THE TECHNOLOGY BLIND SPOT – THE PORTRAIT YOU NEVER SAT FOR | PART 2 OF 5

In March 2022, Guido Girardi bought a headband from a company’s website. Girardi had spent years in Chile’s senate warning colleagues about neurotechnology; now he wanted to test a product for himself. The device, a five-channel EEG headset called Insight, made by the San Francisco company Emotiv, reads the brain’s electrical activity through sensors resting against the scalp. Girardi created an account, accepted the terms, and began recording his own brain. Then he found the catch.

His free license would not let him export or even review the recordings. The data streamed to Emotiv’s cloud and stayed there, available to the company and unavailable to him. Closing the account would not erase it. Emotiv’s policy retained brain data for research.

Deleting it took the Supreme Court of Chile. On August 9, 2023, the court’s Third Chamber ruled that Emotiv’s storage and commercialization of Girardi’s brain activity violated his constitutional rights to psychic integrity and privacy, and ordered the company to erase every recording without further process. The scholars and lawyers who worked on the case describe it as the first ruling in history against a consumer neurotechnology company for violating brain-data privacy.

No American court has issued anything like it. This installment asks a narrower question than the series title suggests: not whether a data portrait of your client exists, but whether the portrait’s newest tile, the recorded activity of the brain itself, has any legal shield when a litigant asks for it. Five state statutes now regulate the commerce in neural data. None of them stops a subpoena.

The Device in the Drawer

The market Girardi tested has become a consumer category. At least 30 neurotechnology products are for sale online today: EEG meditation headbands, sleep-optimization bands, focus monitors marketed to students and traders. Retailers shelve them beside fitness trackers, and buyers treat them the same way, as wellness gadgets with an app.

Beneath the packaging, the privacy terms tell a different story. In April 2024, the Neurorights Foundation reviewed the policy documents of all 30 companies. Twenty-nine of the 30 have access to their users’ neural data with no meaningful limitation, and the same 29 can transfer that data to third parties. Only 14 extend a right to delete. Only six mention encryption. Five commit to notifying customers after a breach. Girardi’s experience was not an outlier. It was the market’s default setting.

A reader who assumes medical privacy law fills the gap has the framework backward. HIPAA governs covered entities, health plans, providers, clearinghouses, and their business associates. A headband vendor selling direct to consumers is none of those things. The same electrical signal that HIPAA guards inside a neurology clinic loses that protection the moment a consumer device records it, because American privacy law tracks the custodian, not the data. Your client’s EEG from a hospital sleep study sits behind federal law. Your client’s EEG from a consumer headband sits behind a clickwrap agreement drafted by the vendor’s counsel.

Five Statutes in Twenty-Six Months

Legislatures noticed. Colorado moved first: House Bill 24-1058, signed April 17, 2024, amended the Colorado Privacy Act to classify neural data as sensitive data, resting on a legislative finding worth quoting in full: because every brain is unique, neural data “always contains sensitive information that may link the data to an identified or identifiable individual.” California followed on September 28, 2024, adding neural data to the California Consumer Privacy Act’s categories of sensitive personal information and defining it as information “generated by measuring the activity of a consumer’s central or peripheral nervous system” that is “not inferred from nonneural information.”

Montana enacted a standalone neural-data privacy law in 2025. Connecticut’s amendment took effect on July 1, 2026, three weeks ago. Vermont became the fifth state this spring, signing its neurological-rights act on May 18, 2026, alongside a separate data-privacy act that classifies neural data as sensitive with no revenue threshold at all: a startup holding neural data from 3,000 Vermont consumers falls within its reach when it takes effect in 2028.

Momentum is building, not slowing. Nine neural-data bills appeared across six states in the first six weeks of 2026. A federal bill, the MIND Act, introduced in September 2025 by Senators Schumer, Cantwell, and Markey, would direct the Federal Trade Commission to study how to regulate neural data. It has not advanced past committee.

Read the fine print before drawing comfort from the count. Vermont’s neurological-rights act left the legislature lighter than it entered: the Senate stripped both the consent requirement and the private right of action, leaving a statement of principles and a study due back January 15, 2027. Statutory momentum and statutory protection are different things.

Here is the part that matters for your practice. The question is not whether these statutes protect your client’s neural data. The question is against whom. Every statute in the list regulates commerce: who may collect neural data, whether they may sell it, what consent they need, what a consumer may demand deleted. And every comprehensive privacy law in the stack carries a legal-process exemption. California’s, to take one, expressly permits a business to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons. The statutes police the market. They say nothing about the courtroom. A discovery request does not evade the new laws; it walks through a door the drafters left open on purpose.

