| Myth | Reality |
|---|---|
| Brain data is already covered by existing medical privacy laws like HIPAA. | Most consumer brain-computer interface headsets are wellness or gaming devices, not medical devices, so standard health privacy rules typically do not apply to the neural data they collect. |
| Only far-future brain implants raise neurorights concerns. | Consumer electroencephalography headsets sold today already generate neural data that courts, such as Chile’s Supreme Court, have ruled constitutionally protected. |
| US state privacy laws now fully close the neural data gap. | Colorado and California added neural data categories, but California’s SB 1223 explicitly excludes data merely inferred from non-neural signals such as typing patterns or eye tracking, leaving a real gap. |
| Neurorights are a single, settled legal standard worldwide. | Neurorights are a patchwork of one constitutional amendment, two US state laws, one non-binding UNESCO recommendation, and a pending Chilean bill, each with different scope and enforcement. |
What Neurorights Means When Machines Can Read Minds
Brain-computer interfaces, or BCIs, are no longer confined to research labs. Consumer headsets track focus and meditation states, medical implants restore movement to paralyzed patients, and neurotechnology companies are racing to commercialize devices that read electrical or magnetic signals directly from the brain. Every one of those signals is data, and unlike a password or a purchase history, brain data can reveal mood, attention, intent, and in some experimental settings, fragments of thought before a person consciously chooses to share them. Neurorights is the term legal scholars, ethicists, and neuroscientists use for the emerging body of law built to answer a simple question: who controls that information, and what can be done with it.
The concept traces back to a 2017 proposal from the Neurorights Foundation, co-founded by Columbia University neuroscientist Rafael Yuste, who also codirects the university’s NeuroTechnology Center. The foundation reviewed seven major international human rights treaties and concluded that none of them adequately anticipated a world where consumer and medical devices could capture, store, and analyze raw neural signals at scale. That gap analysis became the intellectual foundation for the first wave of neurorights law, starting with a country few people expected to lead: Chile.
Chile’s Constitutional First: The Emotiv Ruling
In 2021, Chile amended its constitution to require special legal protection for brain activity and the data derived from it, becoming the first country in the world to do so. The amendment updated Article 19 No. 1, which protects the right to physical and psychological integrity, extending that protection explicitly to neural information. At the time, many observers treated the move as largely symbolic, a forward-looking statement of values rather than an enforceable legal tool.
That assumption did not survive contact with reality for long. In 2023, Chile’s Supreme Court issued a ruling in a case brought by Senator Guido Girardi against Emotiv Inc., a US-based company that manufactures the Emotiv Insight consumer electroencephalography headset. The court ordered Emotiv to delete a Chilean user’s brain-activity data, finding that neural information falls under the constitutional protection adopted two years earlier. It was the first known instance anywhere in the world of a court directly enforcing a neurorights protection, and notably, it applied Chilean constitutional law against a foreign company operating a consumer-grade wellness device, not a medical implant.
The ruling mattered for reasons beyond Chile’s borders. It demonstrated that neurorights are not purely aspirational language; they can produce binding orders against companies that never expected to be subject to a foreign constitution’s neural data protections. For any BCI company selling internationally, the Emotiv case is now a standard citation in legal risk assessments.
Chile has since moved to build out implementing legislation. Boletin No. 13.828-19, a bill designed to translate the 2021 constitutional amendment into detailed statutory rules covering neurotechnology research, data handling, and informed consent, passed the Senate and was before the Chamber of Deputies as of April 2026. During committee sessions that spring, lawmakers heard testimony from Rafael Yuste himself, underscoring how closely the academic architects of the neurorights concept remain involved in turning it into enforceable law.
The Five Neurorights: A Framework Built From Treaty Gaps
After concluding that existing human rights instruments did not adequately cover neurotechnology, the Neurorights Foundation proposed five specific rights meant to fill the gap. These five rights have become the reference framework cited in academic papers, legislative testimony, and advocacy campaigns worldwide, even in jurisdictions that have not adopted any of them into binding law.
