Foundations Consumer Neuroscience

Consumer Neuroscience Foundations

12 canonical consumer-neuroscience primitives for product, content, interface, and retention design. Each primitive is domain-agnostic and ethically bounded. Primitives 1–8 cover engagement-time neural responses (salience, arousal, bonding, narrative, regulatory orientation, social mirroring, aesthetics, interoception). Primitives 9–12 cover temporal and predictive mechanisms (memory consolidation, reward anticipation, embodied cognition, predictive processing). Primitive #10 (reward anticipation, Berridge "wanting" vs "liking") is intentionally distinct from foundations-behavioral-economics primitive #13 (reinforcement schedules / dopamine prediction-error): that skill covers schedule-of-reinforcement design; this skill covers anticipatory dopamine as a separate design lever — countdown UX, drop reveals, daily-card open, pre-purchase excitement. Primitive #12 (predictive processing & active inference) is the unifying primitive that grounds attention (#1), interoception (#8), and narrative (#4) under one prediction-error-minimization frame: the brain continuously generates predictions; violations of priors incur a prediction-error cost that must be "earned" by the design.

Ethical obligation: every primitive in this skill operates on pre-conscious or sub-deliberative neural systems. The manipulation risk is higher than for behavioral-economics nudges, because users cannot easily introspect on the mechanism. Read the Misuse Boundary subsection in each playbook before applying any technique. The test from Thaler and Sunstein: "Would you be embarrassed if the technique appeared on the front page of a newspaper?" If yes, it is exploitation, not design. The DMCC Act 2024, in force from 6 April 2025, makes online choice architecture and dark patterns directly actionable by the CMA with fines up to 10% of global annual turnover.

When to Apply

Apply consumer-neuroscience when:

• Attention/salience design — first-7-second hook, visual hierarchy, modal vs inline
• Anxiety-driven engagement loops (cosmic, dating, status apps) — needs DMCC ethical audit
• Parasocial / narrative-led conversion (creator content, branded characters)
• Daily-cadence retention with timing-sensitive triggers (consolidation windows, wake-time)
• Trust repair, reciprocity, or oxytocin-bond design in social/community products

Skip and use simpler alternatives when:

• Pure pricing/defaults/anchoring question — foundations-behavioral-economics is sufficient and cheaper
• Audience has no measured anxiety/arousal/attention baseline — neuro framing is decoration, not insight
• B2B SaaS with rational-buyer mode dominant — emotional primitives mostly noise; use behavioral-econ + decision-theory
• The proposed mechanism manipulates without genuine user benefit — fails DMCC Act 2024 ethical gate; do not ship
• Required signals (eye-tracking, GSR, fMRI) aren't available AND no biomarker proxy exists — claim is unfalsifiable
• Causal lift question — use foundations-causal-inference to measure; neuro primitives suggest mechanisms, not effect sizes

Contents

• Quick Reference
• Primitive Index
• Formal Supporting Theory
• Ethical Bounds
• Misuse Boundaries
• Decision Checklist
• Anti-Patterns
• Composition Recipes
• Knowledge Base & Operational Guides
• Workflow
• ASCII Flow
• Navigation
• Related Skills
• Fact-Checking

Quick Reference

Primitive Index

Each primitive has a full playbook: Definition / When to use / Misuse boundary / Inputs / Outputs / Failure modes / Worked example / Sources.

Formal Supporting Theory

Use references/formal-theory-map.md when the task needs source assumptions, ethical boundaries, or a distinction between observed neural response and normative welfare.

Ethical Bounds

The Harm Test

A neural design technique is legitimate if it:

1. Steers users toward experiences or decisions they would endorse on reflection.
2. Can be easily overridden or opted out of.
3. Does not exploit pre-conscious neural mechanisms to act against the user's interests.

The same lever — arousal, oxytocin warmth, reward anticipation — can be legitimate or manipulative depending on whether the underlying offer genuinely serves the user.

