Whose thought is it anyway?

A thought in itself cannot be intellectual property. You can't own a thought, because that would be an impediment to freedom of thought, which is a fundamental human right. But the expression of thought can be intellectual property, when it's transmitted and recorded in a medium that makes it accessible to other human beings.

So what happens when someone consents to a brain-computer interface recording their thoughts and fixing them in a medium that makes them accessible to other human beings?

This contentious issue sits in the background of many discussions around brain-computer interfaces.

Fundamentally, raw neural data is a measurement, and measurements are facts which cannot be copyrighted (Feist v. Rural Telephone, 1991). Nobody owns the temperature, or a heart rate, or the number of times a neuron fired.

But given that it is inherently re-identifiable, seeing that each brain produces a brainprint like a fingerprint (Finn et al., 2015) (Ruiz-Blondet et al., 2016), it may be closer to biometrics or genomics than anything else in its raw form. And that has implications for how it's collected, stored and legally treated.

Let's run with that premise for a bit.

Who owns cells that have been removed from a body?

Moore v. Regents was a contentious ruling in 1990, and it is the closest thing we have to an answer about what happens to biological material once it leaves your body (Moore v. Regents, 1990).

It started in 1976 when John Moore, a man with hairy cell leukemia, went to UCLA Medical Center, where a doctor named David Golde told him his spleen had to come out. That was true. The splenectomy was part of his treatment and Moore recovered.

What Moore was not told was that his cells were valuable. They overproduced proteins the biotech industry wanted, and before the operation Golde had already arranged to keep the spleen. Golde and a researcher named Shirley Quan cultured the cells into an immortal cell line. They called it Mo, after the man it came from. In 1984 they were granted a patent on it, naming themselves as the inventors and assigning it to the University of California (US Patent 4,438,032, 1984). Golde took 75,000 shares and consulting fees from Genetics Institute, under an agreement Sandoz later bought into.

Then Golde kept calling Moore back. Moore had moved to Seattle by this point, and each time he was told the follow-up was medically necessary and could only be done at UCLA. So each time he flew down. Over roughly seven years Golde took blood, serum, skin, bone marrow and sperm. Moore thought he was a patient being monitored, when in reality, he was a source being harvested.

Eventually the ruse unravelled. Twice in 1983 UCLA asked him to sign a form granting the university all rights to any cell line developed from his tissue. In April he granted them. In September he struck the grant out. That refusal is the only reason there is a case. He kept the form, took it to a lawyer, and the lawyer's investigation surfaced the patent UCLA had been issued the following March.

He sued for conversion, which is the tort of wrongfully taking control of someone else's property. His argument was that the cells were his. They came out of his body. No one asked him, and other people got rich.

The Supreme Court of California told him he had no ownership interest in his excised cells. California law already stripped most property attributes from tissue removed from the body (Cal. Health and Safety Code, 1972). The patented cell line was, in the court's words, "factually and legally distinct from the cells taken from Moore's body", because the value lay in the work of making it live in a laboratory forever. And underneath both of those sat the real reason, which is that a property right in extracted tissue would expose every researcher who had ever handled a human sample, and the court was not willing to do that to an entire industry.

But Moore did not lose everything.

The court held he had a claim for breach of fiduciary duty and lack of informed consent (Moore v. Regents, 1990). A doctor who intends to use a patient's tissue in research he has a financial stake in has to disclose that stake before asking the patient to consent. Golde had asked Moore to sign consent forms for seven years while concealing that fact.

All cells are not equal in the eyes of the law

Not all cells are treated equal, and reproduction is the exception.

In 1991 a man named William Kane deposited fifteen vials of sperm at a cryobank in Los Angeles. He was in a relationship with a woman named Deborah Hecht. He left her his interest in the vials in his will, and then he took his own life. His two adult children from an earlier marriage went to court to have the vials destroyed.

The California Court of Appeal held that the sperm was property (Hecht v. Superior Court, 1993).

