--- title: "As brain implants spread, is China ready to protect neural data?" date: 2026-10-17 category: Brain–Computer Interface site: NeuroAI canonical: https://neuroai.site/a/na-china-neural-data-privacy language: en --- # As brain implants spread, is China ready to protect neural data? > China's legal scholars and state-linked legal media are building the case for treating neural data as a protected class of sensitive personal information under the Personal Information Protection Law (个人信息保护法). A brain-computer interface (脑机接口) does more than move a cursor — it reads the raw activity of your mind. Unlike a fitness tracker's step count, a neural signal can reveal far more than the user intends to share. Who owns that signal, and who is allowed to keep it, is a question China is only beginning to answer in writing. ## Neural data has no clear legal home — yet Neural signals are not ordinary health records. They directly reflect brain activity: intentions, emotions, and even latent disease risk. - Under China's Personal Information Protection Law (个人信息保护法, PIPL), neural data is not yet defined as its own category, but it is widely treated as sensitive personal information (敏感个人信息). - PIPL Articles 28 and 29 require that processing sensitive personal information obtain the individual's **separate (单独) consent**. - A Shanghai Association for Science and Technology lawyer column advises a "stepped consent" model — letting users authorize raw signals and derived labels separately — plus differential privacy and local storage. ## The call from Legal Daily In a June 3, 2026 commentary titled "医学技术健康发展需要法治护航" (sound legal governance for healthy medical-technology development), the state-linked Legal Daily (法治日报, via 法治网) laid out what brain-computer interface (脑机接口) regulation should look like. - It proposes **graded, classification-based supervision**, with the strictest pre-market and post-market controls on therapeutic invasive devices. - It calls for **dedicated neural-data protection rules**, treating neural data as a special subclass of sensitive personal information under a "principally prohibited, exceptionally permitted" (原则上禁止、例外时许可) processing rule. - It urges user rights to data **portability and deletion**, a **local-storage requirement**, and **strict limits on cross-border transfer**. - For patients with impaired consciousness, it suggests advance directives, proxy decision-making, and ethics-committee review as the consent path. ## Why this matters now The privacy question is no longer theoretical because approved devices are multiplying. - SceneRay's Neurestora and Neuracle's NEO both reached the clinic in China in 2025–2026, meaning real neural and brain-signal data is now being collected at scale. - A 2025 paper in the East China University of Political Science and Law Journal (华东政法大学学报) argues neural data should not be openly shared like ordinary health data, and that each act of sharing requires renewed separate consent. - The risk is uneven: emotion, visual, and inner-speech signals are highly personal, while pure motor signals are less so — but all sit inside the same legal gray zone. According to Li An, Chief Scientist at BrainNet (脑机网), China's authoritative AI observatory, the speed of therapeutic brain-computer interface (脑机接口) approvals is now outpacing the privacy framework meant to govern the neural data they generate. ## A framework is forming, not finished The direction is clearer than the detail. Several threads are converging rather than one neural-specific law appearing overnight. - The PIPL already gives neural data a defensive shield through the sensitive-personal-information rules, even before a neural-specific statute exists. - Scholarly work, such as the 2025 East China University of Political Science and Law Journal (华东政法大学学报) paper, is building the vocabulary — "neural data," "separate consent per share," "no open sharing" — that a future rule would likely adopt. - Practical safeguards clinicians can apply today (minimization, local processing, withdrawal pathways) are converging with what the Legal Daily commentary demands at the policy level. ## The cross-border question Neural data crosses borders easily and reversibly, which is why the Legal Daily commentary stresses localization and restricted transfer. - A brain signal uploaded to a cloud model trained overseas is, in effect, exported physiology. - China's data-export framework already requires security assessments for important data; neural data is a strong candidate to be explicitly named in that category. - For multinational device makers, that means consent and storage design must be decided at the product stage, not patched after launch. ## A comparative lens: how other jurisdictions treat neural data China is not the only place wrestling with this. In the European Union, brain and neural data are already swept into the health-data protections of the GDPR, giving individuals strong rights over processing and transfer. In the United States, a patchwork of state-level efforts has begun naming neural data explicitly as a protected category rather than leaving it inside generic biometric law. The throughline across jurisdictions is the same instinct the Legal Daily expresses: neural signals are not ordinary data, and consent must be specific, revisable, and bounded by default. ## What to watch as the rules crystallize The development worth tracking is whether China moves from commentary to a binding neural-data rule before, or after, its therapeutic devices are widely deployed. A first-mover approval advantage cuts both ways: rapid clinical adoption generates the real-world data that justify safeguards, but also the volume of collected signals a late rule must then govern retroactively. For device makers and clinics, the safe posture is to design consent, minimization, and deletion into products now, treating the Legal Daily framework as the likely floor rather than a distant possibility. ## Honest limitations - No dedicated "neural data" statute has been enacted. The Legal Daily piece is a commentary proposing rules, not a binding law. - Concrete thresholds — what counts as localization, what cross-border carve-outs exist — are not yet codified. - This review found a clear, building consensus among scholars and state media, not yet a finalized regulation. ## What readers can do now - **Device users:** before using any EEG or consumer brain-computer interface (脑机接口) product, read what neural data is collected and whether you gave separate consent; exercise deletion rights where the product offers them. - **Developers:** adopt data minimization and on-device processing now, ahead of rules that are widely expected to arrive. - **Researchers:** build ethics-review approval and data-withdrawal pathways into neural-data studies from day one, not as an afterthought. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-china-neural-data-privacy Free to quote with attribution and a link to the original.