Legislation Regulating Neural Data Picks Up Steam

Last year, after Colorado and California became the first states in the nation to expand privacy protections to include neural data, we said more states could follow suit. This year two more have done so.

In May, Montana Gov. Greg Gianforte (R) signed SB 163 by Sen. Daniel Zolnikov (R) to include neurotechnology data under the protections of the Big Sky Country State’s Genetic Information Privacy Act.

A month later, Connecticut Gov. Ned Lamont (D) signed a similar bill, SB 1295, by the General Law Committee of the Constitution State’s legislature, bringing the total number of states with neural data privacy laws on the books to four.

“These laws, all of which amend existing state privacy laws, signify growing lawmaker interest in regulating what’s being considered a distinct, particularly sensitive kind of data: information about people’s thoughts, feelings, and mental activity,” wrote Jameson Spivack, deputy director for Artificial Intelligence at the Future of Privacy Forum, and FPF intern Chris Victory, in an August blog post. “Created in response to the burgeoning neurotechnology industry, neural data laws in the U.S. seek to extend existing protections for the most sensitive of personal data to the newly-conceived legal category of ‘neural data.’”

At least five other states have considered neural data privacy bills this year: Alabama, Illinois, Massachusetts, Minnesota and Vermont. The Alabama and Vermont legislative sessions have concluded, but the other three continue into next year.

Neural Data Privacy Bills Considered in Seven States

This year lawmakers in at least seven states have considered bills dealing with neural data privacy, according to the LexisNexis® State Net® legislative tracking system. Three of those states have enacted such measures.

‘Urgent Need’ for Neural Data Privacy Regulation

In June the scientific journal EMBO Reports published an article making the case that swift “advances in neurotechnology” were “creating urgent risks for mental privacy.”

“While invasive neurotechnology, such as cortical implants, necessitates neurosurgery and therefore falls under medical regulations, non-invasive neurotechnology, such as EEGs, near-infrared imaging or portable brain scanners, headsets and bracelets, are increasingly entering an essentially unregulated consumer marketplace,” wrote the article’s authors, Łukasz Szoszkiewicz and Rafael Yuste. “These rapid developments harbor the risk that intimate neural data are collected, analyzed and potentially misused. Contemporary legal frameworks offer only limited protection for such uniquely sensitive data, creating an urgent need for targeted safeguards to preserve mental privacy.”

“Neurotechnology is advancing faster than our legal and ethical frameworks can adapt,” the authors concluded.

 A report published in April 2024 by the NeuroRights Foundation highlighted another dimension of the issue. One of the key findings of “Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies”—“the first comprehensive report analyzing the data practices and user rights of consumer neurotechnology products,” according to its executive summary—is that there’s “enormous ambiguity regarding whether companies consider neural data a form of personal data,” with 60% of the companies surveyed providing “no information for consumers about how their neural data is handled and what rights they have in relation to it.”

Bipartisan Support for Issue

The same month that the the NeuroRights Foundation’s report came out, Colorado Gov. Jared Polis (D) signed HB 1058, sponsored by two pairs of Republicans and Democrats—Reps. Cathy Kipp (D), who is now a senator, and Matt Soper (R), and Sens. Mark Baisley (R) and Kevin Priola (D)—establishing the nation’s first neural data privacy protections.

A few months later California legislators passed a pair of bills that included neural data under the California Consumer Privacy Act’s definition of “sensitive personal information”: AB 1008, introduced by Rebecca Bauer-Kahan (D) and SB 1223 by Sen. Josh Becker (D).

This year’s enactment in Connecticut was signed into law by a Democratic governor as well, but Montana’s was introduced and signed by Republicans.

As evidenced by that mix of Rs and Ds following the policymakers’ names, neural data privacy began as a bipartisan issue and continues to be so, at a time when there is little on which the two major parties are able to agree. This could hasten adoption of such bills while other proposals flounder in the culture wars and partisan gridlock.

Industry Criticism of Current Regulatory Efforts

The new neural data privacy laws and proposed legislation have drawn criticism from the neurotech industry. Bloomberg Law reported that neurotech companies have expressed concern that the wide net lawmakers have been casting with their regulation might catch not only “their desired target—largely consumer-facing products—but also” companies in the medical space that already have to comply with the federal Health Insurance Portability and Accountability Act, or HIPAA.

“What does become clear out of what is currently proposed or implemented is that there’s insufficient differentiation of what is under that big umbrella of brain-computer interface,” Florian Solzbacher, co-founder of Blackrock Neurotech, a developer of neural implants, told the publication.

Company leaders also told Bloomberg that “by attempting to future-proof laws for hypothetical use cases, there’s a potential to add compliance burdens to what is ‘already one of the most regulated places on earth.’”

“The compliance costs imposed by a patchwork of privacy laws could limit businesses to certain states or solely to the academic realm,” the company officials said.

Federal Lawmakers Also Eyeing Regulation

At the federal level, a trio of Democratic senators—Maria Cantwell, Chuck Schumer and Ed Markey—have introduced SB 2925, the Management of Individuals’ Neural Data Act of 2025, or MIND Act, which calls for the Federal Trade Commission to study how neural data “should be protected to safeguard privacy, prevent exploitation, and build public trust as neurotechnology rapidly advances.”

“Neural data, such as information about a person’s brain waves or signals from neural implants, is one of the most private categories of personal data,” said Andrew Crawford, senior policy counsel for the Center For Democracy & Technology, in a press release announcing the introduction of the MIND Act in September. “Companies increasingly seek to collect and use this data for a variety of purposes including predicting and influencing human behavior. Yet, other than a few state laws, very few rules and regulations govern such data.”

With the upheaval in Washington under the Trump administration, the prospects for any kind of federal legislation is uncertain, leaving a wide lane for state legislators to continue to step in.

They seem willing to do so, having introduced at least 20 bills referring to “neural data” this year and enacted three of them, although the one signed into law in California (AB 1170)—unlike the neural data privacy bills enacted in Connecticut and Montana—makes only “nonsubstantive changes” to “various provisions” of state law.

State lawmakers have also received powerful support from the American Medical Association, which adopted a resolution this year calling for comprehensive neural data privacy protections, with the explicit goal of influencing state laws.

Given the rare bipartisan support for the issue among state lawmakers as well, more neural data privacy bills are likely on the way.

—By SNCJ Correspondent BRIAN JOSEPH

 Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.