Neural Data Privacy Regulation: What Laws Exist and What Is Anticipated?

Introduction

Legislators at both the federal and state levels are taking steps to regulate the collection, use, and disclosure of neural data. In 2024, Colorado and California enacted the first U.S. state privacy laws governing neural data, and at least six other states are following suit in an attempt to increase privacy protections applicable to the use of neurotechnology.

Neurotechnology encompasses a broad range of devices that track brainwaves, including medical devices, consumer products (including some wearable devices, virtual reality systems, and even some smartphone applications), and invasive devices. Such technology has shown promising benefits, such as treating paralysis and predicting seizures. However, lawmakers have expressed concern regarding data misuse and even “brain-control weaponry” on the extreme end. The actions legislators and regulators take based on these concerns will have a significant impact on a variety of different types of companies that collect neural data, including Elon Musk’s NeuraLink, Blackrock Neurotech, Neurable, and Neurode.

Key Privacy Concerns

Concerns about neurotechnology and its regulation have developed almost as quickly as the technology itself. The Neurorights Foundation released a report in April 2024, highlighting gaps in consumer neurotechnology device companies’ privacy practices. The report found that nearly every company reviewed appeared “to have access to the consumer’s neural data and provide no meaningful limitations to this access.”

State and federal lawmakers have similarly raised concerns about data misuse associated with neurotechnology. In April 2025, several U.S. Senators urged the U.S. Federal Trade Commission (FTC) to take action to protect American’s neural data from “potential exploitation or sale, as brain-computer interface (BCI) technologies rapidly advance.” The Senators noted that “unlike other personal data, neural data — captured directly from the human brain — can reveal mental health conditions, emotional states, and cognitive patterns, even when anonymized.” The FTC could potentially use its authority to discipline unfair and deceptive practices to address these concerns, but it has not responded to the letter or otherwise expressed its intent in this regard.

Currently, most U.S. federal and state privacy laws provide minimal protection for neural data. For example, the Health Insurance Portability and Accountability Act (HIPAA), while expansive in defining “health” information, protects neural data only to the extent that it is received or created by HIPAA “covered entities,” i.e., health plans, certain health care providers, “health care clearinghouses”; or business associates of covered entities. Similarly, although many state consumer privacy laws apply to “sensitive personal information,” neural data is not clearly included in the state law definitions of that term.

As California and Colorado have determined, privacy legislation specific to neural data or amendments to existing privacy law may be critical to protect individuals from misuses of neural data. But those two states have not approached their regulation of neural data in quite the same way, and the proposals of other states indicate that, absent federal legislation (which Congress is highly unlikely to pass in the near future), the laws governing neural data will develop inconsistently across the states. Determining how to plan for compliance may therefore be an ongoing challenge.

California and Colorado Enactments

As noted, California and Colorado are currently the only states with enacted neural data-focused laws. Colorado was the first state to explicitly extend privacy rights to neural data by expanding the definition of “sensitive data” in the state’s existing consumer privacy law, Colo. Rev. Stat. Ann. § 6-1-1303, to include “neural data.” Under the Colorado law, regulated entities must obtain consent before collecting or processing “sensitive data,” so such consent is now required to obtain, use, or disclose neural data; and other protections for “sensitive data” apply as well. Similarly, the California legislature amended the California Consumer Privacy Act (CCPA) to expressly include neural data in the definition of “sensitive personal information,” thereby granting consumers special rights with respect to their neural data.

California and Colorado’s definitions and treatment of “neural data,” however, are not uniform. Colorado’s law defines “neural data” as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems and that can be processed by or with the assistance of a device.” The CCPA, in contrast, defines “neural data” to exclude any data that is inferred from nonneural information — which means that behavioral and physiological data that could be used to infer a mental state is not “sensitive personal information” under the CCPA. For example, wearable devices that capture heart rate, which is data from the circulatory system, not the central or peripheral nervous system, would not be “sensitive personal information” under the CCPA (even though that data could be used to reveal stress levels), while electrical activity data from consumer neurotechnologies (devices that directly capture data from the brain) would.

There is also asymmetry between California and Colorado’s requirements for obtaining consent to process neural (and other sensitive personal) data. Colorado’s law requires regulated businesses to obtain opt-in consent to collect and use neural data. In comparison, the CCPA only affords consumers a limited right to opt out of the use and disclosure of their neural data, and then only if the use or disclosure is for purposes other than to provide goods or services requested by the consumer. Conversely, the CCPA has a broader reach in defining “consumer” to include employees and individuals acting in a business-to-business context, whereas the Colorado law defines “consumer” to exclude employees and business representatives.

Proposed State Measures — Highlights

In addition to amending the CCPA to address neural data specifically, the California legislature is considering a bill that would require a covered business to use neural data only for the purpose for which the neural data was collected and to delete neural data when the purpose for which the neural data was collected is accomplished. The bill would define a “covered business” to mean a person or entity that makes available a brain-computer interface to a person in the state and “brain-computer interface” to mean a system that allows direct communication and control between a person’s brain and an external device.

The other states in which neural data privacy legislation is pending include Connecticut, Illinois, Massachusetts, Minnesota, Montana, and Vermont. Those states’ proposals vary in scope and substance, as indicated briefly below.

Connecticut’s bill would amend the state’s privacy law to include neural data as a type of sensitive data. The definition of “neural data” is broader than Colorado’s definition — it is not limited to data used for identification purposes. Connecticut’s bill would require an opt-in consent before processing neural data and data impact assessments for each processing activity.

Illinois’ bill would amend the Illinois Biometric Information Privacy Act to include neural data as a “biometric identifier,” requiring entities to provide individuals with notice regarding how neural data is collected and stored, and obtain express written consent before such collection.

In Massachusetts, a state without a comprehensive consumer privacy law, legislators have proposed the Neural Data Privacy Protection Act, which, like the amended CCPA, would provide protections for neural data but omit from such protection information inferred from non-neural data. Under the Massachusetts bill, covered entities would be prohibited from (1) collecting or processing neural data unless it is strictly necessary to provide or maintain a product or service, (2) transferring neural data to a third party without consent or other limited exceptions, or (3) processing neural data for targeted advertising.

Minnesota’s proposal is a standalone bill providing separate protections for neural data and mental privacy, and would apply to both private and governmental entities. The bill would prohibit governmental entities from collected data transcribed from brain activity without informed consent and would prohibit companies from using a brain-computer interface to bypass conscious decision-making by an individual.

Montana’s bill would extend existing genetic information privacy safeguards to neurotechnology data and would give state residents more control over their neural data.

Vermont’s bill aims to prohibit brain-computer interfaces from bypassing conscious decision-making without consent.

Proactive Data Governance

Given the inconsistency in scope and substantive requirements among the newly enacted and proposed neural data privacy laws, entities that deal with neural data face something of a moving target in seeking to design their products and activities to comply with such laws. Applying fundamental privacy protection principles and considering comparative regulatory approaches to other types of personal information, such as genetic information and biometric information, may serve as helpful elements of a neural data privacy protection framework.

A basic data governance protocol should include a model and roadmap that aligns with a company’s mission and tolerance for risk. A process for monitoring compliance with the company’s model against requirements and best practices should be implemented. Finally, internal policies should explain how neural data is collected, stored, shared, and secured. This policy should be regularly reviewed against any newly enacted laws to ensure continued compliance.

Companies should also keep in mind that, because privacy laws directed toward neural data are in their infancy and there are likely to be more coming, they could very well play a role in shaping the direction of these laws through direct lobbying or participating in trade associations devoted to lobbying.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.