Whose thought is it anyway?

In some parts of the world, particularly San Francisco, people are collecting thousands of hours of non-invasive neural data each week to train models that decode attempted speech into text. All evidence points to the fact that the more data you gather between participants, the faster you can calibrate highly accurate models for a new participant. That provides the best user experience, because a new user can start with the device in minutes, not days. So everyone is racing to build their data moat.

There are companies like Condu.it, Sabi, and others who are still in stealth that I can't talk about, who are doing this at scale with consent forms, payments, and rights locked away. But no one has gathered such a dataset from invasive recordings yet, largely because it's very hard to do.

There is also another distinction which differentiates what we are doing. All of the non-invasive companies are gathering data during attempted speech or typing exercises. These are still very conscious actions, and it's one of the reasons why we are not pursuing it.

We want inner speech, which can coarsely be described as when you think in language. That is far more intimate, and it's closer to true thought.

Collecting neural data alone is a legal gray zone, because the law hasn't moved as fast as neurotech has. But collecting inner speech data is even more of a legal gray zone, because you're collecting real thought that might not always be consciously controlled. There are privacy considerations you can implement; for example, Erin Kunz and collaborators in their 2025 paper had the brilliant idea of a "Hey Siri"-like passphrase to start recording, in this case "chitty chitty bang bang". That comes later.

Before we even get to decoding thought, we want to make sure we are collecting the training data responsibly, not only for the participants who are graciously contributing to the next generation of brain computer interfaces, but also for our company, so that we are in good legal standing once the law does catch up to innovation. In this light, I have spent several months having conversations with people from all across the spectrum on what they see as responsible collection of legal data. Some individuals, like my friend Reynolds Tang-Smith, say that they will evaluate the founder and the company, and if they trust them, they'll give them whatever data they want. Others are far more interested in the nuances of the law, and frankly so am I. Discussions are still ongoing, and if you have a view on this matter, please contact me. Nevertheless, I have laid out some of the pillars of the arguments below.

Some definitions

To start, a thought in itself cannot be copyrighted. Copyright protects expression that has been fixed in a tangible medium, not the idea behind it (17 U.S.C., 1976). An unspoken thought is neither. And further, owning a thought would be an impediment to freedom of thought. You wouldn't want to infringe on a fundamental human right, would you?

So what happens when a decoder turns cortical activity into a sentence on a screen? That sentence is fixed, which is the threshold for copyright. Recent AI cases seem to suggest the output belongs to nobody, since US courts have confirmed, up to a denial of certiorari in 2026, that copyright requires a human author (Thaler v. Perlmutter, 2025). But that reasoning doesn't transfer here. In those cases the human disclaimed any creative contribution and the machine supplied the expression. Here it is the reverse. The person supplied every expressive element and the decoder supplied none. A decoder can be seen as a stenographer and copyright has never had trouble with dictation.

Which means copyright probably does attach, and it attaches to the participant. So I think the interesting object was never the sentence. It's the recording.

But that doesn't make it any easier to work with, because raw neural data is a measurement. It's a fact. Nobody owns the temperature, or a heart rate, or the number of times a neuron fired.

Furthermore, this data is inherently re-identifiable, since each brain produces a brainprint like a fingerprint (Finn et al., 2015) (Ruiz-Blondet et al., 2016). Which puts it closer to biometrics or genomics than to anything else in its raw form. And this is where we leave intellectual property behind. The regimes that govern this are biometric privacy, data protection, and the law of what happens to material taken from a human body. None of them are ownership regimes in the way people mean when they ask who owns their neural data.

The following table summarises the legal footing for each category of data in consideration.

Substance	Owned as property?	Copyrightable?	How it is governed
Extracted tissue / cells	No (Moore)	n/a	Informed consent / fiduciary duty
Donated tissue + DNA	No (Greenberg, Catalona)	n/a	Consent; unjust enrichment (sometimes)
Reproductive material	Qualified yes (Hecht)	n/a	Decisional authority / procreative autonomy
Genes (isolated DNA)	No	n/a	Not patent-eligible (Myriad); privacy law
Biometrics (fingerprint, faceprint)	No	n/a	Biometric-privacy statutes (BIPA, GDPR Art. 9)
Raw neural data	No	No (a measurement, not expression)	Neural-data / sensitive-data statutes
Fixed expression of thought	n/a	Yes, if fixed + original + human	Copyright
Unexpressed thought	No	No (not fixed, and an idea)	Freedom of thought (forum internum)

Let's take the premise of neural data being closer to tissue than text, and look at what courts have done with tissue.

Who owns cells that have been removed from a body?

