Research: The Body Layer — Biometric, Genetic, and Molecular Control

July 2, 2026

Body-layer programs deployed or piloted 2022–2026, sourced to peer-reviewed papers, SEC filings, government documents, court records, clinical-trial registry IDs, and established trade press. Where a topic is contested, both the program AND its documented limit are surfaced. Every adverse characterization is attributed to a named regulator, court, filing, or outlet — none is asserted as our own accusation. This is the “look at the receipts, not the speculation” spine of The Vein.

Companion pages carry the deeper cuts: brain-signal law on The Electrode and the Feed; identity-tied money on CBDC; enrollment programs on Digital ID; the collection layer on Biometric Collection and Facial Recognition; and the health leg on Healthcare Data Surveillance and Health Surveillance.

1. Biometric ID Programs

See also: Biometric Collection — The Control-Grid Component and Digital ID.

India — Aadhaar (UIDAI). 1.4 billion enrolled as of 2024, the world’s largest biometric ID system (fingerprints, iris, facial photo against a 12-digit number). Authentication-failure rates: 49% in Jharkhand, 37% in Rajasthan per Right to Food Campaign field surveys. The Supreme Court of India’s 4:1 ruling of 2018-09-26 (Puttaswamy v. Union of India) upheld Aadhaar but struck down mandatory bank/SIM linking and Section 33(2) (UIDAI — full SC judgment PDF; Supreme Court Observer summary; NPR — field reporting on starvation deaths).

United States — REAL ID Act, enforcement effective 2025-05-07. TSA began refusing non-REAL-ID state IDs at airport checkpoints on this date. Per DHS, as of April 2025 roughly 81% of travelers were already presenting REAL-ID-compliant IDs at TSA checkpoints (DHS — REAL ID; TSA — enforcement statement; GAO-22-104432 — oversight report on REAL ID implementation).

EU — eIDAS 2.0 / European Digital Identity Wallet. Regulation (EU) 2024/1183, in force 2024-05-20. Every Member State must offer a wallet by 2026-12; all relying parties must accept by 2027-11. The Article 45 (Qualified Website Authentication Certificates) provision drew a 400+ signatory letter from Mozilla, EFF, and academic cryptographers warning that browser trust over government-issued CAs could enable state-level MITM (EUR-Lex — regulation text; Mozilla/EFF — joint letter PDF; EFF — analysis).

Worldcoin / Tools for Humanity — World ID via “Orb” iris hashing. Per company disclosures, ~10 million unique humans verified by 2024 and ~26 million as of early 2026 (company-reported, not independently audited — do not present as verified). The Kenya High Court ordered deletion of iris/facial data from approximately 350,000 Kenyans and a permanent enrollment ban (Petition E254 of 2023). The program has been banned or suspended in Spain (AEPD, March 2024), Portugal (CNPD), Hong Kong (PCPD), Brazil (ANPD, January 2025), Indonesia, and Kenya. These are regulatory and judicial actions, not our characterization of wrongdoing (Worldcoin Foundation — transparency stats; ICLG — Kenya High Court ruling summary; AEPD — Spain ban order; ANPD — Brazil order).

TSA PreCheck biometric option (facial matching) + CLEAR Plus. TSA began rolling out facial matching at PreCheck lanes via CAT-2 (Credential Authentication Technology 2) kiosks, deployed at 200+ airports by 2024. CLEAR Plus claims over 25 million members per company SEC filings (Alclear Holdings parent; Class A common stock disclosures). Senator Markey, Senator Merkley, and others sent multiple letters demanding TSA disclose audit data on false-match rates (TSA — CAT-2 / digital ID fact sheet; Senator Markey — letter to TSA, February 2024; SEC EDGAR — Alclear Holdings (CLEAR) filings).

IATA OneID. IATA Resolution 791 mandates contactless biometric travel by 2025. Pilots run with Air France-KLM, Cathay Pacific, British Airways, Lufthansa, and Qantas; ~50+ airports were running components by 2024 (IATA — OneID program page; IATA — press release on biometric trials).

Mobile Driver’s Licenses (mDL) under ISO/IEC 18013-5. As of 2026-Q1, mDL is live or piloted in 18 US states (Arizona, Colorado, Maryland, Georgia, Iowa, Utah, and others). Apple Wallet mDL is accepted at TSA in 12 states; Google Wallet support is expanding. Per CNBC’s 2021 review of the contracts, Apple’s deals with state DMVs require the state to “pay for the privilege of integrating with the wallet” and to market it — attributed to CNBC’s reading of the contract text, not our characterization of Apple’s intent (AAMVA — mDL Implementation Guidelines; CNBC — contract analysis; ISO/IEC 18013-5:2021 — standard page).