| Proposed Right | What It Protects | Closest Existing Legal Analogue |
|---|---|---|
| Mental privacy | Prevents unauthorized access to, or disclosure of, a person’s neural data without informed consent | Data protection statutes such as the EU General Data Protection Regulation, but not written specifically for neural signals |
| Personal identity | Protects a person’s sense of self and agency from being altered by neurotechnology without consent | No direct analogue; closest are informed-consent doctrines in medical device law |
| Free will | Guards against covert manipulation of decisions through direct neural stimulation or interference | Bodily autonomy protections in constitutional and tort law |
| Equal access to mental augmentation | Aims to prevent neurotechnology from creating a cognitive divide between those who can and cannot afford enhancement | Disability rights and anti-discrimination statutes, applied by analogy |
| Protection from algorithmic bias | Addresses the risk that algorithms interpreting neural data misclassify or discriminate based on flawed models of the brain | Emerging AI bias and algorithmic accountability rules |
Only the first of these, mental privacy, has clear traction in binding law today, largely through Chile’s constitutional provision and the narrower US state privacy amendments. The remaining four rights remain aspirational in most jurisdictions, cited in policy discussions and UNESCO’s ethics recommendation but not yet embedded in enforceable statutes.
The Global Patchwork: State Laws and the UNESCO Recommendation
Outside Chile, neurorights protections have arrived piecemeal, mostly through amendments to general consumer privacy laws rather than dedicated neurotechnology statutes. Colorado amended its state privacy law in April 2024 to classify neural data as sensitive personal information, joining biometric and genetic data in a category that triggers stricter consent and processing requirements. California followed with SB 1223, signed by Governor Newsom, which added neural data to the California Consumer Privacy Act’s definition of sensitive personal information.
On the international ethics side, UNESCO’s General Conference adopted the Recommendation on the Ethics of Neurotechnology at its 43rd session in November 2025. It is the first global framework addressing neurotechnology ethics, covering principles such as informed consent, mental privacy, and equitable access. Like all UNESCO recommendations, it is non-binding on member states; it functions as a normative reference point rather than an enforceable law, similar in structure to UNESCO’s earlier 2021 Recommendation on the Ethics of Artificial Intelligence.
| Jurisdiction or Body | Instrument | Year | Legal Status |
|---|---|---|---|
| Chile | Constitutional amendment to Article 19 No. 1 | 2021 | Binding, enforced by Supreme Court in 2023 |
| Chile | Boletin No. 13.828-19 implementing bill | Pending since 2026 | Passed Senate, before Chamber of Deputies |
| Colorado, United States | Amendment to state privacy law adding neural data | 2024 | Binding state law |
| California, United States | SB 1223 amendment to the CCPA | 2024 | Binding state law, with inferred-data exclusion |
| UNESCO | Recommendation on the Ethics of Neurotechnology | 2025 | Non-binding global ethics framework |
From constitutional amendment to courtroom enforcement
A simplified timeline showing how Chile moved from a 2021 constitutional amendment protecting brain activity, to a 2023 Supreme Court order against Emotiv Inc. for a consumer headset user’s data, to a 2026 implementing bill working through the Chamber of Deputies with input from Neurorights Foundation co-founder Rafael Yuste.
The Inferred-Data Gray Zone Nobody Has Closed
Every neurorights framework built so far, including Chile’s own emerging statute, shares a common weak point: they generally protect data collected directly from neural signals, such as electroencephalography readings, while leaving a much larger category largely unaddressed, data inferred about mental states from non-neural signals. California’s SB 1223 is explicit about this boundary. Its definition of protected neural data excludes information merely inferred from typing patterns, eye tracking, voice analysis, or similar behavioral signals, even when that inferred information is used to estimate mood, attention, or cognitive load with real accuracy.
This is not a small carve-out. Keystroke dynamics, gaze tracking in virtual reality headsets, and voice-stress analysis can already approximate some of the same inferences that raw neural signals provide, in some cases with reasonable accuracy for detecting fatigue, stress, or engagement. A company that avoids directly collecting brainwave data but instead infers a user’s mental state from how they type or where they look faces essentially none of the added scrutiny that would apply to a literal EEG headset, even though the privacy harm to the individual can be functionally similar.
A Stanford Law School blog post published in April 2026 found that Chile’s own framework, despite being the most mature neurorights regime in the world, has a comparable gray zone around inferred mental data. The constitutional language and the pending implementing bill focus on data “derived from brain activity,” a phrase that legal commentators argue is ambiguous as applied to inference chains that start with non-neural inputs but end in conclusions about mental states. In practice, this means the single most legally advanced neurorights jurisdiction on earth has not fully solved the problem its own framework was designed to address.
Common mistake
Treating “neural data protection” and “mental privacy” as interchangeable. Most current laws, including California’s SB 1223 and Colorado’s amendment, protect data collected directly from neural signals but exclude mental states inferred from behavioral proxies like typing speed or eye movement, so a product can operate entirely outside neural-data rules while still profiling users’ mental states.