Moore v. Regents was a contentious ruling in 1990, and it is the closest thing we have to an answer about what happens to biological material once it leaves your body (Moore v. Regents, 1990).

It started in 1976 when John Moore, a man with hairy cell leukemia, went to UCLA Medical Center, where a doctor named David Golde told him his spleen had to come out. That was true. The splenectomy was part of his treatment and Moore recovered.

What Moore was not told was that his cells were valuable. They overproduced proteins the biotech industry wanted, and before the operation Golde had already arranged to keep the spleen. Golde and a researcher named Shirley Quan cultured the cells into an immortal cell line. In 1984 they were granted a patent on it, naming themselves as the inventors and assigning it to the University of California (US Patent 4,438,032, 1984). Golde took 75,000 shares and consulting fees from Genetics Institute, under an agreement Sandoz later bought into.

Golde kept calling Moore back. Moore had moved to Seattle by this point, and each time he was told the follow-up was medically necessary and could only be done at UCLA. So each time he flew down. Over roughly seven years Golde took blood, serum, skin, bone marrow and sperm. Moore thought he was a patient being monitored, when in reality, he was a source being harvested.

Eventually the ruse unravelled. Twice in 1983 UCLA asked him to sign a form granting the university all rights to any cell line developed from his tissue. In April he granted them. In September he struck it out. He kept the form, took it to a lawyer, and the lawyer's investigation surfaced the patent UCLA had been issued the following March.

Moore sued for conversion, which is the tort of wrongfully taking control of someone else's property. He argued that the cells were his. They came out of his body. No one asked him, and other people got rich.

The Supreme Court of California told him he had no ownership interest in his excised cells. California law already stripped most property attributes from tissue removed from the body (Cal. Health and Safety Code, 1972). The patented cell line was, in the court's words, "factually and legally distinct from the cells taken from Moore's body", because the value lay in the work of making it live in a laboratory forever. And underneath both of those sat the real reason, which is that a property right in extracted tissue would expose every researcher who had ever handled a human sample, and the court was not willing to do that to an entire industry.

But Moore did not lose everything.

The court held he had a claim for breach of fiduciary duty and lack of informed consent (Moore v. Regents, 1990). A doctor who intends to use a patient's tissue in research he has a financial stake in has to disclose that stake before asking the patient to consent. Golde had asked Moore to sign consent forms for seven years while concealing that fact.

All cells are not equal in the eyes of the law

Not all cells are treated equal, and reproduction is the exception.

In 1991 a man named William Kane deposited fifteen vials of sperm at a cryobank in Los Angeles. He was in a relationship with a woman named Deborah Hecht. He left her his interest in the vials in his will, and then he took his own life. His two adult children from an earlier marriage went to court to have the vials destroyed.

The California Court of Appeal held that the sperm was property (Hecht v. Superior Court, 1993).

But look closely at how it said so. Kane had an interest, the court wrote, "in the nature of ownership, to the extent that he had decisionmaking authority as to the use of his sperm for reproduction".

The property right is defined by the decision.

But what about when you donate DNA?

In the 1990s a group of families whose children had Canavan disease, a fatal inherited disorder, went looking for the gene that caused it. They found a researcher named Reuben Matalon who was willing to hunt for it. They gave him tissue from their children, including from children who had died. They gave him blood. They raised money for him. And they built and handed over a registry of affected families, which made the search possible.

Matalon found the gene. In 1997 the hospital he worked for patented it, then, according to the complaint, began charging royalties on the test and restricting who could perform it.

The families found out afterwards. They sued.

In 2003 a federal court in Florida dismissed almost everything (Greenberg v. Miami Children's Hospital, 2003). No conversion, because the property right in tissue, in the court's words, "evaporates once the sample is voluntarily given to a third party". No informed consent claim. No breach of fiduciary duty. The only claim left standing was unjust enrichment, and it survived not because of the tissue but because the families had also given money, labour and the registry.

Greenberg is a harder ruling than Moore. Moore at least kept the consent claim alive. These families were told nothing, gave everything, and had both their consent and fiduciary duty claims dismissed, leaving a single equitable claim about the parts of their contribution that were not biological.

Then there is what happens when you try to take it back.

Washington University ran a prostate cancer biorepository built around a surgeon named William Catalona. When he moved to Northwestern, he wrote to the men who had contributed and asked them to release their samples so they could follow him. Around six thousand of them signed. The university sued, and in 2007 the Eighth Circuit held that the samples belonged to the university (Washington University v. Catalona, 2007). The participants had made a gift. Their right to withdraw was a right to stop contributing and have future samples destroyed. It was not a right to say where the samples already given should go.

Consent to participate does not come with a leash attached.

Do I own my fingerprint?