United Kingdom — Online Safety Act “Highly Effective Age Assurance.” Enforcement 2025-07-25. Permitted methods: government-issued ID, biometric facial age estimation, credit card, digital identity wallet. ProtonVPN reported a 1,400% surge in UK sign-ups in the 24 hours after enforcement (company-reported, not independently audited) (Ofcom — enforcement guidance; ITIF — policy analysis, September 2025).

World Bank ID4D / “Identification for Development.” Funded by the Bill & Melinda Gates Foundation, UK FCDO, France, NORAD, and Omidyar Network. Per World Bank reporting, ID4D programs operate in 60+ countries; the World Bank’s 2021 ID4D Annual Report estimates 850 million people remain without official ID (World Bank — ID4D portal; World Bank — ID4D Annual Report 2021 PDF).

United States — Department of State biometric exit, expansion of facial comparison. CBP’s Traveler Verification Service ran facial-comparison checks on over 200 million travelers at exit as of fiscal year 2024 per CBP. DHS OIG-20-71 (2020) documented earlier rates and integration issues (CBP — biometrics page; DHS — OIG-20-71).

2. CBDC + Biometric Tie-in

See also: CBDC and Digital Payments — The Control-Grid Component.

China — Digital Yuan (e-CNY). Live since 2020 (PBOC). Per People’s Bank of China statements via state media, cumulative e-CNY transactions reached 3.48 billion transactions / 16.7 trillion yuan (~$2.37 trillion USD) by late 2025. e-CNY hard-wallets are linked to identity through tiered KYC; the highest-tier wallet requires full ID and bank-account linkage. A CNAS report (Fanusie & Jin, January 2021) states: “DCEP technical architecture will allow for real-time or near-real-time financial surveillance of all users’ transactions” — a characterization attributed to CNAS (gov.cn — PBOC announcement, English; CNAS — report PDF; Atlantic Council — CBDC Tracker, China).

Nigeria — eNaira. Launched 2021-10-25. An IMF working paper found 98.5% of issued wallets never used, and less than 0.5% adult adoption. At the Cedi @ 60 conference (November 2025), a CBN official publicly acknowledged that retail eNaira had failed and that Nigeria would pivot to wholesale CBDC only — the documented limit of biometric-tied CBDC absent an existing payment-rails advantage (IMF — Working Paper WP/23/226 on eNaira PDF; HRF — CBDC Tracker, Nigeria).

Bahamas — Sand Dollar. The world’s first live retail CBDC (October 2020). Per Central Bank of The Bahamas figures, less than $2 million was in circulation as of 2024 against ~$500 million in physical currency. Wallet onboarding is tiered by KYC: Tier 1 ($500 cap) requires name + government ID number; Tier 2 ($10,000 cap) requires biometric verification (Central Bank of The Bahamas — Sand Dollar page; CBOB — central bank site).

Eastern Caribbean — DCash. The pilot was suspended for two months in January 2022 due to a platform outage. Per ECCB, DCash wallets required photo ID + selfie for verification (mid-tier) and full KYC (high-tier). The 2022 outage is the documented limit case for CBDC operational reliability (ECCB — DCash page; ECCB — statement on suspension).

European Central Bank — Digital Euro. Preparation phase entered 2023-11-01; second preparation phase 2025-11-01 per ECB Governing Council. The legislative file in the European Parliament (COM(2023) 369 final) contemplates “identification of the user” for non-low-value transactions; the ECB disclaims programmability for users, but the legislative framework as drafted permits identity-tied wallet issuance through PSPs (ECB — digital euro page; EUR-Lex — Commission proposal COM(2023) 369 final; ECB — blog, December 2025).

India — Digital Rupee (e₹) retail pilot. RBI’s retail e₹ pilot went live December 2022 and expanded through 2023–2024. The RBI Annual Report 2023-24 disclosed approximately 5 million e₹ users and 16 participating banks. e₹ wallets in major banks (SBI, HDFC, ICICI, Yes Bank) require Aadhaar-linked KYC at onboarding, providing a direct biometric → CBDC bridge (RBI — Annual Report 2023-24 PDF; RBI — Concept Note on CBDC PDF).

