Statute by Statute: Where U.S. Neural-Data Laws Draw the Line

Same guess, two sensors, two legal answers.

Picture two focus-tracking apps: one reads an EEG headband, the other a laptop webcam watching your eyes and face. If both companies are otherwise covered, California and Connecticut treat only the headband readings as neural data (California Legislature, 2024; Connecticut General Assembly, 2025). My policy note argued about that gap; here I trace its legal roots.

The example is invented; the collection is not. In Magee, Ienca, and Farahany’s review of 17 brands’ privacy policies, every brain-computer interface brand and every fitness-wearable brand said it collects cognitive biometric data at least sometimes, and nine said they share de-identified or aggregate data with third parties (Magee et al., 2024).

California writes the gap into its own definition.

SB 1223 is narrower than it first appears. Its definition reaches measurements of central or peripheral nervous-system activity only when they are “not inferred from nonneural information” (California Legislature, 2024). As of October 2026, that clause is unchanged.

Colorado asks what the data is used for.

Colorado’s HB24-1058 defines neural data broadly, but the state’s sensitive-data list does not name it. The bill added “biological data” to that list, which includes neural data and is defined by purpose: data used, or meant to be used, to identify someone (Colorado General Assembly, 2024).

My inference: a headband app that uses brain readings to score mood, not to identify the user, may fall outside these rules, though the bill’s declaration lists the two kinds of data separately.

Connecticut’s rule is law, and it stops at the central nervous system.

Public Act 25-113 (Substitute SB 1295) is law: its neural-data provisions took effect July 1, 2026, and reach only central nervous system activity (Connecticut General Assembly, 2025). It never mentions non-neural information; a webcam inference falls outside simply because it measures no such activity. California, Colorado, and Montana, by contrast, also reach the peripheral nervous system (California Legislature, 2024; Colorado General Assembly, 2024; Montana Code).

Montana placed neurotechnology data inside a genetic-privacy law.

SB 163 (2025) put “neurotechnology data” into Montana’s 2023 Genetic Information Privacy Act, whose consumer-privacy duties bind only organizations that sell genetic testing directly to consumers or whose work involves collecting, using, or analyzing genetic data (Montana Code § 30-23-102(4); § 30-23-104). Separately, Montana law limits how government agencies collect or search this data (Montana Code § 30-23-103(2); § 44-6-104).

My inference: a neurotechnology company with no genetic-data business may fall outside those duties.

The MIND Act runs on a slow clock.

As of October 2026, the MIND Act (S. 2925) is still a bill, with no recorded action since its September 29, 2025 referral to a Senate committee (Congress.gov, accessed October 2, 2026). If enacted, it would give the Federal Trade Commission (FTC) a year to report to Congress, the Office of Science and Technology Policy 180 more days to draft guidance, and the Office of Management and Budget (OMB) 60 more days to issue binding guidance to federal agencies. A year later, agencies could not buy or run neurotechnology that conflicts with it (MIND Act of 2025, §§ 4–5).

My inference: at full deadlines, OMB’s guidance would arrive about one year and eight months after enactment, and that ban about two years and eight months after. Since it sets no rule for companies, as my policy note explains, I read the bill as procedural: it schedules decisions instead of making them.

Each agency has a tool, and each tool has a fence.

Under section 18, the FTC can write rules defining specific unfair or deceptive practices, after extra steps such as finding a practice prevalent (FTC Act § 18). Its report on June 2021 to January 2025 says it proposed and finalized four such rules “for the first time in decades,” none about mental-state data (Federal Trade Commission, 2025).

The Health Insurance Portability and Accountability Act (HIPAA) builds its rules around three kinds of “covered entity”: health plans, health care clearinghouses, and providers that send health information electronically in standard transactions (HHS rule, 45 CFR 160.103; Social Security Act § 1172(a), added by HIPAA). Section 520(o)(3) of the Federal Food, Drug, and Cosmetic Act lets the Secretary of Health and Human Services, acting through the Food and Drug Administration (FDA), return some excluded software to device rules after finding serious health risks, but not healthy-lifestyle software (FD&C Act § 520(o)(3), 2018).

My inference: the FTC route needs no new law but is slow; the other two need Congress. A company selling a focus headband directly to consumers is none of HIPAA’s three, so lawmakers could add such makers to that list and narrow the wellness exclusion for software that infers mental states.

Chile’s constitution reached a company; the two rights theories I read do not yet.

Two details matter here: Ley 21.383 put brain-activity protection in the constitution itself (Chile Ley 21.383), and Girardi v. Emotiv Inc. was a suit against a private company, in which the court also directed Chile’s public health institute and customs authority to review the Insight device (Corte Suprema de Chile, 2023).

The U.S. Constitution has no clause like Chile’s. Tomain argues that the Ninth Amendment, which protects rights the Constitution does not list, already covers freedom of thought and mental privacy, but concedes that reaching companies is “a much harder case” under the state action doctrine, which limits constitutional rights to government conduct (Tomain, 2025). Istace, working in international human rights law, likewise builds on existing rights, finding derived neurorights clearer and politically easier than brand-new ones (Istace, 2025).

My inference: placement matters. Undoing Chile’s protection takes another constitutional change; Montana redrew its statute with an ordinary bill. Chile’s clause still leaves details to ordinary law, so the difference is one of degree. Neither Tomain’s nor Istace’s route yet gives consumers a claim against a company, and without someone able to enforce it, a right stays on paper.

What I can cite, what I inferred, and what is still open.

For now, whether a guess about your focus counts as neural data can depend on which device made it.

Sources used in this post

The scholarly sources behind this post are Magee, Ienca, and Farahany (2024), Beyond neural data: Cognitive biometrics and mental privacy; Mecacci and Haselager (2019), Identifying criteria for the evaluation of the implications of brain reading for mental privacy; Tang et al. (2023), Semantic reconstruction of continuous language from non-invasive brain recordings; Istace (2025), Establishing Neurorights: New Rights versus Derived Rights; and Tomain (2025), Ninth Amendment Neurorights.

The legal and policy sources are California Civil Code § 1798.140(ae)(1)(G), as amended by SB 1223; Colorado HB24-1058 (signed text), which amended Colorado Revised Statutes § 6-1-1303; Connecticut Public Act 25-113 (Substitute SB 1295), section 5; Montana Code Annotated sections 30-23-102, 30-23-103, 30-23-104, and 44-6-104, as amended by SB 163 (2025); the introduced federal MIND Act of 2025 and its introduced text; FTC Act § 18, 15 U.S.C. § 57a; the FTC’s Accomplishments: June 2021 to January 2025 report (page 21); the HHS definitions rule at 45 CFR 160.103; Social Security Act § 1172(a), 42 U.S.C. § 1320d-1(a), added by HIPAA (Pub. L. 104-191, § 262); section 520(o) of the Federal Food, Drug, and Cosmetic Act, codified at 21 U.S.C. 360j(o); Chile Ley 21.383; and the Chilean Supreme Court’s Girardi v. Emotiv Inc. decision (Rol 105.065-2023).