In 2008 Illinois passed the Biometric Information Privacy Act (Biometric Information Privacy Act, 2008). It covers retina and iris scans, fingerprints, voiceprints and scans of hand or face geometry.

Simple put, you must obtain informed written consent before you collect. You must publish a retention and destruction schedule and actually destroy the data when the purpose is satisfied or three years after the person's last dealing with you, whichever comes first. You may not sell, lease, trade or otherwise profit from it, at all, with or without permission. And if you break any of that, the person can sue you directly.

In 2019 the Illinois Supreme Court was asked whether someone had to show they had actually been harmed (Rosenbach v. Six Flags, 2019). A mother had sued Six Flags over a thumbprint taken from her fourteen-year-old for a season pass. The court held that no injury beyond the violation itself was required.

The failure to obtain consent is the injury.

There are further cases, including a landmark one with Facebook's facial recognition, which generally point to the same idea.

Brain data has a brainprint like a fingerprint, so do they get the same protection?

This brings us back to the brain.

In 2015 a group at Yale showed that a person's functional connectivity profile, essentially the pattern of how their brain regions talk to each other, identifies them reliably across different scanning sessions and across different tasks (Finn et al., 2015). They called it connectome fingerprinting.

In 2016 a group at Binghamton combined classifiers to reach 100 percent identification across a pool of fifty people, from event-related potentials in EEG measured against images shown for 184 milliseconds each (Ruiz-Blondet et al., 2016).

Anonymized neural data is close to a contradiction. The identifying feature is not attached to the recording as a label. It is the shape of the recording itself.

Chile is the first country to write neural data protections into law

Chile is the first country in the world to write neural data into its constitution.

In 2017 a neuroscientist at Columbia named Rafael Yuste, one of the architects of the US BRAIN Initiative, gathered a group of researchers and ethicists and published a warning (Yuste et al., 2017). The technology they were building was going to make mental privacy a live legal question, and nobody was ready for it. In January 2019 he took that argument to Congreso Futuro, Chile's annual public science event, run by the Senate's Committee on Future Challenges (Congreso Futuro, 2019). He demonstrated what the machines could already do, and what could already be inferred from what they recorded.

The senator chairing that committee was Guido Girardi, a physician by training, and he mapped it immediately onto something he already understood. When we learned to read the genome we had to invent genetic privacy to go with it. Someone was now reading the brain and nothing had been invented for privacy protection.

He took it and ran with it. The Senate's Future Commission approved a constitutional amendment unanimously in December 2020, both chambers passed it in September 2021, and the president signed it that October (Ley 21.383 (Chile), 2021). Article 19 No. 1 of the Chilean constitution now requires the law to give special protection to brain activity and to the information derived from it.

Then came the harder part. Chilean legal academics were describing neurorights as a fictitious construction assembled out of nothing. Girardi needed a defendant.

So he bought a headset.

In 2022, by now a former senator, Girardi bought an Emotiv Insight, a consumer EEG headband sold to people who want to track their focus, and to researchers as a way to democratise brain science. It is not a medical device and does not claim to be. He plugged it in and accepted the terms, and in doing so granted Emotiv a worldwide, perpetual, irrevocable licence over his brain data. The data went to servers in the United States. Exporting his own recordings was a paid feature.

In April 2022 he filed a constitutional protection action in the Court of Appeals of Santiago. Emotiv's defence was that the device is consumer research equipment, users accept the policy voluntarily, research data is anonymised, the harms are hypothetical, and the company complied with Chile's data protection statute, which was written in 1999. In May 2023 the Court of Appeals rejected the case unanimously, holding that if Girardi had a complaint it belonged under the ordinary data protection law like anyone else's (Girardi Lavín c. Emotiv Inc. (Court of Appeals), 2023).

He appealed. On 9 August 2023 the Supreme Court of Chile reversed, holding that Emotiv's handling of his brain data had affected his constitutional rights to physical and psychological integrity and to privacy (Girardi Lavín c. Emotiv Inc., 2023).

Anonymisation was not a defence. Brain data used for scientific research cannot be treated as free-use statistical material simply because a name has been removed. It requires express consent, and that consent has to specify the purpose and the end of the research it is being used for.

The court ordered Emotiv to delete his data and referred the device to Chile's public health institute and its customs service.

When Girardi bought the Insight, Emotiv's own privacy policy treated brain data as personal information. On 9 June 2023, between the two judgments, the company published an updated policy stating that EEG data on its own is not personal information (Emotiv Inc., 2023).

Future-proofing for uncharted territory

Every case in this piece agrees that you must get consent not only to take the data, but for its end purpose. The following six guidelines sum all of the legal precedent we've covered, and that which we haven't discussed.