But look closely at how it said so. Kane had an interest, the court wrote, "in the nature of ownership, to the extent that he had decisionmaking authority as to the use of his sperm for reproduction".

The property right is defined by the decision.

Kane could not have sold the vials. He could not have done whatever he liked with them. What he had was authority over a single question, which was whether they would be used to make a child, and the court was willing to call that authority property because there was nobody else alive who could answer it for him.

In 1992, in Tennessee, a divorcing couple had fought over seven frozen embryos. Mary Sue Davis wanted to donate them to another couple. Junior Davis wanted them destroyed. The Tennessee Supreme Court held that pre-embryos were neither persons nor property, but an interim category owed what it called "special respect" (Davis v. Davis, 1992). It decided the case by balancing the two interests against each other, and held that the party who wants to avoid becoming a parent ordinarily wins. Junior Davis won. Cells that did not originate from his body were destroyed by court order.

So even inside the exception there is a line. Gametes edge toward property. Embryos do not.

But what about when you donate DNA?

In the 1990s a group of families whose children had Canavan disease, a fatal inherited disorder, went looking for the gene that caused it. They found a researcher named Reuben Matalon who was willing to hunt for it. They gave him tissue from their children, including from children who had died. They gave him blood. They raised money for him. And they built and handed over a registry of affected families, which made the search possible.

Matalon found the gene. In 1997 the hospital he worked for patented it, then, according to the complaint, began charging royalties on the test and restricting who could perform it.

The families found out afterwards. They sued.

In 2003 a federal court in Florida dismissed almost everything (Greenberg v. Miami Children's Hospital, 2003). No conversion, because the property right in tissue, in the court's words, "evaporates once the sample is voluntarily given to a third party". No informed consent claim. No breach of fiduciary duty. The only claim left standing was unjust enrichment, and it survived not because of the tissue but because the families had also given money, labour and the registry.

Greenberg is a harder ruling than Moore. Moore at least kept the consent claim alive. These families were told nothing, gave everything, and had both their consent and fiduciary duty claims dismissed, leaving a single equitable claim about the parts of their contribution that were not biological.

Then there is what happens when you try to take it back.

Washington University ran a prostate cancer biorepository built around a surgeon named William Catalona. When he moved to Northwestern, he wrote to the men who had contributed and asked them to release their samples so they could follow him. Around six thousand of them signed. The university sued, and in 2007 the Eighth Circuit held that the samples belonged to the university (Washington University v. Catalona, 2007). The participants had made a gift. Their right to withdraw was a right to stop contributing and have future samples destroyed. It was not a right to say where the samples already given should go.

Six thousand people, in writing, all asking for the same thing, and it made no difference. Consent to participate does not come with a leash attached.

Ok, so patients don't own their genes. Can you patent them?

Myriad is usually read as the case that went the other way.

In 2013 the US Supreme Court held that Myriad Genetics could not patent the BRCA1 and BRCA2 genes, because a naturally occurring DNA segment is a product of nature and is not patent eligible merely because it has been isolated (AMP v. Myriad Genetics, 2013). This is routinely reported as patients winning back their genes. Nobody won anything back. The question was whether a gene sequence is eligible for a patent, not who owns it. When the patent fell the sequence did not return to the women it came from. It fell into the commons, where anyone could use it.

That is the pattern. The law will stop a company from monopolising your biology. It will not hand it to you.

So by the mid-2000s the ownership question had failed everywhere it was asked, and legislatures started doing something else.

Do I own my fingerprint?

In 2008 Illinois passed the Biometric Information Privacy Act (Biometric Information Privacy Act, 2008). It covers retina and iris scans, fingerprints, voiceprints and scans of hand or face geometry. It never asks who owns a fingerprint. It asks a different set of questions entirely.

You must obtain informed written consent before you collect. You must publish a retention and destruction schedule and actually destroy the data when the purpose is satisfied or three years after the person's last dealing with you, whichever comes first. You may not sell, lease, trade or otherwise profit from it, at all, with or without permission. And if you break any of that, the person can sue you directly.

