1. Meaning 

Cognitive Surveillance Liability refers to the legal responsibility that may arise when a government authority, employer, technology company, educational institution, or other entity monitors, infers, records, predicts, or manipulates aspects of a person's mental life in a manner that violates legal rights or causes legally recognizable harm.

The term is best understood as an emerging legal framework, rather than a universally recognized, independent cause of action. Liability generally arises under existing doctrines of privacy, data protection, constitutional law, employment law, consumer protection, tort law, and human-rights law.

Cognitive surveillance may involve monitoring or inferring:

Mental states: attention, stress, emotional responses, fatigue, or cognitive workload.

Thought-related information: opinions, beliefs, intentions, preferences, and inferred political or personal attitudes.

Neural information: brain signals collected through EEG headsets, brain–computer interfaces, or other neurotechnology.

Behavioural and biometric information: eye movements, facial expressions, voice patterns, typing behaviour, and physiological signals used to infer mental states.

Predictive cognitive profiles: assessments of an individual's future behaviour, reliability, susceptibility, or decision-making tendencies.

Not every form of observation is unlawful. The legal question is whether the monitoring has a valid legal basis, serves a legitimate purpose, is proportionate, protects sensitive information, and respects the rights of the affected individual.

2. Essential elements of liability

A claim involving cognitive surveillance can be analysed through the following elements.

1. Surveillance or cognitive inference

The defendant collects, processes, or derives information about mental states, neural activity, attention, emotions, or thought-related behaviour.

2. Legal duty or protected right

A duty may arise from constitutional guarantees, data-protection legislation, confidentiality, contract, workplace obligations, or a duty of reasonable care.

3. Breach or unlawful conduct

Examples include covert monitoring without adequate authority, excessive collection, unauthorised disclosure, discriminatory profiling, or an unjustified intrusion into private mental life.

4. Harm and causation

Depending on the cause of action, the claimant may need to establish mental distress, reputational injury, financial loss, discrimination, loss of autonomy, or another legally recognised injury. Some privacy or constitutional claims may be available without proving conventional financial loss.

5. Remedy and accountability

Depending on the legal regime, relief may include an injunction, deletion or correction of data, compensation, constitutional relief, regulatory penalties, or restrictions on further processing.

These elements are analytical rather than a single statutory test. Their exact requirements vary by jurisdiction and type of claim.

3. Major case laws on cognitive surveillance liability

The following decisions provide important legal principles for evaluating cognitive surveillance. Some concern privacy and autonomy directly, while others concern digital or workplace surveillance and are relevant by analogy.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts: A nine-judge bench considered whether the Indian Constitution protects a fundamental right to privacy, in litigation arising from challenges to the Aadhaar identification scheme.

Judgment: The Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms in Part III of the Constitution. The judgments connected privacy with dignity, autonomy, personal choice, and the ability to preserve a private space for thought.

Indian Kanoon+1

Relevance to cognitive surveillance liability:

State surveillance that intrudes into mental privacy may engage Article 21.

Monitoring may affect freedom of thought and personal autonomy even when no physical search occurs.

Intrusive surveillance must satisfy the applicable constitutional requirements of legality, legitimate state purpose, and proportionality.

The State also has positive obligations to protect privacy against certain forms of interference.

Legal significance: This is the strongest Indian constitutional foundation for arguments against unjustified cognitive surveillance. It does not, however, establish a separate tort called cognitive surveillance liability.

Case 2: Bărbulescu v. Romania (2017)

European Court of Human Rights, Grand Chamber · Application No. 61496/08

Facts: An employer monitored an employee's electronic communications and used the material in disciplinary proceedings.

Judgment: The Grand Chamber found a violation of Article 8 of the European Convention on Human Rights because the domestic courts had not adequately protected the employee's privacy and correspondence. The assessment required attention to advance notice, the extent of monitoring, the reasons for it, and the availability of less intrusive measures.

HUDOC+1

Relevance:

Employers cannot assume that workplace equipment eliminates all privacy rights.

A general monitoring policy does not automatically justify unrestricted access to private communications.

Transparency, necessity, proportionality, and safeguards are important.

The same reasoning may be relevant where employers use attention-tracking software, emotional-inference tools, or cognitive performance profiles.

Legal significance: A leading authority on workplace surveillance safeguards. It does not specifically decide the legality of neural monitoring.

Case 3: Carpenter v. United States (2018)

Supreme Court of the United States · 585 U.S. 296

Facts: Law enforcement obtained historical cell-site location records from wireless carriers, revealing extensive information about the defendant's movements.

Judgment: The Court held that obtaining the historical records at issue constituted a Fourth Amendment search and generally required a warrant supported by probable cause. It emphasised the unusually revealing nature of comprehensive digital location records.

LII / Legal Information Institute+1

Relevance:

Information collected for ordinary technical purposes can reveal intimate patterns of an individual's life.

Aggregated data can create a detailed profile that isolated observations would not disclose.

A surveillance system should be assessed by what it reveals in practice, not only by the type of sensor it uses.

Legal significance: Although the case concerns location information rather than thoughts, it provides a useful analogy for systems that infer beliefs, attention, emotional conditions, or likely decisions from extensive behavioural data.

Case 4: López Ribalda and Others v. Spain (2019)

European Court of Human Rights, Grand Chamber · Applications Nos. 1874/13 and 8567/13

Facts: Employees challenged covert video surveillance installed by their employer in a supermarket following suspected thefts.

Judgment: The Grand Chamber did not find a violation of Article 8 on the particular facts. Its analysis stressed the circumstances justifying the surveillance, its scope and duration, the location monitored, and the safeguards against misuse. The case is not blanket authorisation for covert monitoring.

