Consumer neurotechnology is booming. You can buy a funky-looking headband for $500 on the internet if you want your own personal EEG to track your brain data. But before you click purchase, you might want to check out the device’s privacy policy.

These consumer devices are unlikely to include any protections or restrictions around how companies can employ or sell a user’s neural data, according to a new report from the Neurorights Foundation, a nonprofit that advocates for the ethical development of neurotechnology.