United States — Executive Order 14178 (2025-01-23) prohibition. A Trump executive order explicitly prohibits agencies from “establishing, issuing, or promoting CBDCs.” The Anti-CBDC Surveillance State Act passed the House 219-210 in July 2025. This documents the limit/absence: the US has no biometric-tied CBDC pilot active (Federal Register — EO 14178; Congress.gov — H.R. 1919).

BIS Project Aurum / Project mBridge. A BIS Innovation Hub multi-CBDC bridge with PBOC, the Hong Kong Monetary Authority, the Bank of Thailand, and the Central Bank of UAE. mBridge moved to MVP phase in 2024 — cross-border architecture even where individual country pilots stall (BIS — Project mBridge; BIS — Project Aurum).

3. Brain-Computer Interfaces — Commercial State

See also: The Electrode and the Feed, which covers the neurorights law surrounding this hardware.

Neuralink — PRIME Study (N1 implant). FDA Investigational Device Exemption granted May 2023; first human implant January 2024 (patient Noland Arbaugh, named because publicly self-identified). ClinicalTrials.gov registry NCT06429735. Per Neuralink’s own disclosure and Wall Street Journal reporting, “thread retraction” affected ~85% of recorded threads in the first patient, with mitigation via algorithm adjustments — a documented technical/adverse event reported by the company and WSJ, not a claim of misconduct. The registry’s primary endpoint: safety and BCI effectiveness in controlling external devices via decoded neural activity (ClinicalTrials.gov — NCT06429735; Neuralink — PRIME study brochure; WSJ — thread retraction, May 2024).

Synchron — Stentrode. An endovascular BCI delivered via the jugular vein, no craniotomy. FDA IDE granted 2021. Pivotal clinical-trial registry NCT05035823 (COMMAND trial). Backed by Bezos Expeditions, Gates Frontier, and ARCH Venture Partners. First US patient implanted July 2022 at Mount Sinai. Synchron disclosed an Apple Vision Pro integration partnership in 2024 (ClinicalTrials.gov — NCT05035823 (COMMAND); Synchron — website; Nature Biotechnology — coverage).

Blackrock Neurotech — Utah Array / MoveAgain. The Utah array has been implanted in BrainGate trial subjects (NCT00912041) since 2004. As of 2024 disclosures, approximately 40+ humans have been implanted over the program’s life — the longest-running human BCI track record. Tether took a majority stake in 2024 (ClinicalTrials.gov — NCT00912041 (BrainGate); Blackrock Neurotech — corporate page; Tether — announcement, August 2024).

Precision Neuroscience — Layer 7 Cortical Interface. FDA 510(k) clearance granted April 2025 for the Layer 7 electrode array (a “thin-film” cortical array placed sub-durally without penetrating cortex). 510(k) number K243625. First-in-human work conducted at Mount Sinai. Co-founded by Benjamin Rapoport, a Neuralink co-founder who departed (FDA — 510(k) database; Precision Neuroscience — newsroom; Nature — Precision Neuroscience profile, October 2024).

Onward Medical — ARC-BCI. An implantable brain–spine interface restoring volitional movement in spinal-cord-injury patients. Peer-reviewed in Nature (Lorach et al. 2023, “Walking naturally after spinal cord injury using a brain–spine interface”); the first-in-human patient regained walking ability. ClinicalTrials.gov NCT04632290 (Lorach et al., Nature 618, 126–133 (2023); ClinicalTrials.gov — NCT04632290).

BrainGate Consortium. A multi-institutional academic BCI program (Brown, Stanford, Mass General, Emory). Its pivotal speech-decoding paper (Willett et al., Nature 620, 1031–1036, 2023) decoded 62 words per minute from intracortical recordings in an ALS patient — the non-commercial baseline and scientific floor against which commercial BCI claims should be evaluated (Willett et al., Nature (2023); BrainGate — website).

DARPA Next-Generation Nonsurgical Neurotechnology (N3). Six teams funded since 2019 to develop non-invasive or minimally invasive BCI. Performers include Battelle, Carnegie Mellon, Johns Hopkins APL, PARC, Rice, and Teledyne — the military-funded leg of the BCI ecosystem, distinct from the medical-commercial entrants (DARPA — N3 program page; DARPA — press release, May 2019).