In 2019 the Illinois Supreme Court was asked whether someone had to show they had actually been harmed (Rosenbach v. Six Flags, 2019). A mother had sued Six Flags over a thumbprint taken from her fourteen-year-old for a season pass. The court held that no injury beyond the violation itself was required. The failure to obtain consent is the injury.

Two years later Facebook paid six hundred and fifty million dollars for running face recognition on photographs of about seven million people in Illinois, to suggest who to tag (In re Facebook Biometric Privacy Litigation, 2021).

Nobody in any of this claimed to own a face.

Europe reached the same structure by a different route. Under the GDPR, biometric data is a special category requiring explicit consent, but only when it is processed for the purpose of uniquely identifying a person (GDPR, 2016). Note what that means. The same measurement can be ordinary data or maximally protected data depending on what you are trying to do with it. The trigger is the purpose, not the substance.

Brain data has a brainprint like a fingerprint, so do they get the same protection?

Which brings the question back to the brain, where the evidence is now uncomfortable.

In 2015 a group at Yale showed that a person's functional connectivity profile, essentially the pattern of how their brain regions talk to each other, identifies them reliably across different scanning sessions and across different tasks (Finn et al., 2015). They called it connectome fingerprinting.

In 2016 a group at Binghamton combined classifiers to reach 100 percent identification across a pool of fifty people, from event-related potentials in EEG measured against images shown for 184 milliseconds each (Ruiz-Blondet et al., 2016). They called their system CEREBRE.

The Binghamton result came with a interesting wrinkle. Because their signature depended on the particular stimulus set they used, it was cancellable. If it leaked you could issue the person a new one, which is something you cannot do with a face or a fingerprint. But that property belongs to their authentication protocol, not to brain signals generally. A broadband recording of someone speaking is not cancellable. It is just them.

And that is the thing that breaks the last defence available.

Every regime we have been through has an escape hatch, and the hatch is anonymization. Strip the name and the record stops being personal data, so the consent rules stop applying and the tissue can be used freely for research. It is the mechanism the biobanks run on. It is the reason Greenberg and Catalona were even arguable.

If the signal identifies the person, the hatch is welded shut. Anonymized neural data is close to a contradiction. The identifying feature is not attached to the recording as a label. It is the shape of the recording itself.

Chile decided to do something about it

Chile is the first country in the world to write neural data into its constitution.

In 2017 a neuroscientist at Columbia named Rafael Yuste, one of the architects of the US BRAIN Initiative, gathered a group of researchers and ethicists and published a warning (Yuste et al., 2017). The technology they were building was going to make mental privacy a live legal question, and nobody was ready for it.

Two years later he was invited to Santiago.

Chile runs an annual public science event called Congreso Futuro, driven by the Senate's Committee on Future Challenges (Congreso Futuro, 2019). In January 2019 Yuste gave a talk there on neurorights and mental privacy. He put in front of the room a demonstration of what the machines could already do, and what could already be inferred from what they recorded.

Sitting in that room was the senator who chaired the committee, Guido Girardi. Girardi is a physician with a background in public health, and he heard the argument and immediately mapped it onto something he already understood. When we learned to read the genome, we had to invent genetic privacy to go with it. Someone was now reading the brain and nothing had been invented for protection.

He took it and ran with it. In December 2020 the Senate's Future Commission approved a constitutional amendment unanimously. In September 2021 both chambers passed it. In October 2021 the president signed it (Ley 21.383 (Chile), 2021).

Article 19 No. 1 of the Chilean constitution now requires the law to give special protection to brain activity, and to the information derived from it.

Chile protected a data stream, distinct from the organ that produces it, and it did so at the highest level of law available to it, roughly thirty-three months after a conference panel.

Then came the harder part.

Chilean legal academics were describing neurorights as a fictitious construction assembled out of nothing. Girardi needed a defendant.

So he bought a headset.

