Momentum Builds for State Legislation on Neural Data Privacy

STATE NET®  THOUGHT LEADERSHIP SERIES

State lawmakers are beginning to regulate what could become one of the most sensitive categories of personal data—information derived from brain and nervous system activity.

A study by the Neurorights Foundation found that 97% of consumer neurotechnology companies surveyed had access to users’ neural data with no meaningful limitations on use or sale. For privacy professionals and policymakers, that statistic is alarming because, unlike your fingerprint or your face, neural data can provide insights into cognitive states, such as attention, stress, or sleep patterns. And while consumer neurotechnology devices currently available can’t read your thoughts, the data they collect may enable more detailed inferences as technologies advance. 

“Although current devices gather relatively basic information like sleep states, advocates for brain data protection caution that future technologies, including artificial intelligence, could extract more personal and sensitive information about people’s medical conditions or innermost thoughts,” reported KFF Health News.

The legislative response at the individual state level has been picking up steam, according to the State Net® Capitol Journal™. Colorado and California both enacted neural data measures in 2024, and Montana and Connecticut followed in 2025. These four states now have neural data privacy protections on the books, with at least 15 additional state bills pending. What was a fringe policy discussion two years ago has become a sudden priority for lawmakers and therefore a practical compliance reality for corporate teams.

Legislative Wave Builds Momentum

Colorado HB 1058 became the nation’s first consumer privacy law protecting neural data, when it was signed in April 2024. The bill passed with bipartisan support and near-unanimous votes in both chambers, a rare outcome in today’s polarized political environment. Since that landmark act:

• California enacted SB 1223, amending the California Consumer Privacy Act to include neural data under the “sensitive personal information” category;
• Connecticut enacted SB 1295, which takes effect July 1, 2026;
• Montana joined the wave with SB 163, amending its Genetic Information Privacy Act. But the state took the distinct approach of prohibiting the storage of neural data in foreign adversary countries.

At least seven other states considered neural data bills in 2025, including Alabama, Illinois, Massachusetts, Minnesota and Vermont. Illinois’ proposal is particularly
notable: it would add neural data to the Biometric Information Privacy Act—the nation’s most litigated privacy statute—creating significant new exposure for
any company processing brain data from Illinois residents.

Colorado State Sen. Cathy Kipp, who sponsored the first-in-the-nation law, points out that the concern behind these legislative measures is future-oriented. “If you collect the data today,” she said, “what can you read from it five years from now because the technology is advancing so quickly?”

Why Neural Data is Different

The urgency around neural data privacy stems from what makes it distinct from other biometric information. A fingerprint can be used to identify who you are; neural
data can be used to infer your cognitive or physiological state—such as your level of attention or stress—sometimes without your active input.

In fact, the International Association of Privacy Professionals reported that 60% of companies do not provide consumers with information about how their neural data is managed or what rights they have concerning it, and more than 50% have policies including provisions that explicitly permit data sharing.

The Future of Privacy Forum has described this as the “Goldilocks Problem”: defining neural data too broadly might capture trivial information, while defining it too narrowly could miss information that reveals sensitive mental states through indirect means.

Download the latest State Net Capitol Journal thought leadership article to learn more.