FDA Q-Submission / breakthrough device pipeline for BCI. Per FDA Center for Devices and Radiological Health Breakthrough Devices Program annual reports, several BCI devices have been granted breakthrough designation (Synchron 2020; Neuralink IDE 2023; Precision 2024). The breakthrough designation provides expedited review but is not an approval — a common point of misreporting (FDA — Breakthrough Devices Program).

Chile — constitutional protection of “neurorights.” Chile became the first country to constitutionally protect mental privacy. Law 21.383 (October 2021) and a 2023 Chilean Supreme Court ruling in Girardi v. Emotiv ordered the deletion of EEG data collected by US-based Emotiv from a Chilean senator — the legal counter-frontier (BCN — Chile Law 21.383 (Spanish); Yuste & Genser, Frontiers in Human Neuroscience on neurorights, 2024).

4. Genetic Database Programs

23andMe bankruptcy (Chapter 11, 2025-03-24). Approximately 15 million customer genetic profiles entered the bankruptcy estate. California AG Rob Bonta issued an urgent consumer alert advising customers to delete their data prior to any sale. The assets were sold (June 2025) to TTAM Research Institute, a nonprofit created by 23andMe co-founder Anne Wojcicki. These are documented filings, regulator statements, and the bankruptcy record (California AG — urgent consumer alert, 2025-03-21; NEJM — Bankruptcy, Genetic Information, and Privacy (2025); Lawfare — analysis).

23andMe credential-stuffing breach (October 2023). 6.9 million users affected per the company’s SEC filing. A class-action settlement of $30 million plus three years of credit monitoring was preliminarily approved 2024-09 (final approval 2024) (SEC EDGAR — 23andMe filings; Reuters — on settlement).

GEDmatch + forensic genetic genealogy. Joseph James DeAngelo was identified as the Golden State Killer in April 2018 via a GEDmatch upload. As of December 2023, forensic genetic genealogy is documented to have contributed to 651 cases solved / 318 perpetrators identified per a Forensic Magazine compilation citing FBI and DNA Doe Project figures. A peer-reviewed Science paper (Erlich et al., 2018) projected the technique could identify approximately 60% of US individuals of European descent via third-cousin-or-closer matches (Erlich et al., Science 362, 690–694 (2018); Forensic Magazine — case-count compilation).

State-level forensic-genealogy statutory limits. As of 2024, only Maryland (HB 240/SB 187, 2021) and Montana (HB 602, 2021) had explicit statutory restrictions on law-enforcement forensic genealogy. Maryland requires written user consent, mandates sample destruction, and bars covert collection; Montana requires a search warrant. Twelve other states have explicitly permitted the practice via policy or AG guidance (EFF — analysis; Maryland — HB 240 (2021)).

GINA limits — what genetic-discrimination law does NOT cover. The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits health-insurance and employment discrimination based on genetic information. It does NOT cover life, disability, or long-term-care insurance. Multiple US carriers explicitly use genetic test results in life-insurance underwriting per AAMC and JAMA analyses (EEOC — GINA page; Prince & Schmidtke, JAMA Internal Medicine 2019, 179(4):501–502).

Consumer-genetic data in law-enforcement pipelines. A Science 2024 commentary documented the migration of consumer genetic samples into law-enforcement pipelines via “investigative genetic genealogy” outsourced to companies like Othram and Parabon NanoLabs. Othram disclosed over 250 cases as of 2024 per company press releases (Murphy & Tong, Science 384, 38–40 (2024); Othram — news page).

All of Us Research Program (NIH). Over 800,000 participants enrolled by 2024 per NIH program reporting; over 480,000 with whole-genome sequence data returned per a Nature 2024 cohort paper. Government-run, distinct from consumer-product genetic databases (All of Us — program statistics; The All of Us Research Program Genomics Investigators, Nature 627, 340–346 (2024)).

UK Biobank. Approximately 500,000 enrollees with whole-exome and now whole-genome sequencing released to ~30,000 approved researchers globally per UK Biobank data-access dashboards. The whole-genome dataset was released November 2023 (UK Biobank — data showcase; Halldorsson et al., Nature 607, 732–740 (2022) on whole-genome release).

China — direct-to-consumer and state genomics. BGI Group (Beijing Genomics Institute)’s prenatal NIFTY test was reviewed by Reuters in 2021, which found that genetic and health data from non-Chinese pregnancies could be transferred to mainland servers — attributed to Reuters’ investigation. The US Department of Defense added BGI subsidiaries to the Chinese Military Company List (June 2024), a published government designation (Reuters — investigation, July 2021; Federal Register — DoD CMC list).

