Muse Sleep Band Maker Used User Brain Data for AI Training Without Explicit Consent
Interaxon, the maker of the Muse sleep and meditation headband, has been using approximately 50,000 hours of user brainwave data to train an AI model without obtaining explicit consent, raising significant privacy concerns.
The maker of the popular Muse sleep and meditation headband, Canadian company Interaxon, has been found to be using approximately 50,000 hours of its users' brainwave data to train an artificial intelligence model. This practice was revealed in a year-long investigation by Science magazine, which highlighted that users were not explicitly informed about their sensitive neural data being used for AI development.
Interaxon's Muse headband is designed to help users understand their brain activity during sleep and meditation. However, the investigation uncovered that the company was simultaneously collecting and utilizing this electroencephalography (EEG) data to train a "brain foundation model." Such models, trained on extensive brainwave datasets from diverse individuals, can identify complex patterns in neural activity, potentially leading to advancements in understanding neurological conditions like seizures.
While Interaxon has since updated its privacy policy to state that de-identified data is used for machine learning, the initial lack of explicit consent for AI training has drawn criticism. The company did remove direct identifiers such as names and email addresses from the EEG recordings before using them. However, researchers caution that this level of de-identification may not be sufficient to protect user privacy.
Academic studies have indicated that EEG recordings and their derived features can contain highly sensitive, patient-specific information. Researchers have demonstrated that individuals can potentially be re-identified from EEG data, even after conventional anonymization methods are applied. This raises concerns about the risks associated with sharing such data, especially in clinical and research contexts.
Further research has shown that analyzing resting-state EEG recordings can reveal personal characteristics, including personality traits and cognitive abilities. Some studies have even achieved high accuracy rates in identifying individuals solely from their resting-state EEG data. Other research suggests that EEG data could potentially infer mental health status, neurological conditions, and even past substance use.
These findings are particularly relevant in the burgeoning field of neural technology, where companies collect vast amounts of brain data. A review of 57 companies in this sector found that only a small fraction explicitly stated they would not sell user brain data, and many allow such data to be transferred to new owners in case of acquisition. This underscores a broader trend of insufficient transparency and control over neural data.
The legal landscape is also struggling to keep pace with these advancements. While some jurisdictions like Colorado and California are beginning to classify neural data as sensitive, many existing privacy regulations, such as Illinois's Biometric Information Privacy Act (BIPA), do not explicitly cover EEG data. This regulatory gap leaves users with limited recourse and protection.
For consumers using neurotech devices, the incident serves as a stark reminder to carefully review privacy policies and understand how their data is being used. The potential for data misuse, unauthorized sharing, or future sale necessitates vigilance and proactive engagement with device manufacturers regarding data handling practices and opt-out options.