A researcher fits a volunteer with a cap of sensors. The machine begins to read not just movement, but intention, emotion, and the quiet architecture of thought.
For decades, the law treated that signal as just another medical measurement, no different from a heartbeat or a blood count. That assumption is now being rewritten.
In the middle of 2025, China's Ministry of Science and Technology published a guideline that names a new category of risk: the privacy of the mind itself.
Key takeaways
- The science ministry issued neurotechnology research ethics guidelines on 23 July 2025 (MOST).
- The guideline builds on a February 2024 brain–computer interface (脑机接口) research ethics guide (MOST).
- The Personal Information Protection Law treats biometric data as sensitive, needing separate consent (PIPL Art. 28).
- A 2023 trial review measure lists invasive BCI clinical research for expert review (ten departments).
- The July 2025 seven-department BCI opinion sets a data-governance framework (gov.cn).
- Mental privacy, leakage, and the right to correct or delete neural data are named protections (MOST guideline).
Naming the risk
The document is called the Ethical Guidelines for Medical Research on Neurotechnology Involving Humans. It was prepared by the Medical Ethics Subcommittee of the National Science and Technology Ethics Committee and released on 23 July 2025 (Ministry of Science and Technology, via Economic Daily). It applies to neurotechnology that collects or modulates neural signals through physical means — exactly the territory of brain–computer interface (脑机接口) work.
What is new is the vocabulary. The guideline explicitly defends mental privacy (心智隐私), the information a person's thoughts and feelings carry without being shown to the outside world. It warns against any use that could leak, abuse, or access such data without informed consent, and it gives research participants the right to access, correct, and delete their own neural data (MOST guideline).
The guideline does not stand alone. It points researchers to the World Health Organization's ethics work on health artificial intelligence and to an earlier, February 2024 document focused specifically on brain–computer interface research (MOST; Shanghai Jiao Tong University ethics office).
What the law already covers
China did not start from zero. Several existing laws already wrap neural data in protection:
- The Personal Information Protection Law (2021) treats biometric information as sensitive; Article 28 requires a specific purpose, strict necessity, and the individual's separate consent (legal text, cited in medical-ethics scholarship).
- The Data Security Law imposes whole-process data-security management and protection of important data.
- The Trial Measures for Science and Technology Ethics Review (2023) list invasive brain–computer interface clinical research for treating neurological and psychiatric disease among activities needing expert review (ten departments).
- The February 2024 brain–computer interface research guideline places invasive approaches on a high-risk ethics-review list and bars enhancement uses that fuel addiction or distort fair competition (MOST).
Neuroethics scholars note that regulators are exploring graded and classified management of neural data to match its sensitivity (medical-ethics journal, 2025).
From research lab to product
The policy push reached industry language later the same month. On 23 July 2025, seven departments — including the Ministry of Industry and Information Technology, the National Health Commission, and the National Medical Products Administration — issued the Implementation Opinions on Promoting Innovative Development of the Brain–Computer Interface Industry. The text calls for a data-governance framework, rules on collecting and storing user information, and stronger protection against "brain privacy" leakage and biological-digital security risks (gov.cn).
That linkage is the practical point. Research ethics tell scientists what they may do; the industry opinion tells companies what they must build. Together they push neural-data handling from a researcher's good intention toward an auditable obligation.
Why this is harder than it looks
Defining mental privacy is easier than measuring it. A neural signal is not a tidy file; it is a continuous, reconstructable stream that can reveal far more than the wearer intends. Consent forms rarely explain what a decoder might infer months later, when the same data is reused for a different model.
There is also a tension with the clinical promise. Doctors want rich, longitudinal neural records to restore movement or speech. Regulators want minimal, sealed, de-identified data. The guideline lands on "prudent and responsible" as the governing stance, but it is guidance, not a binding statute. Enforcement will depend on hospitals, companies, and local ethics boards translating principles into procedure.
The honest framing is that China is building the scaffolding before the building is full. The documents establish that neural data deserves special protection; they do not yet specify audit cadence, breach penalties, or cross-border transfer limits for brain data specifically.
Honest limitations
The July 2025 neurotechnology guideline is advisory reference material for research institutions, not a binding law. Specific penalties and audit rules for neural-data breaches are not detailed in the documents reviewed. Figures about data sensitivity and patient rights come from official guidelines and secondary legal scholarship rather than a single statute. Cross-border transfer limits for brain data specifically remain undefined in the sources checked.
What readers can do now
- Researchers: write data-minimization and deletion clauses into study protocols now, since the guideline already names them as expected practice.
- Operators: treat neural data as sensitive personal information requiring separate consent, even where local rules are still vague.
- Investors: score BCI ventures on data-governance maturity; regulatory expectation is moving from optional to expected.