Four US states, Chile and Vermont now name brain data in law. This article compares the texts and traces one consumer EEG headband's data through each to see what protection actually applies.
Neural data privacy laws now exist in a handful of places, yet nobody can say with confidence what they do for the person wearing a meditation headband. Four US states have written brain data into their privacy statutes. Chile put the protection of brain activity into its constitution, and its Supreme Court has ordered a headset maker to delete a user’s recordings. Vermont declared neurological rights in 2026. The open question is whether these texts reach the ordinary data flow of a consumer EEG device, and which of the competing legal designs actually protects anything.
This article sets out what is established, steelmans three rival answers, and then runs one structured thought experiment: a single, generic consumer EEG headband, its data traced step by step, tested against each regime. This is general information, not legal advice.
The question, stated precisely
The question has three parts. First, coverage: does a given statute’s definition of neural data capture what a consumer device collects, including the derived scores an app computes from raw signals? Second, strength: when it does apply, what does the law demand, opt-in consent before processing, or only a right to object afterward? Third, reach: does the company selling the device even fall within the statute’s scope?
Why bother? Consumer neurotechnology is sold online as wellness hardware, so health privacy rules generally do not apply, and the companies’ own terms are thin. A 2024 audit by the Neurorights Foundation (Genser, Damianos and Yuste 2024) reviewed 30 companies selling consumer neurotech and found that 29 appeared to have access to users’ neural data with no meaningful limits. Only 14 explicitly gave users a right to delete; 20 said they might share data with third parties.
Demand is easiest to document in legislatures; searches for this article found no consumer forum thread worth citing. The record shows a steady flow of bills: a Neurorights Foundation legal adviser testified on the subject before a Vermont Senate committee in April 2026 (Collins 2026), and trade coverage counted at least nine states enacting or considering such laws by early 2026 (Issar, Shugrue and Houghtlin 2026). It mirrors the pattern in state AI laws: states first, unevenly, while federal action stalls.
What is established: four state statutes
Colorado went first. HB24-1058, signed on April 17, 2024 and effective that August, amended the Colorado Privacy Act to add a new category, biological data, and placed neural data inside it. Its definition is broad on its face:
“Neural data” means information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems and that can be processed by or with the assistance of a device.
Colorado HB24-1058, § 2, adding C.R.S. § 6-1-1303(16.7) (enrolled text printed in capitals)
The catch sits in the parent definition. Biological data counts as sensitive only when it is data that is
“used or intended to be used, singly or in combination with other personal data, for identification purposes.”
Colorado HB24-1058, § 2, adding C.R.S. § 6-1-1303(2.5)
Future of Privacy Forum analysts note this may leave very little consumer neural data in the sensitive category (Spivack and Victory 2025). A meditation app does not use brainwaves to work out who you are; it already knows, because you logged in.
California followed with SB 1223, signed on September 28, 2024 and in force from January 1, 2025, which adds neural data to the California Consumer Privacy Act’s list of sensitive personal information (Collins 2026). The California definition covers central and peripheral nervous system activity but excludes data “inferred from nonneural information” (Spivack and Victory 2025). Its remedy is weaker than consent: under the CCPA, consumers may limit use of sensitive information, and that heightened treatment attaches when the data is used to infer characteristics about them. Otherwise it is handled like ordinary personal information, with the usual rights to know, delete, correct and opt out of sale or sharing.
Montana went another way in 2025. SB 163, signed May 1 and effective October 1, extended the state’s Genetic Information Privacy Act to “neurotechnology data” (Collins 2026). On paper it is the most demanding of the four: separate express consent for each purpose, a probable-cause warrant or subpoena for government access, limits on disclosure to insurers and employers, and domestic storage unless the consumer agrees otherwise (Mathews 2025). The difficulty is scope. The duties attach to “entities” as the genetic privacy statute already defined them, and FPF suggests that may reach only consumer genetic testing companies.
Connecticut’s SB 1295, signed June 24, 2025, added neural data to sensitive data under the Connecticut Data Privacy Act, with most provisions effective July 1, 2026. It is the only one of the four limited to the central nervous system (Spivack and Victory 2025). Sensitive data in Connecticut requires opt-in consent before processing (Mathews 2025).
Chile: a constitution and a court
Chile is the reference case for the neurorights movement. Law 21.383 amended Article 19, No. 1 of the Constitution so that scientific and technological development must respect physical and psychological integrity, and it directed the legislature to regulate such development with particular attention to brain activity and the information derived from it (Cornejo-Plaza, Cippitani and Pasquino 2024).
