.

Emotiv, another wearable EEG maker, is training its Large Brain model partly on recordings from customers using its high-end devices. It also updated its privacy policy after being contacted by Science, disclosing that de-identified neural data may be used for model training subject to opt-in consent.

The approach differs from training a large language model: instead of feeding AI text, developers supply recordings of electrical activity in the brain. The model learns recurring patterns that can be adapted to recognise different brain states or assist with specific research tasks. AI startup Piramidal trained its model on more than 4 million hours of EEG data in partnership with Cleveland Clinic and developed a seizure-detection system that correctly identified nine out of 10 seizures in a pilot study after it was fine-tuned on the clinic's recordings.

Most wearable EEG devices use just one to six electrodes, far fewer than the 19 to 25 typical of clinical EEG systems, and their recordings are generally less comprehensive. That does not mean consumer headbands can suddenly read people's thoughts.

The privacy implications of wearable brain technology aren't entirely new. In February, an engineer discovered he could access other users' brainwave recordings through a smart sleep mask he had purchased, after finding hardcoded credentials that appeared to be shared across devices. Separately, last December the San Francisco startup Coundit made an effort to collect 10,000 hours of neural data from thousands of patients, with the aim of developing AI capable of translating brain signals into language. Meta has also been developing BrainQwerty, a non-invasive brain-computer interface that translates brain activity into keyboard inputs, achieving 61% average word accuracy in a second-generation system.