Nobody Asked My Brain for Permission

There’s a thread on r/technews about wearable sleep trackers using your brainwaves to train AI models without explicit consent. The top comment says that if you don’t sleep with a brainwave headband on, you’re safe. Fair enough. Most of us don’t own one. Still, I’ve been turning it over for a day.

I should say up front that I haven’t read the underlying article closely, and the thread didn’t link much detail. One commenter dismissed the whole thing because the news site runs AI ads. Another called it FUD. I can’t rule either out. What I can say is that the claim sounds plausible, because I’ve worked in IT long enough to know how these things usually go.

Here’s how. Somebody builds a product. The terms of service are 11,000 words long. Buried in paragraph 40 is a line about “improving our services and developing new technologies”. Nobody reads it, including me, and I get paid to read documentation. A year later someone discovers the data went into a training set. The company says users agreed. Technically, they did. In any sense that matters, they didn’t.

One person in the thread said their CPAP machine has a 3G connection that sends data back to the manufacturer. That one landed for me. My father-in-law has one, and I’d never thought to ask what it phones home. The machine is medical, it’s useful, and it does a job. Nobody buys it thinking they’re enrolling in a research program.

Someone asked what the benefit of tracking brainwaves with AI actually is. I think that’s the right question, and it has two answers. The honest one is that sleep data is really valuable for research. Sleep science has been short of large datasets for decades, and a million people wearing headbands is a dream for that field. I’m a bit excited about that, genuinely. The other answer is that the same dataset is valuable to anyone who wants to predict your mood, your health, or how likely you are to buy something at 2am. Same data, same pipeline, and the only difference is who’s holding it and what they promised.

So I hold two views. I’d like sleep research to get better, and I’d like it done with consent that means something. The trouble is they don’t come as a pair. The first is easy to build. The second takes effort and slows things down, and in this industry it tends to lose.

Brainwaves feel different from step counts. A heart rate is a number. EEG is closer to a fingerprint of how your head works, and we don’t yet know what can be pulled out of it. The people collecting it don’t fully know either. That’s why “it only affects people with headbands” doesn’t reassure me much. It’s a small group now. Smart glasses, earbuds and watches are all heading toward neural and biometric sensing, and the group won’t stay small.

Australia’s Privacy Act is, to put it kindly, overdue for an overhaul. The reforms keep arriving in instalments, and health and biometric data are the areas where I’d like them to move faster. I’d also like consent to be something you opt into, not a box you fail to untick. I’m not asking for a ban. I’m asking for the company to tell me, in a plain sentence, what it’s doing with my sleeping brain.

I take my watch off at night, like the commenter who said they strip off the wedding ring, glasses and smartwatch. I used to think that made me a bit fussy. It turns out to be a decent privacy policy. It won’t scale, though, and individual caution can’t be the whole answer.

Someone joked that they’re not worried because they don’t have brainwaves. I laughed. Then I thought about how many people have said the same thing about their data, right up until it turned up somewhere.

I don’t know how this plays out. I do know that the right time to ask these questions is before the headband is in every second bedroom, not after.