The Fitbit Decade

To see where this goes, watch the last consumer sensor make the same trip. Two days before Christmas 2015, Richard Dabate told Connecticut state police that a masked intruder had broken into his Ellington home, shot his wife Connie, and zip-tied him to a folding chair. Connie Dabate was wearing her Fitbit. The tracker on her hip recorded her moving around the house for roughly an hour after the moment her husband said she died. More than 100 witnesses testified across five weeks of trial, but the timeline came from the device. A jury convicted Dabate of murder on May 10, 2022. He is serving 65 years.

The legal system needed less than a decade to move wearable data from novelty to routine. Courts now treat fitness-tracker output as ordinary electronically stored information, requested, preserved, and produced under the same rules as email. [See Your Fitness Tracker Is a Spy, Part 2, The Technology Blind Spot (2026).] Nothing in the Federal Rules of Civil Procedure distinguishes a heart-rate log from a brain-activity log. The move from steps to heartbeats to brain waves is a change of sensor, not a change of doctrine.

But the brain is different? Not to a subpoena. The Fifth Amendment stops the government from compelling a person to testify against himself; it does not shield records that already exist, created voluntarily and held by a third party. A meditation app’s stress log is, in the law’s eyes, a business record sitting on a server in California. Carpenter v. United States requires the government to obtain a warrant for historical cell-site location records, and the Chief Justice took care to call that holding a narrow one; it binds the government, not a civil litigant with a document request.

Recall what makes any single stream dangerous: the join. [See The Mosaic, The Technology Blind Spot (2026).] A headband that logs poor sleep and elevated stress at 11:42 PM is one column in a table. License-plate readers and card transactions supply where your client went. Cell towers supply when. Neural data supplies something no prior tile could: a timestamped record of internal state. The portrait gains an interior.

Louis Brandeis saw this coming in 1928. Dissenting in Olmstead v. United States, he warned that “ways may some day be developed by which the Government, without removing papers from secret drawers, can reproduce them in court,” and that “advances in the psychic and related sciences may bring means of exploring unexpressed beliefs, thoughts and emotions.” Ninety-eight years later, the exploring instrument retails on Amazon, and the party doing the exploring does not need to be the government. Brandeis wrote a dissent. The market wrote the majority opinion.

Three Problems, Running Independently

Evidence first. The copy that matters is not on your client’s phone. Twenty-nine of 30 vendors hold their own copy, which means a third-party subpoena can reach data your client believed deleted, or never knew existed. Family and personal-injury dockets will get there first: sleep logs offered to contest parenting fitness, stress data offered to prove emotional distress, focus records offered to challenge a disability claim. Preservation cuts the other way with equal force: once litigation is reasonably anticipated, a client’s neural data is discoverable ESI, and a client who quietly closes an account mid-dispute may have destroyed evidence neither of you inventoried.

Confidentiality next. Model Rules of Pro. Conduct r. 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of information relating to the representation. Suppose your client wears a focus tracker through your case-strategy meetings. A vendor now holds a log of stress spikes that lines up, timestamp by timestamp, with every difficult conversation in your conference room. No one breached anything. The record still describes the representation.

Competence completes the set. Comment 8 to Model Rules of Pro. Conduct r. 1.1 extends the duty of competence to the benefits and risks of relevant technology. An attorney who does not know these devices exist cannot ask the intake question, draft the preservation notice, or anticipate the production request. The blind spot is the exposure.

Where This Argument Breaks

The strongest objection deserves its full weight. Consumer EEG is noisy. A five-channel headband records aggregate electrical activity through hair and skin; it does not read thoughts, and most published decoding results come from laboratory equipment on cooperative subjects. A skeptic will say that treating a wellness gadget as a window into the mind repeats the oldest error in privacy writing: confusing what a sensor measures with what a marketing department claims it measures. On the science, the skeptic is right.

On the procedure, the skeptic loses. Discovery runs on relevance, not scientific rigor. Connie Dabate’s Fitbit was a consumer accessory whose reliability defense counsel attacked for five weeks, and the jury weighed it anyway. Noisy data with timestamps persuades precisely because it feels objective: asleep or awake, calm or agitated, at 11:42 PM. A judge who admits the log and lets the jury weigh its reliability has followed the rules exactly. The fight over what an EEG record actually proves will happen case by case, in front of judges who learned about the technology that morning.