The test came through a consumer product. Former senator Guido Girardi Lavín sued Emotiv Inc. over its Insight headset, a wireless EEG device marketed for wellness and productivity rather than therapy. He objected that the terms stored his recordings in Emotiv’s cloud and kept brain data after account closure for research. Emotiv answered that users consented and that research data were anonymised. On August 9, 2023, the Supreme Court sided with Girardi, ordering Emotiv to delete his data and directing the Institute of Public Health and the customs service to ensure the device and its data use complied with the law (Carter 2023). The commentators who analysed the ruling describe its significance plainly:
“This is the first worldwide judgment on “neurodata,” which refers to data obtained using neurotechnologies.”
Cornejo-Plaza, Cippitani and Pasquino, 2024, Frontiers in Psychology
On research reuse, they read the Court as setting a clear condition:
“Specific consent indicating the purpose and aim of the corresponding research is required.”
Cornejo-Plaza, Cippitani and Pasquino, 2024, Frontiers in Psychology
The ruling applied Chile’s existing data protection statute alongside the constitutional text; it did not rest on a free-standing neural data code. That detail matters for the debate below.
Outside the four states: Vermont, Congress, Europe, UNESCO
Vermont’s Act 101 of 2026, signed May 18, 2026, adds a chapter on neurological rights to Title 18. It declares rights to mental and neural data privacy, freedom of thought and protection from unauthorized access to brain activity. Yet the enacted text defines none of its key terms, imposes no consent mechanism, names no covered entity and sets out no enforcement path; it asks an advisory council to propose definitions in a report due January 15, 2027. It is a declaration, for now.
At the federal level, the MIND Act (S. 2925), introduced in September 2025 by Senators Cantwell, Schumer and Markey, would direct the Federal Trade Commission to study how neural data should be protected and recommend a framework (Joseph 2025). It regulates nothing directly. Later secondary coverage reported no further progress, and this article could not confirm any action since (Issar, Shugrue and Houghtlin 2026).
Europe has no neural-specific rule in the GDPR. EEG linked to an account is personal data; whether it is an Article 9 special category, needing explicit consent, depends on whether it counts as health data or identifying biometric data. A focus score is not obviously either. UNESCO’s General Conference adopted a Recommendation on the Ethics of Neurotechnology in November 2025; such instruments set principles meant to influence national law and do not bind companies directly.
Three competing answers
Researchers and advocates disagree about which design protects people. Three positions are worth stating at full strength.
Answer one: existing privacy law, with neural data labelled sensitive, is enough
The four US statutes plug neural data into machinery that already works: access, deletion, sale opt-outs, attorney-general enforcement and, in some states, opt-in consent. Chile’s landmark ruling itself leaned on ordinary data protection law. The evidence against is the coverage gaps. Colorado’s identification clause may exempt most consumer use; Montana’s may miss most companies; California offers only a right to limit, which assumes users act after the fact.
Answer two: neurorights need their own constitutional or human-rights footing
Advocates around the Neurorights Foundation argue that mental privacy and cognitive liberty are distinct goods, too important to rest on easily amended statutes. Chile is the proof of concept; Vermont and UNESCO show the idea spreading. The strongest counterpoint comes from Vermont itself: a list of rights with no definitions and no enforcement changes nothing about what a headband company must do on Monday morning.
Answer three: definitions of neural data aim at the wrong target
The third position, close to FPF’s “Goldilocks” critique, holds that what people fear is inference about mental states, and such inferences can come from heart rate, eye movement or typing rhythm as easily as from EEG. A law keyed to the measurement source will be too narrow (missing nonneural proxies) and, in places, too broad (sweeping in trivial peripheral signals). California’s exclusion of data inferred from nonneural information shows the tension directly. Against this view: inference-based rules are hard to draft, and regulators may need a bright line to enforce anything at all. Philosophical arguments about free will hover nearby, but the legal problem is narrower: what counts as reading a mind.
Thought experiment: one EEG headband, every regime
The analysis below follows a hypothetical but ordinary product. The headband has four dry scalp electrodes, a heart-rate sensor and an accelerometer. It streams to a phone app over Bluetooth, uploads to the vendor’s cloud, computes a “calm score” per session, uses aggregate trends to personalise in-app offers, shares de-identified datasets with an academic partner, and keeps research copies after a user closes the account. The user lives in the jurisdiction being tested, and the company is assumed to meet each statute’s general size thresholds.
