Muse sleep band users weren’t told their brain data was training AI

The maker of Muse, a headband that measures brain activity during sleep and meditation, used users' brainwave data to train AI without explicitly telling them, according to a year-long investigation published in Science magazine. Interaxon, the Canadian company behind the device, utilized approximately 50,000 hours of electroencephalography (EEG) recordings to develop a "brain foundation model." While such research could lead to beneficial applications like recognizing seizure patterns, it raises significant ethical concerns about data consent and privacy.

When questioned by Science about the practice, Interaxon's chief marketing officer Nadia Kumentas acknowledged that users should have been explicitly informed about the AI training. In response, the company updated its privacy policy to state that de-identified data is used to train machine learning models. However, the data had already been collected and used without clear disclosure.

Privacy concerns persist

While Interaxon removed names and email addresses from the EEG data before using it for training, experts warn that such "de-identification" may not be sufficient to protect user privacy. A University of South-Eastern Norway study found that conventional anonymization methods are often inadequate for high-dimensional biomedical signals like EEG data, as removing direct identifiers doesn't necessarily prevent reidentification.

Additional research from Ben-Gurion University and Korea University suggests that EEG recordings can potentially reveal personality traits, cognitive abilities, and even identify individuals with high accuracy. A University of Southern California study further claimed that such data could expose mental health status, neurological conditions, and substance use history.

Industry-wide issues

The investigation revealed that Interaxon is not alone in questionable data practices. Science reviewed 57 companies that collect brain data and found that only six explicitly promised not to sell users' brain data. More than two-thirds allow brain data to transfer to a new owner if the company is acquired, while eleven had privacy policies only for website visitors, and four had no policy at all.

A 2024 Neurorights Foundation report similarly found that 29 of 30 neurotech companies surveyed appeared to have unrestricted access to consumers' neural data without meaningful limitations. Legal protections remain inconsistent, with Illinois' Biometric Information Privacy Act not covering EEG data, while Colorado and California now classify neural data as sensitive information.

What users can do

For Muse owners and users of other neurotech devices, experts recommend checking the manufacturer's privacy policy to understand how data is being used. Consumers should specifically ask whether their EEG data is used for AI training, whether they can opt out of such usage, and whether they can request deletion of already collected recordings.

If these options aren't available, users should consider whether they're comfortable continuing to use the device, especially given that brain data could potentially be transferred to new owners if the company is acquired or goes bankrupt, as seen with genetic testing company 23andMe. Malwarebytes survey data shows 90% of consumers worry about AI using their data without consent, reflecting widespread concern about these practices.