HUDOC+1

Relevance:

The decision supports a contextual assessment of surveillance. For example, a narrowly targeted security investigation may be treated differently from continuous monitoring of every worker's emotional reactions and cognitive performance.

Legal significance: The law may distinguish between justified, limited surveillance and indiscriminate monitoring. Whether a similar balance permits cognitive surveillance depends on the applicable jurisdiction and facts.

4. Additional Indian constitutional and statutory principles

A. Constitutional rights

The most relevant constitutional provisions include:

Article 14: Protection against arbitrary state action and legally impermissible discrimination.

Article 19: Applicable freedoms, including speech and expression, where surveillance chills or interferes with protected activity.

Article 21: Life, personal liberty, dignity, privacy, and autonomy.

A constitutional claim generally requires an appropriate connection to state action. Conduct by a private company may instead require reliance on statutory protections, contractual duties, tort principles, or other applicable laws, although constitutional values can influence the interpretation of those laws.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 provides a statutory framework for digital personal data processing. Its provisions address grounds for processing, notice, consent, specified legitimate uses, security-related obligations, individual rights, grievance redressal, and regulatory enforcement.

India Code+1

For cognitive surveillance, the key questions include:

Does the system process digital personal data relating to an identifiable individual?

Is the processing covered by the Act, and what lawful basis applies?

Are applicable notice and consent requirements satisfied, or does a statutory permitted use apply?

Are the relevant security, retention, and accountability obligations being met?

Can the individual exercise applicable rights or seek grievance redressal?

Important qualification: The Act does not expressly create a standalone category of “cognitive surveillance liability.” Its applicability and available remedies depend on the relevant provisions, commencement notifications, rules, exemptions, and facts. The Act's enactment date alone does not mean every provision applies from that date.

As of 2 November 2026, the DPDP Act is subject to phased commencement. The notification dated 13 November 2025 schedules sections 3–17 and several other provisions for commencement 18 months after publication, in May 2027. Therefore, it would be inaccurate to treat all substantive duties and individual remedies as already operative.

eGazette+1

5. Types of cognitive surveillance that may create liability

The same technology can produce different legal outcomes depending on its purpose, the data collected, the people affected, and the safeguards employed.

6. Who can be held liable?

Government authorities: They may face constitutional scrutiny where surveillance lacks lawful authority or violates fundamental rights.

Employers: They may incur liability for disproportionate employee monitoring, unlawful use of collected information, discriminatory decisions, or breaches of applicable employment and privacy obligations.

Technology developers and service providers: Liability may arise where a provider violates a statutory duty, misuses information, breaches a contract, or negligently causes legally recognised harm. Responsibility depends on the provider's actual role and applicable law.

Data controllers or fiduciaries: Organisations determining the purposes and means of covered personal-data processing may have statutory responsibilities under the relevant data-protection regime.

Third parties: A party that obtains, discloses, or exploits surveillance data unlawfully may also face liability, depending on the facts and the governing law.

7. Defences and limits on liability

A defendant may argue that the monitoring:

Was authorised by applicable law.

Pursued a legitimate and sufficiently specific objective.

Was necessary and proportionate to that objective.

Used transparent procedures or satisfied a valid exception to notice or consent requirements.

Employed appropriate security measures and access controls.

Did not cause the injury alleged, or that the applicable legal requirements for the claim were not established.

These are not universal defences. Consent, for example, does not necessarily cure a constitutional violation or make an otherwise unlawful or disproportionate practice legitimate.

8. Remedies for cognitive surveillance

Depending on the jurisdiction and claim, potential remedies include:

Injunctions preventing or limiting unlawful surveillance.

Correction, restriction, or deletion of personal information where legally available.

Compensation for proven loss or other legally recognised injury.

Constitutional remedies against unlawful state action.

Regulatory investigation and statutory penalties.

Employment remedies, including challenges to disciplinary action where supported by law.

A claimant should preserve relevant notices, consent records, policies, technical reports, communications, decision records, and evidence connecting the surveillance to the alleged harm.

9. Hypothetical illustration

Suppose a company requires employees to wear EEG headsets that measure neural activity and infer attention levels. It secretly retains the data, creates profiles of employees deemed insufficiently attentive, and dismisses workers on the basis of those profiles.

The legal analysis would ask:

Was collecting neural data lawful and appropriately disclosed?

Was the monitoring necessary for a legitimate workplace objective?

Were the inferences reliable, and could employees challenge them?

Did the employer use the profiles in a discriminatory or arbitrary manner?

Did the company violate applicable privacy, employment, contractual, or data-protection duties?

Can the affected workers establish a basis for compensation or other relief?

Under the principles in Puttaswamy and Bărbulescu, such a system would warrant close scrutiny. However, neither judgment directly establishes that all EEG-based workplace monitoring is unlawful.

10. Conclusion

Cognitive Surveillance Liability is a useful emerging legal concept for analysing the consequences of monitoring mental states, neural activity, attention, and inferred beliefs. Its principal foundations are privacy, dignity, autonomy, data protection, employment law, and protection against arbitrary or discriminatory decisions.

In India, Justice K.S. Puttaswamy v. Union of India provides the central constitutional foundation. Bărbulescu v. Romania, Carpenter v. United States, and López Ribalda v. Spain offer comparative guidance on workplace and digital surveillance, subject to their different legal systems.

The central legal principle is that technological ability to infer a person's mental state does not, by itself, establish a legal entitlement to collect or exploit that information. Liability must ultimately be determined under the applicable law and the particular facts.

This is a general legal explanation for research and study, not a case-specific legal opinion.