In 2022, by now a former senator, Girardi bought an Emotiv Insight. It is a consumer EEG headband with five channels, made by a company in San Francisco co-founded by the Australian Tan Le, sold to people who want to track their focus or their meditation, and sold to researchers as a way to democratise brain science. It is not a medical device and does not claim to be.

He plugged in the device and accepted the terms. By doing so, he granted Emotiv a worldwide, perpetual, irrevocable licence over his brain data. The data went to servers in the United States. And unless he paid to upgrade to the professional tier, he could not export or import his own recordings. He had bought a device that read his brain, and keeping his own results was a paid feature.

In April 2022 he filed a constitutional protection action in the Court of Appeals of Santiago.

Emotiv's defence was that Insight is a consumer research device, not a medical one. Users accept the privacy policy voluntarily and can decline. Any data used for research is anonymised. The harms alleged are hypothetical. And the company complied with Chile's existing data protection statute, which was written in 1999.

In May 2023 the Court of Appeals rejected the case unanimously (Girardi Lavín c. Emotiv Inc. (Court of Appeals), 2023). It held that no constitutional right had been affected in its legitimate exercise, and that if Girardi had a complaint it belonged under the ordinary data protection law like anyone else's.

He appealed. On 9 August 2023 the Supreme Court of Chile reversed and found for him, holding that Emotiv's handling of his brain data had affected his constitutional rights to physical and psychological integrity and to privacy (Girardi Lavín c. Emotiv Inc., 2023).

Anonymisation was not a defence. Brain data used for scientific research cannot be treated as free-use statistical material simply because a name has been removed. It requires express consent, and that consent has to specify the purpose and the end of the research it is being used for.

The court ordered Emotiv to delete his data and referred the device to Chile's public health institute and its customs service.

When Girardi bought the Insight, Emotiv's own privacy policy treated brain data as personal information. On 9 June 2023, between the two judgments, the company published an updated policy stating that EEG data on its own is not personal information (Emotiv Inc., 2023).

There are no definitive rulings

Courts have decided who owns a spleen, a donated gene, a vial of sperm, a face in a photograph, and one consumer headband sold to a Chilean senator who went looking for a fight. No court anywhere has ruled on a recording taken from the surface of a living brain for the purpose of decoding what the person was trying to say. Nothing has been decided about what happens when thousands of those recordings become a model.

There are at least three open questions and none of them have obvious answers.

The first is the artifact. If a decoder turns cortical activity into a sentence on a screen, that sentence is fixed in a tangible medium, which is the threshold copyright cares about (17 U.S.C., 1976). But US courts have now confirmed, up to a denial of certiorari in 2026, that copyright requires a human author (Thaler v. Perlmutter, 2025). The person did not fix the sentence. The model cannot author it. The most intimate expression a person can produce may turn out to belong to nobody.

The second is the trigger. European law gives biometric data its strongest protection only when the data is processed for the purpose of uniquely identifying someone (GDPR, 2016). A speech decoding corpus is not built to identify anyone. It is built to work out what they said. So the strongest protection on the books may simply not reach the material, even though every recording in the set is uniquely attributable to the person who made it. That gap is why four American states had to write separate neural data laws rather than amend the biometric ones they already had (Colorado HB24-1058, 2024) (California SB 1223, 2024) (Montana SB 163, 2025) (Connecticut SB 1295, 2025).

The third is the handoff. All four of those state laws are consumer privacy statutes, and three of them carve out data already governed by clinical and research rules. So a recording made in an operating theatre under ethics oversight sits outside them. Only Montana refuses the carve-out, demanding separate consent for neurotechnology data and overriding the federal waivers. The value is created when the recording becomes training data for something sold. No instrument anywhere governs that crossing.

The first global standard, sort of

Into that gap, on 11 November 2025, came the first global standard.

UNESCO adopted a Recommendation on the Ethics of Neurotechnology at its 43rd General Conference in Samarkand (UNESCO, 2025). It is the first instrument of its kind anywhere. It covers mental privacy and freedom of thought, heightened protections for children, limits on neuromonitoring in workplaces, and consumer protection.