Manipulation vs Legitimate Design

UK Regulatory Context (August 2026)

DMCC Act 2024 entered into force 6 April 2025, revoking the CPRs 2008 outright (s.251(1), commenced by SI 2025/272) and succeeding them with ss. 226 (misleading actions), 227 (misleading omissions), and 228 (aggressive practices), plus the Sch. 20 list of banned practices. The successor provisions are redrafted, not a restatement — old CPRs regulation numbers do not map across cleanly, so cite DMCC sections. The CMA has direct civil-enforcement power and can fine up to 10% of global annual turnover without requiring a court order.

Enforcement is now live, not prospective — the first two infringement decisions both concerned online choice architecture rather than advertising content:

• 18 November 2025: CMA opened its first DMCC enforcement actions against 8 firms (drip pricing, default opt-ins, pressure selling) and issued approximately 100 advisory letters across 14 sectors.
• 18 June 2026: second infringement decision — Marks Electrical fined £720,000 (£1.2m reduced 40% for early settlement) and ordered to refund ~£600,000 to ~40,000 customers, for pre-selected extra charges (customers auto-opted into paid recycling and unwrapping services). Conduct covered April–November 2025. This is the clearest signal of the enforcement floor: a mid-size retailer, a single default-opt-in pattern, a seven-figure headline penalty plus consumer redress.

April 2025: CMA published procedural guidance on DMCC enforcement. December 2025: CMA published price transparency guidance under DMCC.

Online Choice Architecture (dark patterns) now directly actionable under DMCC, including:

• Confirm-shaming (manipulative framing on decline options)
• Pre-ticked defaults that benefit the operator at user expense
• Drip pricing (incremental price reveal late in purchase flow)
• False urgency ("Only 2 left!" when stock is unconstrained)
• Forced continuity (auto-renew without prominent disclosure)

Secondary regulatory anchors:

• ASA CAP Code: misleading advertising, fabricated testimonials, manufactured social proof
• DMCC Act 2024 s.228 (aggressive practices — replaced CPRs 2008 Reg. 7, revoked 6 April 2025)
• UK GDPR: biometric and neuro-physiological signal capture (GSR, HRV, eye-tracking, fNIRS) constitutes special-category data in many use cases; requires explicit consent and lawful basis (Article 9)

EU Regulatory Context (August 2026)

For products serving EU users, the EU AI Act is the parallel anchor to DMCC and applies on top of GDPR.

• Article 5 prohibitions in force from 2 February 2025: AI systems that deploy "subliminal techniques beyond a person's consciousness" or "purposefully manipulative or deceptive techniques" causing significant harm are prohibited outright. AI systems that exploit vulnerabilities (age, disability, socio-economic situation) are also prohibited. This directly captures the manipulation column of the table above when AI is in the loop. Unaffected by the 2026 delay below — the prohibitions bind now.
• Emotion-recognition prohibition (workplace and education): AI inference of emotions from facial expression, voice, GSR, HRV, or any biometric stream is prohibited in workplace and education contexts (Article 5). Commercial deployment outside those contexts is not prohibited but is regulated.
• High-risk classification DELAYED to 2 December 2027 (was 2 August 2026): the AI Digital Omnibus was published in the Official Journal 24 July 2026 and entered into force 27 July 2026, deferring standalone Annex III high-risk obligations — which include commercial emotion-recognition and biometric-categorisation systems — by 16 months. Annex I (AI embedded in products under EU product-safety law) moves to 2 August 2028. Providers and deployers must still meet data-governance, transparency, human-oversight, robustness, accuracy, and post-market monitoring requirements, but the compliance deadline is December 2027. Treat this as schedule relief, not repeal: systems in design now will ship into the regime.
• Article 50 transparency obligations remain on the original 2 August 2026 schedule — they were not delayed. Users exposed to emotion-recognition or biometric-categorisation systems must be explicitly informed, now. A four-month grace period (to 2 December 2026) applies only to the Article 50(2) watermarking duty for systems already on the market. This is the live EU obligation for affect-inference products as of August 2026.
• GDPR continues to apply: lawful basis (typically Article 9 explicit consent for biometric data) is a precondition; the AI Act adds requirements on top. GDPR is unaffected by the Omnibus delay and is the binding constraint in the interim.