The first table summarises the statutes themselves, using only features confirmed in the sources above.
| Regime | In force | Scope of ‘neural’ | Core duty for neural data | Main gap |
|---|---|---|---|---|
| Colorado HB24-1058 | Aug 7, 2024 | Central + peripheral | Sensitive data (opt-in) only if used for identification | Identification clause |
| California SB 1223 | Jan 1, 2025 | Central + peripheral; excludes data inferred from nonneural info | Right to limit use; ordinary CCPA rights | No prior consent |
| Montana SB 163 | Oct 1, 2025 | Neurotechnology data, excludes nonneural signals | Separate express consent per purpose; warrant for government access | May cover only genetic-privacy ‘entities’ |
| Connecticut SB 1295 | July 1, 2026 | Central nervous system only | Sensitive data, opt-in consent | Peripheral signals left out |
| Chile (Const. art. 19 No. 1; Emotiv ruling) | 2021 amendment; ruling Aug 9, 2023 | Brain activity and derived information | Specific consent for research; deletion ordered | Case-by-case litigation |
| Vermont Act 101 | May 18, 2026 | Undefined | Declared rights only | No definitions or enforcement |
| US federal (MIND Act) | Not enacted | n/a | FTC study if passed | No binding rule |
The second table walks the data flow through each regime. Entries are the author’s reading of the statutory text and secondary analysis, not settled interpretation; a question mark marks genuine doubt.
| Step in data flow | Colorado | California | Montana | Connecticut | Chile |
|---|---|---|---|---|---|
| 1. Raw scalp EEG captured and uploaded | Personal data; not sensitive unless used to identify | Sensitive PI | Covered if vendor is an ‘entity’? | Sensitive; opt-in consent | Protected; consent required |
| 2. Heart rate and motion from same band | Arguably not nervous-system activity; ID clause applies anyway | Probably not neural; ordinary personal information | Likely excluded as nonneural | Not neural (CNS only) | Unclear |
| 3. Derived ‘calm score’ | Ordinary personal data | Likely sensitive (generated from neural data); right to limit applies because it infers a trait | Probably covered | Probably sensitive? | Information derived from brain activity: covered |
| 4. Personalised offers from trends | Opt-out of targeted ads | Right to limit; opt-out of sharing | Separate consent needed | Consent covers it only if specific | Specific consent needed |
| 5. De-identified data to research partner | Outside if truly de-identified | Outside if truly de-identified | Separate research consent | Outside if truly de-identified | Specific research consent (Emotiv) |
| 6. Retention after account closure | Deletion right on request | Deletion right on request | Deletion right | Deletion right on request | Deletion ordered in Emotiv |
Three results stand out. Colorado, the pioneer, may give this product the least neural-specific protection, because nothing in the flow uses EEG to identify anyone. Connecticut gives the strongest front-door control, opt-in consent, but only for the EEG channel. And the step most people worry about, research reuse of data after they leave, is governed most clearly by Chile’s court ruling rather than by any US statute, since the American laws treat genuinely de-identified data as outside their scope.
What the exercise shows, and what it does not
Protection for the same device swings from minimal to substantial on two drafting choices: whether a purpose condition gates the sensitive category, and whether the remedy is advance consent or a later objection. The derived scores, which apps actually display and monetise, sit in the least-tested zone of every statute.
It does not show how any regulator or court would rule. No enforcement action under the four US neural provisions turned up in the sources reviewed, so every cell is an interpretation. Real devices vary, and size thresholds, HIPAA and workforce exemptions, and the robustness of de-identification were assumed rather than tested. On that last point the Neurorights Foundation audit found that 17 companies mentioned de-identification but none explained its difficulties for neural signals (Genser, Damianos and Yuste 2024). If neural recordings are re-identifiable, as that report implies they may be, then row five of the table is far less comforting than it looks.
The author’s reading, and what would settle it
What follows is opinion. The current US statutes are better understood as labelling exercises than as protection. They mark neural data as special, which matters for future enforcement and for corporate defaults, but for a typical wellness headband the operative protections are mostly the ones any app user already has. Connecticut’s opt-in rule is the exception, and I expect it, rather than Colorado’s pioneering text, to become the de facto national floor, because companies tend to build one consent flow for the strictest large market. Chile’s model is more potent in principle, yet its real force came from a judge applying ordinary data law to an adhesion contract. And every US deletion right, like the data broker deletion tools covered elsewhere on this site, works only if the user asks.