One limit needs naming. I searched for a reported American decision compelling production of consumer neural data and found none. The argument in this piece is structural, not precedential: the statutes leave the litigation door open, the discovery rules draw no line at this data type, and the wearable precedent shows how quickly courts normalize a new sensor. The doctrine is in place. The case number is not, yet.

Your Thursday Action

Pull two templates: your standard preservation letter and the definitions section of your standard discovery requests. Read the categories. Would “wearable device data” capture the cloud copy of a meditation headband’s stress log, held by a vendor your client cannot name? If not, add one defined category: neural or neurophysiological data generated by consumer devices, including EEG headbands, sleep trackers, and focus monitors, together with copies held by device vendors. Then add one line to your intake checklist asking whether the client uses any such device. Two template edits and one question. That is the whole assignment.

Guido Girardi needed his country’s highest court to erase one season of brain recordings, and he got the order because Chile wrote brain activity into its constitution in 2021. Your client will generate tonight’s session with a sleep band bought from an ad, governed by a policy nobody read, stored by a vendor nobody chose, in a state whose newest statute controls who may buy that data and says nothing about who may demand it. The portrait you never sat for now includes the sitter’s mind. The first request for production is coming. The only open question is whether it lands on your desk or gets sent from it.

About the Author

JD Morris is Co-Founder and COO of LexAxiom, an Agentic AI platform for the business of law. Over a 25-year career, he has built and scaled enterprise technology products across Dell, EMC, VMware, and Cisco, including the first exabyte eDiscovery platform. He holds dual MBAs from Columbia Business School (Finance) and UC Berkeley Haas (Marketing), a Master of Legal Studies in Cybersecurity Law from Texas A&M, and a Master of Engineering from George Washington University. He writes The Technology Blind Spot on the intersection of emerging technology and law. Connect with him on LinkedIn at www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social.

References

1. Girardi v. Emotiv Inc., Corte Suprema de Chile [Supreme Court of Chile], Rol 105.065-2023 (Aug. 9, 2023) (Chile).

2. José M. Muñoz et al., Effects of the First Successful Lawsuit Against a Consumer Neurotechnology Company for Violating Brain Data Privacy, 42 Nat. Biotech. 1015 (2024).

3. Neurorights Found., Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies (Apr. 2024), https://www.neurorightsfoundation.org/research/reports.

4. Act of Apr. 17, 2024, ch. 68, 2024 Colo. Sess. Laws 222 (codified at Colo. Rev. Stat. § 6-1-1303(2.5), (16.7), (24)(d)).

5. S.B. 1223, 2023–2024 Reg. Sess., ch. 887, 2024 Cal. Stat. (codified at Cal. Civ. Code § 1798.140).

6. Cal. Civ. Code § 1798.145(a) (West 2025).

7. Act of May 18, 2026, No. 101, 2026 Vt. Acts & Resolves (H.814).

8. Cooley LLP, Your Brain, Their Rules: The Growing Patchwork of Neural Data Regulation, JDSupra (Feb. 25, 2026), https://www.jdsupra.com/legalnews/your-brain-their-rules-the-growing-9411663/.

9. Cooley LLP, From Maple to Mind Taps: New Vermont Law Puts Neurotech on Notice (June 23, 2026), https://www.cooley.com/news/insight/2026/2026-06-23-from-maple-to-mind-taps-new-vermont-law-puts-neurotech-on-notice.

10. Vermont Signs H.814 into Law, Becoming the Fifth US State with a Neural Rights Statute, Inside BCI (May 21, 2026), https://insidebci.com/policy/2026-05-21-vermont-h814-signed-fifth-state-neural-rights/.

11. Husband Sentenced to 65 Years in Fitbit Murder Case, AP News (Aug. 18, 2022), https://apnews.com/article/shootings-597c5b876c1f7de77fcde24621ec5e94.

12. Jurors in ‘Fitbit Murder’ Trial Convict Man of Killing Wife, AP News (May 10, 2022), https://apnews.com/article/fitbit-murder-trial-2260e9a2daed6a18709fee16ba46487d.

13. Fisher v. United States, 425 U.S. 391 (1976).

14. Carpenter v. United States, 585 U.S. 296 (2018).

15. Olmstead v. United States, 277 U.S. 438, 474 (1928) (Brandeis, J., dissenting).

16. Model Rules of Pro. Conduct r. 1.1 cmt. 8, r. 1.6(c) (Am. Bar Ass’n 2024).

17. 45 C.F.R. § 160.103 (2024) (defining HIPAA covered entities).

18. Ley No. 21.383, Oct. 25, 2021, Diario Oficial (Chile) (amending Chile Const. art. 19, no. 1 to protect brain activity).