For UK-only products, DMCC + UK GDPR are sufficient. For EU users or shared-stack products, both regimes apply and the stricter rule binds.

US Regulatory Context (August 2026)

Four states have enacted neural-data-specific privacy laws (Colorado, California, Montana, Connecticut), and nine further bills were introduced across six states in the first six weeks of 2026 alone (Alabama, California, Illinois, New York, Vermont, Virginia). Treat this as a live patchwork, not a settled regime.

Scope caution — these laws are narrower than "any biometric signal." Most define neural data as signals from the nervous system measured directly, and several explicitly exclude the downstream physiological signals this skill most often uses. Montana SB 163 carves out "nonneural information … the downstream physical effects of neural activity, including but not limited to pupil dilation, motor activity, and breathing rate" — which excludes GSR and eye-tracking. California SB 1223 requires neural data be "not inferred from nonneural information," likely excluding facial coding and voice affect. Colorado's definition reaches only data used for identification purposes, excluding most consumer applications. Connecticut has no explicit carve-out, leaving GSR and eye-tracking ambiguous there. Practical consequence: EEG and fNIRS are squarely in scope; GSR, HRV, eye-tracking, facial coding, and voice affect are mostly out of neural-data statutes — but remain covered by general state biometric/sensitive-data law, BIPA-style statutes, and GDPR for EU users. Do not use a neural-data-law exemption as a reason to skip consent; check the general privacy regime instead.

• California SB 1223 (effective 1 January 2025): amends CCPA to classify "neural data" (signals from central or peripheral nervous system, not inferred from nonneural information) as sensitive personal information. Opt-in consent required; right to delete and restrict sharing apply. Primary source
• Colorado HB 24-1058 (effective 7 August 2024): amends Colorado Privacy Act to include "neural data" within "biological data" as sensitive data. First US law to define and protect neural data. Scope limited to data used or intended for identification. Primary source
• Montana SB 163 (effective 1 October 2025): adds neurotechnology data to Montana's Genetic Information Privacy Act. The most extensive of the four: detailed express-consent requirements for collection, marketing and research use, disclosure, transfer, and sale — often requiring separate informed consent per purpose and per third party. Explicitly excludes nonneural downstream signals. If a product captures true neural data from US users, Montana sets the strictest operative bar.
• Connecticut SB 1295 (signed 24 June 2025; effective 1 July 2026): amends CTDPA to add neural data as a sensitive data category; processing requires express consumer consent; selling sensitive data without consent prohibited. Primary source
• Vermont H.814 / Act 101 (signed 18 May 2026; effective 1 July 2026): correction — do not overstate this law. As enacted, H.814 was substantially narrowed in the Senate: it recognises a largely declaratory statement of "neurological rights" (mental privacy, freedom of thought, non-discrimination in neurotechnology), but the consent requirement and private right of action were stripped before passage. Enforcement rests exclusively with the Vermont Attorney General; there is no consent gate for businesses. Its main forward hook is a commissioned study reporting to the next legislative session. Vermont's binding neural-data framework is Vermont S.71 (neural data as sensitive data), effective 1 January 2028 — track that bill, not H.814, for compliance planning. Treat H.814 as a signal of legislative direction, not a live consent gate. Primary source
• UNESCO Recommendation on the Ethics of Neurotechnology (adopted 12 November 2025): first global non-binding framework covering neural data across commercial uses. Non-binding but widely cited in board-level compliance discussions and DPA engagement. Primary source
• US MIND Act 2025 (proposed): would direct FTC to study neuromarketing as a named use case; not yet law but signals federal regulatory attention. Document FTC-readiness posture if product involves neuromarketing explicitly.

Practical implication: any product capturing genuine neural signal (EEG, fNIRS) from US users must run a per-state consent analysis — California CCPA sensitive PI from 1 January 2025, Montana's per-purpose express consent from 1 October 2025, Colorado and Connecticut in parallel. For GSR, HRV, eye-tracking, facial coding, and voice affect, the neural-data statutes mostly do not bite; the governing constraints are general sensitive-data and biometric law plus GDPR Article 9 for EU users. See references/ethics-operational-checklist.md US Neural Data Laws section.