Where BCI Companies Actually Stand Today
Despite the growing legal and academic attention to neurorights, the companies building brain-computer interfaces mostly operate under regulatory frameworks that were never designed with neural data specifically in mind. Neuralink and Synchron, the two most prominent companies developing implantable BCIs for medical use, are regulated primarily as medical device manufacturers, subject to the same clinical trial, safety, and approval pathways as any other implantable device. Neither faces a dedicated neurorights compliance regime in the United States, because no such regime currently exists at the federal level.
Consumer-facing companies, such as those making wellness or gaming headsets, occupy an even less regulated space. Because these devices are typically marketed as lifestyle or entertainment products rather than medical devices, they generally fall outside both medical device regulation and, in most US states, outside dedicated neural data protection unless the company operates in Colorado or California. The Emotiv case in Chile is instructive precisely because Emotiv Insight is this kind of consumer wellness device, not a clinical implant, and it was still found subject to constitutional neural data protection.
This creates a strange asymmetry: the most invasive BCI technology, implantable devices from companies like Neuralink and Synchron, is regulated under long-established, relatively rigorous medical device frameworks, while less invasive consumer headsets that collect similar categories of neural data in less controlled settings often face lighter regulatory scrutiny, at least outside Chile and the handful of US states that have acted.
What worked
Chile’s approach of anchoring neurorights in constitutional law, rather than an ordinary statute, gave courts a durable basis to act even before implementing legislation existed. The 2023 Emotiv ruling happened two years before the detailed implementing bill was finalized, showing that a strong constitutional hook can produce real enforcement while statutory details are still being worked out.
What Comes Next for Neurorights Law
Three developments will likely shape how neurorights law evolves over the next several years. First, Chile’s implementing bill, once it clears the Chamber of Deputies, will provide the first detailed statutory template that other legislatures can study or adapt, moving the conversation beyond a single constitutional clause and a single court ruling. Second, UNESCO’s 2025 recommendation, while non-binding, gives national governments a ready-made reference text to draw on when drafting their own laws, much as its 2021 AI ethics recommendation has been cited in national AI strategy documents worldwide. Third, and most consequential for ordinary users, the inferred-data gray zone will need to be addressed explicitly in future amendments, since the current generation of laws was written primarily with direct neural sensors in mind rather than the broader universe of behavioral inference.
For companies building or deploying BCI or adjacent neurotechnology products, the practical takeaway is that regulatory exposure is shifting faster than most compliance programs have adjusted for. A device that is legally low-risk today under a narrow definition of neural data could fall within scope of tomorrow’s amendment, particularly as regulators in Colorado, California, and Chile continue to revisit their definitions in response to gray-zone criticism from legal scholars.
- Constitutional versus statutory protectionChile’s neurorights sit in its constitution, giving courts a durable enforcement basis independent of ordinary legislation, unlike most other jurisdictions where protections depend entirely on statute.
- Consumer devices are not automatically low-riskThe enforcement case that mattered most, the Emotiv ruling, involved a consumer wellness headset, not a clinical implant, showing regulators do not reserve scrutiny for medical-grade devices.
- Non-binding does not mean irrelevantUNESCO’s neurotechnology recommendation carries no legal force, but similar non-binding instruments have historically shaped national legislation years after adoption.
- Inference chains are the coming battlegroundRegulators are still writing rules around direct neural sensors while inference from typing, gaze, and voice data quietly expands into the same territory.
- Academic architects remain active in draftingRafael Yuste’s continued involvement in Chile’s implementing legislation shows neurorights law is still being shaped directly by the researchers who first proposed the concept.
Glossary
- Neurorights
- A proposed category of human rights specifically addressing the collection, use, and protection of data generated by neurotechnology and brain activity.
- Neurodata
- Data derived from measuring brain activity, such as electrical signals captured by an electroencephalography headset or implanted electrode.
- Brain-computer interface (BCI)
- A system that creates a direct communication pathway between the brain and an external device, ranging from consumer headsets to implanted medical devices.
- Mental privacy
- The proposed right to control access to and disclosure of one’s own neural data and inferred mental states without informed consent.
- Cognitive liberty
- A related concept describing an individual’s right to control their own mental processes and cognitive experience, free from unauthorized outside interference.
- Inferred mental data
- Information about a person’s likely mental or emotional state deduced from non-neural signals such as typing patterns, eye tracking, or voice, rather than measured directly from brain activity.
