Sleep headbands quietly used customers' brainwave data to train AI models

What's going on

Headbands that measure your brainwaves at night are supposed to show how well you sleep. But at some manufacturers, those recordings end up somewhere else too: in the training data for AI models. That's the finding of an investigation by the journal Science together with the Pulitzer Center's AI Accountability Network. Consumer neurotech companies have collected tens of millions of hours of electroencephalography (EEG) recordings between them. In an EEG, electrodes on the scalp pick up the tiny electrical voltages produced as nerve cells fire. Several companies are using this data to build so-called brain foundation models. At first, their privacy policies didn't clearly mention this use. Tom's Hardware and the Indonesian site Telset.id are among the outlets reporting on it.

Interaxon and the Muse headband

At the center of the story is Interaxon, a Canadian company based in Toronto. It sells Muse-branded headbands for sleep and meditation. The devices measure brain activity and other body signals during sleep. That data feeds reports that let customers track their sleep and changes in their sleep patterns.

According to the investigation, Interaxon has already trained an AI model on roughly 50,000 hours of EEG recordings. The company says names, email addresses and postal addresses are removed first. Chief marketing officer Nadia Kumentas is quoted as saying:

"We try to use as much of that permissible dataset as possible."

But until Science asked, Interaxon's privacy policy didn't explicitly say that users' brain recordings could be used to train foundation models. The text has since been changed. Kumentas concedes:

"We agree that users should be explicitly informed."

For anyone whose data has already been used, the clarification comes too late. Tom's Hardware therefore thinks lawsuits against the company are possible.

The AI model itself isn't news. Interaxon even advertises it. In March 2025, the company launched the Muse S Athena headband for $474.99. It combines EEG with fNIRS, a technique that uses near-infrared light to measure blood oxygen levels in the frontal brain. According to the press release, Muse's "Foundational Brain Model" (FBM) analyzes the data. It was reportedly trained on more than 80,000 EEG sessions from "the world's largest EEG database." Muse says it has collected and analyzed more than a billion minutes of brain data so far, roughly 16 million hours. So the use of data was out in the open. What wasn't clear was that paying customers' own recordings were being used as training material. The core criticism is the lack of transparency, not the technology.

Emotiv, acquisitions and legal gaps

Interaxon isn't alone. EEG maker Emotiv also trains its "Large Brain Model" partly on recordings from customers who use its pricier devices. Emotiv, too, only changed its privacy policy after Science's questions. It now says anonymized neural data is used for training with opt-in consent. Opt-in means users have to actively agree; sharing isn't switched on by default.

Another finding goes even deeper. According to Science, more than two thirds of the companies examined explicitly reserve the right to hand over data in corporate transactions without users' consent. So if someone buys a small neurotech startup, the brain recordings it has collected simply pass to the new owner.

The law is lagging behind. In the US, only Colorado and California have amended their consumer privacy laws to explicitly cover neural data. The other states haven't done so yet. The sources don't address the situation in Europe.

How a brain foundation model works, and where its limits are

A foundation model is a large base model. It's first trained broadly on huge amounts of data and later adapted to specific tasks. Language models like ChatGPT are fed vast amounts of text. Brain foundation models instead learn from recordings of electrical brain activity and spot recurring patterns in them. With fine-tuning, a short round of extra training on specialized data, they can then be pointed at specific brain states or research questions.

There are already early results. AI startup Piramidal trained its model with the Cleveland Clinic on more than 4 million hours of EEG data. The result is a system that detects epileptic seizures. After fine-tuning on the clinic's recordings, it caught nine out of ten seizures in a pilot study.

The headbands can't read your mind, though. Most wearable EEG devices have only one to six electrodes. Clinical EEG systems usually use 19 to 25. That makes recordings from consumer devices far less comprehensive.

Other incidents and projects

Brain wearables have had security problems before. In February, an engineer discovered that a smart sleep mask he'd bought let him access strangers' brainwave recordings. He'd dug into the Android app because of connection problems. Inside, he found hardcoded credentials that were apparently the same for every device. Using them, he could get at other users' EEG readings.

The industry is collecting neural data at scale elsewhere too. Last December, San Francisco startup Coundit set out to gather 10,000 hours of brain data from thousands of patients. It built its own headset that records brain activity alongside speech and text. The goal is an AI that translates brain signals into language. Meta is working on BrainQwerty, a non-invasive brain-computer interface. Non-invasive means nothing is surgically implanted. The system is meant to turn brain activity into keystrokes. The second generation gets 61 percent of words right on average, up from 40 percent for the first. That's still nowhere near good enough for everyday use.

Our take

The investigation shows a familiar pattern: data customers hand over for one purpose quietly becomes AI training material. There have been fights over this for years when it comes to text and images from the web. But brainwaves are biological data, very closely tied to an individual. Experts worry that more could be read from them in the future than is possible today. Stripping out names and email addresses may therefore protect people less than the companies claim. The sources don't say whether EEG data can be traced back to specific people.

The medical benefits are real, as Piramidal's seizure detection system shows. The problems are the missing consent and the acquisition clauses. The fact that Interaxon and Emotiv only changed their policies after press inquiries doesn't suggest voluntary transparency. If you use a sleep or meditation headband, or plan to buy one, check the privacy policy to see whether your data can be used for AI training or passed on if the company is sold. And ideally, check whether you can switch that off.