23andMe US national-security review. Senator Warner and Senator Grassley wrote to HHS and DOJ urging review of the 23andMe asset sale under national-security grounds in March 2025. CFIUS has authority under FIRRMA 2018 to review foreign acquisitions of “sensitive personal data,” including genomic data (Senator Warner — press releases; eCFR — Treasury CFIUS sensitive personal data regulations, 31 CFR § 800.241).

5. mRNA / Programmable Molecular Platforms

Every claim in this section is sourced to peer-reviewed literature (The Lancet, Nature, NEJM, Molecular Therapy, Vaccines, Nature Reviews Materials), FDA/regulatory records, SEC filings, or company disclosures. Documented platform limits are cited to the primary literature and filings as adverse-event and efficacy findings, not as claims of concealment or misconduct. This section is confined to what platform capability is programmable per the record; it advances no safety/efficacy claim beyond what the cited sources state, and asserts no intent. The IP-dispute references are docketed litigation.

Moderna platform — mRNA-1273 (COVID-19), mRNA-1010 (flu), mRNA-1647 (CMV), mRNA-4157 (cancer). Moderna’s pipeline as disclosed in its 10-K filings demonstrates the same lipid-nanoparticle delivery and modified-nucleoside mRNA platform encoding different antigens. mRNA-4157 (with Merck’s KEYTRUDA) is an individualized neoantigen therapy: patient tumor sequenced, neoantigens predicted, mRNA encoding up to 34 neoantigens manufactured per patient. KEYNOTE-942 Phase 2b results published in The Lancet 2024 showed reduced melanoma recurrence vs. KEYTRUDA alone (Weber et al., The Lancet 403, 632–644 (2024); SEC EDGAR — Moderna filings).

BioNTech individualized cancer vaccines (BNT122 / autogene cevumeran). Rojas et al., Nature 618, 144–150 (2023), reported pancreatic cancer Phase 1 data: 8 of 16 patients generated neoantigen-specific T-cell responses, with delayed recurrence in responders — confirming platform-level programmability in peer review (Rojas et al., Nature 618, 144–150 (2023); SEC EDGAR — BioNTech filings).

Self-amplifying mRNA (saRNA) — ARCT-154 / Kostaive. Gritstone bio and Arcturus Therapeutics. Kostaive (zapomeran) was approved in Japan (November 2023, by Meiji Seika Pharma / Arcturus) — the world’s first regulatory approval of a self-amplifying mRNA vaccine. The saRNA platform encodes its own RNA-dependent RNA polymerase, replicating once inside the cell (SEC EDGAR — Arcturus filings; Pollock et al., eClinicalMedicine 44, 101262 (2022) on saRNA Phase 1).

mRNA-based gene editing — Verve Therapeutics VERVE-101. An in vivo CRISPR base-editing therapy for hypercholesterolemia delivered as mRNA in a lipid nanoparticle (encoding an adenine base editor + guide RNA targeting PCSK9). First-in-human dosed 2022; Phase 1b heart-1 trial results presented at AHA 2023. The cardiac SAE in the high-dose cohort drove the company to deprioritize VERVE-101 in favor of VERVE-102 — both the platform capability and a documented adverse-event limit (SEC EDGAR — Verve Therapeutics filings (CIK 0001840574); ClinicalTrials.gov — NCT05398029).

Intellia NTLA-2001 (in vivo CRISPR for transthyretin amyloidosis). Gillmore et al., New England Journal of Medicine 385, 493–502 (2021), the first-in-human in vivo CRISPR delivered as mRNA/LNP encoding Cas9 + guide RNA — demonstrating mRNA + LNP as a programmable gene-editing delivery vehicle, not only an antigen vehicle (Gillmore et al., NEJM 385, 493–502 (2021); SEC EDGAR — Intellia filings).

CureVac / GSK mRNA influenza. Hoffmann et al., Nature Communications 14, 4577 (2023), preclinical data; the CureVac–GSK partnership for mRNA flu and COVID combinations is disclosed in CureVac 20-F filings. CureVac’s CVnCoV failed efficacy in Phase 3 (June 2021), an instructive limit on the platform absent modified nucleosides (Kremsner et al., The Lancet Infectious Diseases 22, 329–340 (2022) on CVnCoV; SEC EDGAR — CureVac 20-F (CIK 0001809122)).