But a UNESCO recommendation is not a treaty. There is nothing to sign and nothing to ratify. No country accedes to it and no country breaches it. It works only by being copied into national law, and so far none of the countries where this research is actually being done have copied it.

The OECD got there earlier and quieter, in December 2019, with a recommendation on responsible innovation in neurotechnology and nine principles, the seventh of which is to safeguard personal brain data (OECD, 2019). It published an implementation toolkit in 2024 (OECD, 2024). It is the most useful of the international instruments for anyone actually building something, because it was written for people who intend to proceed.

Then there are the four states, which are the only hard law in the English-speaking world on this specific substance. Colorado in 2024, California from the start of 2025, Montana from October 2025, Connecticut from July 2026.

Not one asks who owns neural data. They ask whether you obtained express consent before collecting it, what you are permitted to do with it afterwards, how long you may keep it, and whether you may sell it. Which is to say they ask the same four questions Illinois asked about fingerprints in 2008, and the same question the California Supreme Court left standing for John Moore in 1990.

Connecticut adds one more. Its privacy notice has to state whether the controller uses personal data to train large language models (Connecticut SB 1295, 2025). That duty covers personal data generally rather than neural data specifically, but it is the first state privacy law to name the use case.

Future-proofing for uncharted territory

Start with the thing every case in this piece agrees on. Every remedy that landed, did so on what the person had been told before they agreed. Consent is the only thing that has ever worked.

So the first requirement is the one that sank David Golde (Moore v. Regents, 1990). If you have a commercial interest in what a recording will become, that interest belongs in the consent conversation, before the person agrees, in plain language. The failure in Moore was that Golde asked for consent seven years running while holding something back.

The second is specificity. Girardi establishes that consent to research use has to state the purpose and the end of the research (Girardi Lavín c. Emotiv Inc., 2023). Broad permission for unspecified future work is exactly the form of words this material dissolves.

The third is that consent to record and consent to train are two different consents, and they should be asked separately, because a person may reasonably say yes to one and no to the other. Connecticut has legislated a version of the disclosure half (Connecticut SB 1295, 2025).

The fourth is the hardest, and it comes out of Catalona (Washington University v. Catalona, 2007). Once material is given, the law treats it as gone, and the right to withdraw is a right to stop contributing rather than a right to retrieve. If you want withdrawal to mean something for a person whose brain activity is sitting in your corpus, you will have to build that yourself, because no court is going to hand it to them.

The fifth follows from the fingerprinting evidence (Finn et al., 2015) (Ruiz-Blondet et al., 2016). Design on the assumption that the data identifies the person permanently and cannot be anonymised into safety.

And the sixth is simply the shape Illinois arrived at in 2008 and everyone has copied since (Biometric Information Privacy Act, 2008). A published retention period. Actual destruction at the end of it. And no sale, at any price, with or without permission.

Now, let's get to the part where we figure out whether a sentence decoded from thought can even be copyrighted in the first place.