Key Takeaways
- Chile became the first country in the world to add constitutional protection for brain activity and derived neural data, in a 2021 amendment.
- Chile’s Supreme Court enforced that protection in 2023, ordering Emotiv Inc. to delete a user’s brain-activity data, the first known court enforcement of a neurorights claim anywhere.
- The Neurorights Foundation, co-founded by Rafael Yuste, proposed five rights after finding existing human rights treaties insufficient: mental privacy, personal identity, free will, equal access to mental augmentation, and protection from algorithmic bias.
- UNESCO adopted a non-binding global Recommendation on the Ethics of Neurotechnology in November 2025, the first framework of its kind.
- Colorado and California have both added neural data to their state privacy laws, but California’s SB 1223 explicitly excludes data merely inferred from non-neural signals.
- Even Chile’s more mature framework has a similar gray zone around inferred mental data, according to an April 2026 Stanford Law School analysis.
- Neuralink, Synchron, and most consumer BCI makers currently operate mainly under ordinary medical device or general consumer regulation, not neurorights-specific rules.
FAQs
What is neurorights?
Neurorights is an emerging legal and ethical framework aimed at protecting individuals from the risks posed by neurotechnology, particularly around brain data collected by brain-computer interfaces. It centers on ideas like mental privacy, personal identity, and free will, and was first proposed by Columbia University’s Rafael Yuste and the Neurorights Foundation in 2017.
Why is Chile considered the leader in neurorights law?
Chile amended its constitution in 2021 to explicitly protect brain activity and derived data, becoming the first country to do so. In 2023, its Supreme Court enforced that protection against Emotiv Inc. in a case brought by Senator Guido Girardi, marking the first known court enforcement of a neurorights claim anywhere in the world.
What happened in the Emotiv case?
Chile’s Supreme Court ordered Emotiv Inc., a US company that makes the Emotiv Insight consumer headset, to delete a Chilean user’s brain-activity data. The court found the data fell under constitutional protection for neural information, in a case brought by Senator Guido Girardi in 2023.
What are the five proposed neurorights?
The Neurorights Foundation proposed mental privacy, personal identity, free will, equal access to mental augmentation, and protection from algorithmic bias. These emerged after the foundation reviewed seven international human rights treaties and concluded none adequately addressed neurotechnology risks.
Does United States law protect brain data?
Partially. Colorado amended its state privacy law in 2024 to classify neural data as sensitive personal information, and California’s SB 1223 did the same for the California Consumer Privacy Act. Neither is a comprehensive federal neurorights law, and both exclude data merely inferred from non-neural signals.
What is the inferred-data gray zone in neurorights law?
It refers to mental state information deduced from non-neural signals, such as typing patterns, eye tracking, or voice, rather than measured directly from brain activity. California’s SB 1223 explicitly excludes this inferred data, and a 2026 Stanford Law School analysis found Chile’s framework has a similar unresolved gap.
Are Neuralink and Synchron subject to neurorights laws?
Currently, both companies are regulated primarily as medical device manufacturers under standard clinical trial and device approval frameworks, not under any dedicated neurorights-specific regulation, since no country has yet built such a regime for implantable medical BCIs.
What did UNESCO do on neurotechnology ethics?
UNESCO’s General Conference adopted the Recommendation on the Ethics of Neurotechnology at its 43rd session in November 2025, creating the first global ethics framework for the field. Like other UNESCO recommendations, it is non-binding but is expected to influence future national legislation.
For related coverage of how liability and standards are evolving alongside neurotechnology, see our analysis of the autonomous liability gap in physical AI ethics, our comparison of global AI ethics standards, and our piece on whether AI personhood and legal standing could eventually intersect with neurotechnology regulation. Readers interested in how governments track powerful computing systems more broadly may also want our explainer on compute governance and frontier training runs, our overview of privacy-first AI design, and our roundup of AI risk management frameworks compared.
- Chilean Supreme Court ruling on the protection of brain activity: neurorights, personal data protection, and neurodata, National Center for Biotechnology Information
- Even Chile’s Neurorights Leave Inferred Mental Data in a Gray Zone, Law and Biosciences Blog, Stanford Law School, April 2026
- Chile: Pioneering the protection of neurorights, The UNESCO Courier
- Privacy and the Rise of Neurorights in Latin America, Future of Privacy Forum
- The Controversial Push for New Brain and Neurorights, Journal of Medical Internet Research, 2025
- UNESCO Recommendation on the Ethics of Neurotechnology, adopted at the 43rd session of the UNESCO General Conference, November 2025
