Your browsing history, your location, your political preferences. For years, tech companies have found ways to turn personal data into profit. Now, a new and far more intimate frontier is opening: the electrical signals produced by your brain.

This is not science fiction. Nor is it about brain implants for paralysed patients or experimental medical procedures. A fast-growing consumer market of non-invasive neurotechnology – wearable headsets, brain activity-reading headbands, focus-enhancing devices – is already here, already being sold and already collecting neural data from ordinary users. But the legal and ethical frameworks to govern it are struggling to keep up…

Under the EU’s General Data Protection Regulation, brain signals could potentially qualify as biometric or health data, both of which attract stronger protections. But consumer neurotechnology, when sold as wellness products rather than medical devices, often falls into a regulatory grey area, sitting awkwardly between health law, consumer protection and data privacy rules…

The stakes here are higher than with most forms of personal data. Neural signals are not like a credit card number that can be changed if compromised. Generated by your brain in real time, they can increasingly be used to infer things about you that you have not chosen to disclose – such as emotional responses, cognitive patterns, and other reactions you may not consciously be aware of…