DARPA ADEPT and HHS BARDA mRNA platform contracts. DARPA’s ADEPT-PROTECT (2013) and subsequent BARDA contracts with Moderna (April 2020, $483M for mRNA-1273 development; subsequent contracts totaling $4.95 billion) document direct US government partnership in scaling the platform (BARDA / medicalcountermeasures.gov — contract announcement, April 2020; DARPA — ADEPT program page).

Sarepta / Arrowhead / Alnylam — RNA therapeutics broadly. Alnylam’s siRNA platform is approved in five drugs as of 2024 (patisiran, givosiran, lumasiran, inclisiran, vutrisiran), demonstrating programmable knockdown of any liver-expressed gene via GalNAc conjugation. Inclisiran (Leqvio), a twice-yearly cholesterol therapeutic, is now widely prescribed (SEC EDGAR — Alnylam filings; FDA — Leqvio prescribing information).

Lipid nanoparticle platform — Acuitas / Genevant. Hou et al., Nature Reviews Materials 6, 1078–1094 (2021), catalogues lipid-nanoparticle compositions. Acuitas LNP is licensed to Pfizer/BioNTech and CureVac; Genevant LNP is licensed to Arbutus. Patent disputes (Moderna v. Pfizer, Alnylam v. Pfizer/Moderna, Arbutus v. Moderna) document the platform’s IP architecture and its delivery-vehicle generality (Hou et al., Nat Rev Mater 6, 1078–1094 (2021); CourtListener — Alnylam v. Moderna, D. Del. 1:22-cv-00335).

Documented platform-limit findings. Buschmann et al., Vaccines 9, 65 (2021), a peer-reviewed review of LNP biodistribution, shows the LNP itself, not only the encoded antigen, is immunostimulatory — relevant to reactogenicity. Bahl et al., Molecular Therapy 25, 1316–1327 (2017), gives early mRNA-platform pharmacokinetics from Moderna (Buschmann et al., Vaccines 9, 65 (2021); Bahl et al., Molecular Therapy 25, 1316–1327 (2017)).

6. Continuous Monitoring

See also: Health Surveillance — The Control-Grid Component and Healthcare Data Surveillance.

Dexcom Stelo (FDA cleared 2024-03-05). The first over-the-counter continuous glucose monitor cleared in the US, intended for adults not on insulin. 510(k) clearance DEN230081. Commercial launch August 2024 at $99/month direct-to-consumer (FDA — press release on clearance; SEC EDGAR — Dexcom filings (CIK 0001093557)).

Abbott Lingo / Libre Rio. Abbott’s Lingo OTC CGM was cleared for non-diabetic “metabolic health” consumers (UK launch 2024; US launch September 2024 as Libre Rio for non-insulin users). Abbott’s Q4 2024 earnings disclosed 6+ million FreeStyle Libre users worldwide (Abbott — Lingo press release; SEC EDGAR — Abbott filings).

Oura Ring + research partnerships. Per company disclosures, over 2.5 million Oura Rings were sold by 2024. A DoD partnership: a $63 million Defense Threat Reduction Agency contract (2021, expanded 2023) to integrate Oura biometrics into illness-prediction algorithms for service members, with the NBA Bubble (2020) as a precedent (DoD — contract announcement, May 2021; Oura — corporate press).

Apple Watch — atrial-fibrillation and ECG features. The Apple Heart Study (Stanford, NEJM 2019, Perez et al., 381:1909–1917) enrolled 419,297 participants. The Apple Watch ECG was cleared as an FDA Class II device (510(k) DEN180044, 2018) (Perez et al., NEJM 381, 1909–1917 (2019); FDA — DEN180044 summary).

Fitbit / Google — employer wellness programs. Fitbit Health Solutions (acquired by Google January 2021) markets to employer wellness programs. A documented prior employer-wellness incident: the West Virginia teacher walkout (February 2018) included objections to a Go365 / Humana app that fined employees up to $500 for failing to log enough activity — attributed to Vox’s coverage of the labor action, not our characterization of the program (Vox — West Virginia teachers walkout coverage; EEOC — wellness program guidance).

Whoop — performance biometric subscription. Series F at a $3.6 billion valuation (August 2021). Partnerships with the PGA Tour and NFLPA for athlete biometrics. Whoop strain/recovery scores have entered employer pilots per the company’s blog and trade press, though not yet at the scale of CGM (Whoop — corporate press; Fortune — coverage of Series F).