I also think the third answer is right about the long run: statutes keyed to electrodes will age badly as mental-state inference migrates to earbuds, cameras and keyboards.
Several concrete developments would settle parts of the question:
- A repeat of the 2024 Neurorights Foundation audit using the same 30-company list and criteria. Prediction: the share offering an explicit deletion right rises above the 14 of 30 found in 2024, but the share with meaningful limits on company access to neural data stays below half.
- The first attorney-general action or published guidance under Connecticut’s or California’s neural provisions that addresses a derived score. Prediction: regulators will treat app-computed mental-state scores as neural data, not as ordinary personal data.
- A Colorado amendment or rule removing or narrowing the identification clause for neural data. If none comes by 2028, the clause is functioning as intended rather than as an oversight.
- Peer-reviewed re-identification studies on short consumer-grade EEG recordings. If individuals can be matched across sessions at high accuracy, every regime’s de-identification carve-out needs rethinking.
- Clarification of Montana’s ‘entity’ definition, by amendment or enforcement, showing whether neurotech vendors that do no genetic testing are covered at all.
Common questions
Does HIPAA protect data from my EEG headband?
Usually not. HIPAA covers health plans, most providers and their contractors; a wellness headband bought online generally sits outside that system. Several state neural provisions also exempt HIPAA-covered data.
Which US state gives the strongest neural data protection?
It depends on the measure. Connecticut requires opt-in consent for central nervous system data. Montana’s text is the most detailed, with per-purpose consent and a warrant requirement, but its reach over ordinary neurotech companies is uncertain.
Is a ‘focus’ or ‘calm’ score neural data?
Nobody knows yet. Because the score is computed from neural measurements rather than inferred from nonneural information, California’s definition seems to cover it. No regulator or court has ruled on the point in the sources reviewed for this article.
What did the Chilean Emotiv case decide?
On August 9, 2023, Chile’s Supreme Court ordered Emotiv to delete a user’s stored brain data and asked health and customs authorities to check the Insight device’s compliance. Commentators read it as requiring specific consent for research use of neurodata.
References
- Colorado General Assembly. 2024. House Bill 24-1058, Protect Privacy of Biological Data (Ch. 68). Bill page; signed act.
- California Legislature. 2024. Senate Bill 1223 (Becker), amending the California Consumer Privacy Act. leginfo.legislature.ca.gov.
- Vermont General Assembly. 2026. H.814, Act 101, An act relating to neurological rights and the use of artificial intelligence technology in health and human services. Status page; as enacted.
- US Senate. 2025. S. 2925, Management of Individuals’ Neural Data Act of 2025 (MIND Act). congress.gov.
- European Union. 2016. Regulation (EU) 2016/679, General Data Protection Regulation. EUR-Lex.
- Cornejo-Plaza, M. I., Cippitani, R., and Pasquino, V. 2024. Chilean Supreme Court ruling on the protection of brain activity: neurorights, personal data protection, and neurodata. Frontiers in Psychology 15. doi:10.3389/fpsyg.2024.1330439.
- Carter, H. T. 2023. Neural Rights: Landmark Ruling. ArentFox Schiff (originally in Latinvex), October 18, 2023. afslaw.com.
- Genser, J., Damianos, S., and Yuste, R. 2024. Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies. Neurorights Foundation report. PDF.
- Spivack, J., and Victory, C. 2025. The “Neural Data” Goldilocks Problem: Defining “Neural Data” in U.S. State Privacy Laws. Future of Privacy Forum, August 12, 2025. fpf.org.
- Mathews, K. 2025. Comparing New Neural Data Privacy Laws in 4 States. Law360, June 27, 2025 (Cooley reprint). PDF.
- Joseph, B. 2025. Legislation Regulating Neural Data Picks Up Steam. LexisNexis State Net Capitol Journal, November 25, 2025. lexisnexis.com.
- Issar, N., Shugrue, D., and Houghtlin, M. 2026. State of Mind: The New Landscape of Neural Data Privacy Laws. Risk Management Magazine, February 24, 2026. rmmagazine.com.
- Collins, A. 2026. US State Legislation to Protect Neural Data. Testimony on H.814 to the Vermont Senate Committee on Health and Welfare, April 9, 2026. PDF.
- UNESCO. 2025. Recommendation on the Ethics of Neurotechnology, adopted by the General Conference at its 43rd session. unesco.org.
