2024

Lahtinen, Tuomo; Costin, Andrei; Suarez-Tangil, Guillermo; Yousefnezhad, Narges

The use of BCI and XR-BCI devices is yet to become more widespread among the general population. These devices could pose a significant risk to the users’ privacy, as they enable the revelation of users’ emotions, beliefs, and other potentially highly sensitive details. When this information is obtained, it is possible to both invade users’ privacy as never before as well as monetize data very precisely through neuromarketing. This work presents a review of the privacy and monetization of BCI and XR-BCI. It was discovered that many companies collect a considerable amount of data without knowing or revealing the actual purpose of the collection. This data includes sensitive information about health. One of the future risks is that emotions and generic raw brain-wave data are leaked to advertisers through neuromarketing, which is considered a valuable asset for advertisers, e.g., to reveal a person’s willingness to buy something. We urge the need to evaluate the current privacy policies and terms of service of BCIs and XR-BCIs against existing frameworks such as the General Data Protection Regulation (GDPR).