A brain–computer interface (脑机接口) does not just read a heart rate. At its edge it can read intention, attention, even the traces of inner speech. That is not a password you can reset. It is you.
As Chinese hospitals begin implanting and wearing these devices, the question of who owns that signal — and who may keep it — has moved from philosophy seminar to regulatory text.
The law already calls it sensitive
Under China's Personal Information Protection Law (个人信息保护法, PIPL), biometric information is classified as sensitive personal information. Neural data — the electrical patterns of a person's brain — is treated as a form of biometric data, which means it sits in the most protected category.
That triggers specific duties. Article 29 requires separate consent to process sensitive information. Article 19 limits retention to the shortest period necessary. Article 15 lets a person withdraw consent at any time. Article 47 obliges the handler to delete the data. And Article 69 shifts the burden of proof to the handler if harm occurs. In plain terms: a BCI maker cannot quietly hoard your neural signals, cannot bury permission in a 40-page terms-of-service, and must erase them on request.
A dedicated neurotech ethics guideline
On 23 July 2025, the Ministry of Science and Technology (科技部) published the Ethics Guidelines for Medical Research Involving Human Neurotechnology (《涉及人的神经技术医学研究伦理指引》). Drafted by the national science-ethics committee's medical sub-committee, it sets out seven concrete requirements for neurotechnology research.
Its privacy language is unusually direct. It tells researchers to guard against leakage, abuse and unauthorized access to a person's "mental privacy" (心智隐私), and it affirms that participants hold rights to access, correct and delete their mental data. The guideline explicitly pairs neurotechnology with artificial intelligence, pointing researchers to the WHO's guidance on AI in health and to existing BCI research-ethics rules.
The industrial policy backs it up
On the same day, 23 July 2025, the Ministry of Industry and Information Technology (工信部) and six other departments — including the National Health Commission, the Chinese Academy of Sciences and the NMPA (国家药监局) — issued the Opinions on Promoting Innovative Development of the Brain–Computer Interface Industry (《关于推动脑机接口产业创新发展的实施意见》, document No. 工信部联科〔2025〕164号).
The document sets 2027 and 2030 milestones for the sector and, alongside technical goals, stresses informed consent, data security and protection of vulnerable groups. It is the first systemic national-level BCI policy paper, and it puts governance next to engineering rather than after it.
Why "mental privacy" is different
A fingerprint tells you identity. A face tells you who. Neural data can, in principle, hint at what someone is thinking or feeling — which is why specialists describe it as more intrusive than a biometric lock. The guideline's careful wording reflects a real fear: that decoding tools, married to large models (大模型), could turn private cognition into extractable data.
The practical safeguards are becoming clear: keep neural data on the device where possible rather than shipping it to the cloud; collect only what a function requires; state a retention deadline; and let the user pull the plug. Those are the lines regulators are drawing before the market scales.
The immediate risk is not the implant in a hospital but the headband on a child. Consumer "focus-training" devices already read scalp signals from minors, and neural data from a developing brain is among the most sensitive information imaginable. The guideline's emphasis on separate consent and deletion matters most precisely where the user cannot give informed consent themselves.
What readers can do now
- Before using any neural app or headset, check what neural data it collects and where it sends it; decline "broad" permissions.
- Ask hospitals and device makers about data retention and deletion in writing, not just in a privacy policy.
- Support transparency: the guideline gives you rights of access and correction — use them when a device handles your neural signals.
Why neural-data rules are arriving now
The law is catching up to the device, not leading it. Headsets and clinical BCIs already collect signals that, stitched together, can reveal attention, emotion, and even intent — data far more intimate than a fingerprint. Treating neural data as sensitive personal information, with separate consent and a right to deletion, is the baseline that keeps a fast-moving consumer market from normalizing surveillance of the mind. China's move is notable because it pairs a research ethic guideline with an industrial policy push for the same neurotech sector — encouraging the technology while trying to pre-empt its worst misuse. For readers, the practical lesson is to treat any product that reads your brain signals as handling information that deserves the strongest privacy settings you can enforce.
Honest limitations
This article is based on the published PIPL text and on state-media and official summaries of the 23 July 2025 MOST guideline and the MIIT-led实施意见 (document 工信部联科〔2025〕164号), available via gov.cn. The PIPL article references and their interpretation follow legal commentary from Chinese human-rights and law scholars, not a single binding judicial ruling on neural data specifically. The guideline is advisory for research institutions, not a finalized statute with enforcement penalties, and its "mental privacy" protections will be tested as products reach market. Conversions and "sensitive" classifications reflect current legal framing and could evolve through forthcoming standards.