The UK Information Commissioner’s Office (ICO) has published a report on a citizens’ jury about neurotechnology and neurodata. The findings will inform the ICO’s upcoming guidance on how data protection law applies to devices that record or send electrical signals to the brain and nervous system. The sector is growing fast: the UK has 54 dedicated neurotech companies with nearly £120 million in turnover and more than £200 million in investment.
How the jury worked
Nesta’s Centre for Collective Intelligence brought together 20 UK residents for three online sessions over two weeks in March 2026. Jurors watched specialist videos, heard from experts and discussed how to get the benefits of neurotech while managing the risks. The findings are qualitative and are not meant to represent wider public opinion.
Key findings
Jurors were broadly supportive of medical, wellbeing and workplace-safety uses, such as devices that help manage pain or track driver fatigue. They strongly opposed using neurodata to monitor employee focus or student productivity. Their main concerns were discrimination, since a “normal” range of brain activity could penalise older people, neurodiverse people and others, and the power imbalance that makes opting out difficult in practice.
The jury set four regulatory priorities:
- restrictions on collecting data from vulnerable groups, including children, elderly people and people with mental illness or disability;
- restrictions on using neurodata for targeted advertising and automated decisions on access to services such as insurance;
- stricter standards for devices that send signals to the brain and for any neurotech making clinical claims, including medical-grade testing;
- a new legal category for neurodata, because it captures subconscious thoughts and intentions, and current rules do not automatically give it the same protection as other special category data.
Jurors expect companies to replace passive opt-out models and dense terms with clear opt-in consent, and to build in privacy by design, including local data storage and traceability. They also stressed technical accuracy, as flawed neurodata could lead to serious outcomes such as unfair dismissal. They did not call for a blanket ban. Instead, they favoured a high bar for approval, outright limits on some uses and case-by-case assessment of others.
What organisations should do
Even companies outside the neurotech sector may be affected by these findings and the coming guidance. Freeths LLP suggests:
- reviewing consent mechanisms so they are clear, accessible and cover both primary and secondary uses;
- auditing secondary uses of neurodata, especially advertising, profiling and automated decision-making;
- taking particular care in workplace and education settings, where proportionality and a genuine ability to opt out are hard to show;
- preparing for a possible separate neurodata category by checking how data governance and privacy notices would need to change;
- building data minimisation, local storage and traceability into product design from the start;
- following the ICO’s neurotech guidance, which is on its way.
What comes next
The ICO plans to keep engaging with industry, hold a workshop on consent, harmful design and secondary data use, and publish formal guidance. Until then, organisations have a window to review their processes and get ready for a more demanding regulatory environment.