Vulnerable-User Note

CMA enforcement priorities specifically name "aggressive sales practices which take advantage of vulnerability." Wellness, anxiety-relief, and astrology/spiritual audiences are explicitly in scope as vulnerability-risk contexts. EU AI Act Article 5 reinforces this with an outright prohibition on AI systems that exploit vulnerabilities of specific groups (age, disability, socio-economic situation) to materially distort behaviour. Any application in these categories must apply the stricter column of the manipulation table — not the middle ground. Manufactured urgency, oxytocin-proxy warmth without genuine care mechanics, and reward-anticipation loops targeting financially or emotionally vulnerable users are highest-risk under both regimes.

Misuse Boundaries

Check references/patterns-scenarios-traps.md before applying primitives to production user flows.

Decision Checklist

• Attention earned: Is the design earning attention through genuine relevance or novelty, not bottom-up hijacking? → attention & salience (#1)
• Arousal calibration: Is the engagement intensity appropriate for the decision being made? Will the arousal level impair or support the user's goal? → arousal physiology (#2)
• Warmth signals: Are trust and affiliation signals real? Is any warmth mechanic backed by genuine social data? → social bonding (#3)
• Narrative accuracy: If the experience transports users emotionally, is the content accurate? Does immersion serve or obscure the user's interests? → narrative transportation (#4)
• Regulatory orientation: Does the audience skew BIS (prevention) or BAS (approach)? Is the primary message tone matched to the audience's dominant orientation? → approach-avoidance (#5)
• Social proof quality: Are testimonials, reactions, and contagion signals from real users in verified data? → mirror systems (#6)
• Aesthetic-to-delivery ratio: Does visual quality match functional delivery? Is aesthetic reward being used to compensate for a weak product? → neuroaesthetics (#7), reward anticipation (#10)
• Interoceptive framing: Is any body-state or "gut feel" framing based on real signals? Is it used to inform, not to manufacture anxiety? → interoception (#8)
• Consolidation timing: Are push notifications and reminders timed to consolidation windows (evening, post-sleep) rather than maximum interruptibility? → memory consolidation (#9)
• Wanting vs liking balance: Is reward anticipation matched by hedonic payoff? Is the anticipation loop capped to prevent compulsion? → reward anticipation (#10)
• Embodied language: Does copy use body-state metaphors congruent with the product experience? → embodied cognition (#11)
• Prediction-error budget: Does the design surprise users only when it has earned the attentional cost? Are established priors preserved during routine use? → predictive processing (#12)
• Ethical gate: Does each technique pass the harm test? Does it survive DMCC scrutiny for vulnerable-user contexts? → ethical bounds section

Anti-Patterns

Composition Recipes

Recipe 1: Anxiety-Relief Consumer Loop (pre-purchase)

Goal: guide an anxiety-experiencing user through a reassurance journey to a confident purchase decision, without manufacturing or amplifying anxiety.

Stack:

1. Arousal physiology (#2): Detect or assume elevated arousal state (wellness/anxiety audience). Design the entry experience to begin deescalating arousal — calm visual pacing, low-contrast background, short sentence length. Do not spike arousal at entry.
2. Predictive processing (#12): Establish clear product-structure priors immediately. Anxious users have a high prediction-error cost; predictability is reassurance. Consistent layout, no hidden elements.
3. Narrative transportation (#4): Use a "person like me" story (brief, first-person, past-tense) in which anxiety was the starting state and resolution was the outcome. DMN engagement with a self-relevant arc reduces threat appraisal.
4. Social bonding (#3): Introduce real human warmth — a named support person, a real community count, a genuine care statement backed by operational reality (response time, refund policy). Oxytocin half-life ~3–5 min; warmth must be re-encountered across the session, not front-loaded only.
5. Interoception (#8): Close with a body-state check cue ("How do you feel right now?") that invites somatic attention; let the user register their own shift. This is the somatic marker that encodes the product association positively.