If you have a stake in what a recording becomes, it belongs in the consent conversation, in plain language, before the person agrees. That is what sank David Golde, who asked Moore to consent seven years running while holding his financial stake back (Moore v. Regents, 1990).

Consent to research use has to state the purpose and the end of the research (Girardi Lavín c. Emotiv Inc., 2023). Broad permission for unspecified future work is unacceptable.

Consent to record and consent to train are different consents, and a person may reasonably say yes to one and no to the other. To my knowledge, Connecticut is the first to specifically call out training of AI models as an end purpose (Connecticut SB 1295, 2025).

The law treats given material as gone, and the right to withdraw is a right to stop contributing rather than to retrieve (Washington University v. Catalona, 2007). No court is going to hand that back to someone whose brain activity is sitting in your corpus.

Brain data cannot be anonymised into safety (Finn et al., 2015) (Ruiz-Blondet et al., 2016). Treat it accordingly.

The shape Illinois arrived at in 2008 for fingerprinting with published retention period, actual destruction at the end of it, and no sale, at any price, with or without permission (Biometric Information Privacy Act, 2008) is probably the shape that neural data will take.

Do you have an idea you want to discuss in this theme? Get in touch.

References

1. 17 U.S.C. (1976). Copyright Act, sections 101 and 102(a). [Link]
2. Thaler v. Perlmutter (2025). No. 23-5233 (D.C. Cir., 18 March 2025), cert. denied 2 March 2026 (No. 25-449). [Link]
3. Finn, E., et al. (2015). Functional connectome fingerprinting: identifying individuals using patterns of brain connectivity. Nature Neuroscience, 18(11), 1664-1671. doi:10.1038/nn.4135
4. Ruiz-Blondet, M., Jin, Z., & Laszlo, S. (2016). CEREBRE: A novel method for very high accuracy event-related potential biometric identification. IEEE Transactions on Information Forensics and Security, 11(7), 1618-1629. doi:10.1109/TIFS.2016.2543524
5. Moore v. Regents (1990). Moore v. Regents of the University of California, 51 Cal. 3d 120, 271 Cal. Rptr. 146, 793 P.2d 479 (Cal. 1990). [Link]
6. US Patent 4,438,032 (1984). Unique T-lymphocyte line and products derived therefrom, issued 20 March 1984. [Link]
7. Cal. Health and Safety Code (1972). Section 7054.4, disposal of recognizable anatomical parts and tissues following surgical procedures. [Link]
8. Hecht v. Superior Court (1993). 16 Cal. App. 4th 836, 20 Cal. Rptr. 2d 275 (Cal. Ct. App. 1993), at 850. [Link]
9. Greenberg v. Miami Children's Hospital (2003). Greenberg v. Miami Children's Hospital Research Institute, 264 F. Supp. 2d 1064 (S.D. Fla. 2003), at 1075 and 1077-78. [Link]
10. Washington University v. Catalona (2007). 490 F.3d 667 (8th Cir. 2007), affirming 437 F. Supp. 2d 985 (E.D. Mo. 2006), cert. denied 552 U.S. 1166 (2008). [Link]
11. Biometric Information Privacy Act (2008). 740 ILCS 14 (Illinois), sections 10, 15 and 20. [Link]
12. Rosenbach v. Six Flags (2019). Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. [Link]
13. Yuste, R., et al. (2017). Four ethical priorities for neurotechnologies and AI. Nature, 551, 159-163. doi:10.1038/551159a
14. Congreso Futuro (2019). Rafael Yuste, "Neuroderechos y la privacidad mental", Santiago, January 2019. [Link]
15. Ley 21.383 (Chile) (2021). Modifica la Carta Fundamental, para establecer el desarrollo científico y tecnológico al servicio de las personas, amending Article 19 No. 1 of the Constitution, promulgated 14 October and published 25 October 2021. [Link]
16. Girardi Lavín c. Emotiv Inc. (Court of Appeals) (2023). Corte de Apelaciones de Santiago, Rol 49.852-2022, judgment of 24 May 2023. [Link]
17. Girardi Lavín c. Emotiv Inc. (2023). Corte Suprema de Chile, Rol 105.065-2023, judgment of 9 August 2023, considerando séptimo. [Link]
18. Emotiv Inc. (2023). Privacy policy effective 9 June 2023, archived 31 July 2023, compared with the policy effective 25 August 2020 and still posted on 1 June 2023. [Link]
19. Connecticut SB 1295 (2025). Public Act 25-113, An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts, sections 5 and 9 amending the Connecticut Data Privacy Act, neural data and model training provisions effective 1 July 2026. [Link]