Muse Sleep Band Repurposes 50,000 Hours of User EEG Data for AI Training Without Consent

What happened

Interaxon collected EEG data from Muse headband users, stripped direct identifiers, and fed roughly 50,000 hours of recordings into a machine‑learning model without notifying users. After media inquiries, the company updated its privacy policy to disclose the practice.

Why it matters for trust and compliance

• The incident tests an organization’s consent‑management and privacy‑by‑design controls, showing why explicit user notice and opt‑out mechanisms are essential for audit readiness.
• Map consent‑management controls to your framework of record and collect evidence of policy disclosures.
• Use continuous monitoring to verify that data‑use logs align with documented consent and privacy‑impact assessments.

Who is affected

Recommended actions

1. Perform a privacy‑impact assessment that includes secondary AI‑training uses.
2. Update privacy notices to explicitly state all data‑reuse purposes and provide opt‑out mechanisms.
3. Implement technical de‑identification safeguards (e.g., differential privacy) and retain audit logs.