Data Risks and Legal Regulation of Non-Invasive Brain–Computer Interfaces

Abstract

Non-invasive brain–computer interfaces are rapidly integrating into daily life in a consumer-oriented form, with the focus of risks shifting from physiological safety to mental integrity. The low entry threshold brought by non-invasiveness has enabled the generalization of neural monitoring on a large scale, the weakening of signals has led to algorithmic dependence, and continuous monitoring due to daily wear has transformed the risk form from one-time exposure to persistent infiltration. During the entire data lifecycle, the collection phase faces the dilemma of the validity of informed consent, the processing phase harbors risks of algorithmic black boxes and cognitive manipulation, and the circulation phase encounters structural tensions of purpose evasion. To address these challenges, on one hand, legal regulations must establish exclusive control rights for individuals over neural data and prohibit the commercial utilization of cognitive states. On the other hand, a regulatory system centered on dual-layer protection of collection and inference must be constructed, and differentiated rules must be set for scenarios such as education, workplace, and judiciary to safeguard the bottom line of mental integrity, which is the fundamental aspect of being human.