Ethical-bound check: The anxiety being relieved must be real. Do not manufacture anxiety (#2 misuse) to then relieve it. DMCC vulnerable-user test must pass: would the CMA say this practice takes advantage of vulnerability?

Fail signal: "felt scammed" or "felt manipulated" qualitative reports; CSAT drop post-purchase; CMA/ASA complaint volume rising.

Inputs: Baseline anxiety trigger (product category, entry surface, referral source); relief mechanism (narrative arc, warmth signal, somatic check-in); time-to-relief target (default: ≤90s from entry to perceived deescalation); audience retention metric (Day-7 and Day-30 re-engagement rate); persona arousal profile (high-BIS prevention-dominant vs. moderate arousal). Rules: Relief must be initiated within 90s of entry trigger — cortisol arousal curves peak and begin recovery in this window; delay beyond 90s risks entrenchment. Avoid intermittent reinforcement schedules in the relief journey (no random resolution timing) — variable-ratio schedules for an anxiety audience create compulsive re-checking, not relief. Ethical gate: relief must address a genuine user need; manufactured anxiety to then relieve it fails the DMCC harm test and the EU AI Act Article 5 prohibition on exploiting vulnerabilities. Outputs: Trigger-to-relief interaction sequence (step-by-step UX flow with timing); measurable anxiety reduction signal (PSS-style 1–5 self-report at session close, target mean shift ≥1 point); ethical pass/fail flag (CMA vulnerable-user test + DMCC harm test result documented before ship).

Recipe 2: Parasocial Reading Bond (purchase)

Goal: generate a genuine reading bond between user and content (horoscope, tarot, interpretive reading) that drives purchase and repeat engagement without deception.

Stack:

1. Narrative transportation (#4): Open with a brief orienting narrative that primes the DMN. The reading itself should use second-person, present-tense framing to maximize self-referential processing in vmPFC.
2. Mirror systems (#6): Include at least one face or depicted emotional state that matches the emotion the user is likely experiencing. FFA activation and MNS simulation generate social presence with a non-present author.
3. Social bonding (#3): "Others who received this reading reported..." — real cohort social framing; affiliative warmth through shared experience, not manufactured intimacy.
4. Embodied cognition (#11): Copy uses body-state metaphors grounded in the product's actual experience ("a weight lifts," "clarity settles in") — not random metaphors.

Ethical-bound check: Content accuracy: predictive or interpretive content must be labeled as such (ASA CAP Code; no false claims of scientific accuracy). Social data must be real. Face imagery must be genuine or clearly illustrative.

Fail signal: Low share rate despite high session time — narrative bond did not activate social-contagion desire; revisit mirror system (#6) and real social proof (#3).

Inputs: Content type (horoscope, tarot, interpretive reading, personalized narrative); audience persona arousal profile (DMN engagement baseline — emotionally primed vs. neutral); social proof artifacts available (verified cohort testimonials, face assets, share-rate data from prior sessions); notification timing options (session-start cue window, post-read follow-up timing). Rules: Second-person present-tense framing required for vmPFC self-referential processing; first-person past-tense for embedded "person like me" social proof arc. Face or emotional-state imagery must match the target resolution emotion (relief, clarity, confidence) — mismatched affect in testimonials suppresses MNS simulation. All cohort framing ("others who received this reading...") must use verified real user data — fabricated social proof is deception under DMCC and ASA CAP Code. Content labeled predictive or interpretive, never factual-scientific. Outputs: Parasocial bond sequence (narrative arc + social proof placement + embodied metaphor copy); share-intent signal (post-session share prompt acceptance rate, target ≥15% of completers); cohort split result (high-DMN engagement vs. baseline by content format tested).

Recipe 3: Daily-Cadence Retention (post-purchase)

Goal: build a voluntary daily engagement habit that the user values, without compulsion design.

Stack:

1. Reward anticipation (#10): Design a daily reveal or unlock that create

…(truncated)