Levels Health — non-diabetic CGM-as-a-service. Levels launched 2019 and raised a $38M Series A in 2022 at a $300M valuation. It required a prescription via a tele-health provider until OTC CGMs arrived; Levels itself is a commercial deployment (Forbes — profile of Levels Series A; Levels Health — corporate page).

Bossware / continuous workplace monitoring. An illustrative bridge to non-physiological wearable monitoring. An NYT analysis (August 2022) found that 8 of the 10 largest private US employers tracked worker productivity metrics by software, including activity scores. Amazon’s “Time Off Task” (TOT) system is tied to algorithmic warnings and terminations per company filings and NLRB cases — attributed to NYT reporting and an NLRB proceeding, not our accusation (Kantor & Sundaram, NYT, 14 August 2022; NLRB — complaint against Amazon on TOT, 2022).

EU AI Act prohibitions and the limit case. The EU AI Act (Regulation 2024/1689, in force 2024-08-01) explicitly prohibits “emotion recognition” in workplaces and educational institutions (Article 5(1)(f)) — directly relevant to the wearable-continuous-monitoring → emotion-inference pipeline (EUR-Lex — Regulation (EU) 2024/1689; European Commission — AI Act page).

Insurance underwriting use of wearable data — John Hancock Vitality. John Hancock (a subsidiary of Manulife) requires all new individual life-insurance policies sold under its Vitality program to include activity tracking via Fitbit/Apple Watch as a condition for premium discounts, since September 2018 — attributed to Reuters’ coverage and the company’s own program page, not our characterization (Reuters — announcement coverage, September 2018; John Hancock — Vitality program page).

Cross-cutting Documented Limits and Counter-Programs

Where a body-layer program advances, these are the documented counter-receipts.

GDPR Article 9 prohibits processing of biometric/genetic/health data without explicit consent or narrow exceptions. The EU’s first major Worldcoin enforcement (Spain AEPD ban, Portugal CNPD order, Germany BayLDA action) all cite Article 9 (EUR-Lex — GDPR Article 9).

Illinois BIPA (740 ILCS 14/) has produced settlements over $1B against Facebook ($650M, 2021), TikTok ($92M, 2021), Snap ($35M, 2022), Clearview AI ($51.75M consent decree, 2022), and Google ($100M, 2022) — the most consequential biometric civil-liability regime in the US. These are settled or entered legal outcomes under the Illinois Biometric Information Privacy Act; a settlement is not an admission of guilt (Illinois General Assembly — 740 ILCS 14 statute text).

Vermont Genetic Privacy Act (Act 76, 2023) requires explicit opt-in for genetic data use and re-use (Vermont General Assembly — Act 76 (2023)).

Chile neurorights law and the Girardi v. Emotiv ruling (Chilean Supreme Court 2023) ordered deletion of EEG data and recognized “mental privacy” as a constitutional right (BCN — Chile Law 21.383 (Spanish)). See The Electrode and the Feed for the full neurorights context.

Privacy Act of 1974, Section 552a(e)(7) prevents US federal agencies from maintaining records on First Amendment activity absent express statutory authority — periodically cited in challenges to fusion-center watchlist programs (DOJ — Privacy Act of 1974 overview).

2026 KOSA / KOSPA reauthorization fights in the US Senate are the live legislative venue where biometric age-assurance for minors is being debated (Congress.gov — Kids Online Safety Act (S.1409, 118th)).

The bottom line

Across all six body layers — biometric ID, identity-tied CBDC, brain-computer interfaces, genetic databases, programmable molecular platforms, and continuous physiological monitoring — the deployments, contracts, counts, filings, and trial registrations are documented in primary sources, and each advancing program is matched here by its own documented limit: Aadhaar’s authentication-failure rates and the Puttaswamy ruling; Worldcoin’s national bans and the Kenya deletion order; the Nigeria/Bahamas/DCash adoption and reliability failures; the Verve and CureVac clinical setbacks; GINA’s exclusions and BIPA’s billion-dollar settlements.

The evidentiary record supports the structural claim — that a biometric or molecular primary key, once issued, becomes the substrate other control-grid layers ride on — without requiring any inference of coordinated intent. The pattern is visible in the receipts alone. Every adverse characterization above is attributed to a named regulator, court, filing, or outlet; none is asserted as an accusation of our own.

Get updates on the Evil Robots series

Newsletter essays on AI escape, deception, and the humans who built them.