A yearlong investigation by the journal Science, carried out with the Pulitzer Center’s AI Accountability Network, has found that several consumer neurotechnology companies are feeding brainwave data gathered through wearable devices into artificial intelligence models, in some cases without clearly telling users first.

The investigators reviewed privacy policies from 57 companies and found widespread gaps in disclosure and consent. Between them, these firms have amassed tens of millions of hours of electroencephalography (EEG) recordings and several are using those recordings to build so-called brain foundation models.

Interaxon, the Canadian company behind the Muse sleep and meditation headband, is one of them. Its devices track electrical activity in the brain, along with other physiological measurements, while users sleep and turn the readings into reports on rest and changes in sleeping patterns. The company has also trained an AI model on about 50,000 hours of EEG recordings, saying it strips out identifying details such as names, emails and addresses first. It has said it aims to use as much of that eligible corpus as possible.

That use was not spelled out to customers. Before Science made contact, Interaxon’s privacy policy did not state that users’ brain recordings could train foundation models. The company has since updated it, with its chief marketing officer, Nadia Kumentas, acknowledging that users should be explicitly informed.

More than two-thirds of the companies studied allow corporate transfers of data without user consent, which could matter if a small neurotechnology firm is acquired and its stored recordings pass to a new owner. Colorado and California have amended their consumer privacy laws to cover neural data, while other US states have not.

Interaxon is not alone. Emotiv, another wearable EEG maker, is training its Large Brain model partly on recordings from customers using its high-end devices, and also revised its privacy policy after questions from Science, disclosing the use of de-identified neural data subject to opt-in consent.

These systems work differently from a large language model. Rather than text, developers supply recordings of electrical activity in the brain and the model learns recurring patterns that can be adapted to recognise brain states or support research tasks. AI startup Piramidal has trained its model on more than four million hours of EEG data with Cleveland Clinic, developing a seizure-detection system that correctly identified nine out of ten seizures in a pilot study after being fine-tuned on the clinic’s recordings.

Consumer headbands cannot read thoughts. Most use one to six electrodes, far fewer than the 19 to 25 in clinical EEG systems and their recordings are generally less comprehensive. Nine companies have publicly acknowledged building brain foundation models.