References

Feist v. Rural Telephone (1991). Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340. [Link]
Finn, E., et al. (2015). Functional connectome fingerprinting: identifying individuals using patterns of brain connectivity. Nature Neuroscience, 18(11), 1664-1671. doi:10.1038/nn.4135
Ruiz-Blondet, M., Jin, Z., & Laszlo, S. (2016). CEREBRE: A novel method for very high accuracy event-related potential biometric identification. IEEE Transactions on Information Forensics and Security, 11(7), 1618-1629. doi:10.1109/TIFS.2016.2543524
Moore v. Regents (1990). Moore v. Regents of the University of California, 51 Cal. 3d 120, 271 Cal. Rptr. 146, 793 P.2d 479 (Cal. 1990). [Link]
US Patent 4,438,032 (1984). Unique T-lymphocyte line and products derived therefrom, issued 20 March 1984. [Link]
Cal. Health and Safety Code (1972). Section 7054.4, disposal of recognizable anatomical parts and tissues following surgical procedures. [Link]
Hecht v. Superior Court (1993). 16 Cal. App. 4th 836, 20 Cal. Rptr. 2d 275 (Cal. Ct. App. 1993), at 850. [Link]
Davis v. Davis (1992). 842 S.W.2d 588 (Tenn. 1992), at 597 and 604. [Link]
Greenberg v. Miami Children's Hospital (2003). Greenberg v. Miami Children's Hospital Research Institute, 264 F. Supp. 2d 1064 (S.D. Fla. 2003), at 1075 and 1077-78. [Link]
Washington University v. Catalona (2007). 490 F.3d 667 (8th Cir. 2007), affirming 437 F. Supp. 2d 985 (E.D. Mo. 2006), cert. denied 552 U.S. 1166 (2008). [Link]
AMP v. Myriad Genetics (2013). Association for Molecular Pathology v. Myriad Genetics, Inc., 569 U.S. 576. [Link]
Biometric Information Privacy Act (2008). 740 ILCS 14 (Illinois), sections 10, 15 and 20. [Link]
Rosenbach v. Six Flags (2019). Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. [Link]
In re Facebook Biometric Privacy Litigation (2021). In re Facebook Biometric Information Privacy Litigation, No. 3:15-cv-03747 (N.D. Cal.), final approval 26 February 2021. [Link]
GDPR (2016). Regulation (EU) 2016/679, Articles 4(14) and 9(1). [Link]
Yuste, R., et al. (2017). Four ethical priorities for neurotechnologies and AI. Nature, 551, 159-163. doi:10.1038/551159a
Congreso Futuro (2019). Rafael Yuste, "Neuroderechos y la privacidad mental", Santiago, January 2019. [Link]
Ley 21.383 (Chile) (2021). Modifica la Carta Fundamental, para establecer el desarrollo científico y tecnológico al servicio de las personas, amending Article 19 No. 1 of the Constitution, promulgated 14 October and published 25 October 2021. [Link]
Girardi Lavín c. Emotiv Inc. (Court of Appeals) (2023). Corte de Apelaciones de Santiago, Rol 49.852-2022, judgment of 24 May 2023. [Link]
Girardi Lavín c. Emotiv Inc. (2023). Corte Suprema de Chile, Rol 105.065-2023, judgment of 9 August 2023, considerando séptimo. [Link]
Emotiv Inc. (2023). Privacy policy effective 9 June 2023, archived 31 July 2023, compared with the policy effective 25 August 2020 and still posted on 1 June 2023. [Link]
17 U.S.C. (1976). Copyright Act, sections 101 and 102(a). [Link]
Thaler v. Perlmutter (2025). No. 23-5233 (D.C. Cir., 18 March 2025), cert. denied 2 March 2026 (No. 25-449). [Link]
Colorado HB24-1058 (2024). Protections for biological data, amending the Colorado Privacy Act, effective 7 August 2024. [Link]
California SB 1223 (2024). Consumer privacy: neural data, amending Civil Code section 1798.140, effective 1 January 2025. [Link]
Montana SB 163 (2025). Chapter 345, Laws of 2025, amending the Genetic Information Privacy Act to cover neurotechnology data, effective 1 October 2025. [Link]
Connecticut SB 1295 (2025). Public Act 25-113, An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts, sections 5 and 9 amending the Connecticut Data Privacy Act, neural data and model training provisions effective 1 July 2026. [Link]
UNESCO (2025). Recommendation on the Ethics of Neurotechnology, SHS/BIO/REC-NEURO/2025, adopted 11 November 2025 at the 43rd General Conference, Samarkand. [Link]
OECD (2019). Recommendation of the Council on Responsible Innovation in Neurotechnology, OECD/LEGAL/0457, adopted 11 December 2019. [Link]
OECD (2024). Neurotechnology Toolkit, first published April 2024 and since updated. [Link]