Neural Data Laws Now Cover Six U.S. States. They Don’t Agree on What Neural Data Is

A few years ago, “neural data” was a phrase for ethics papers. It is now a defined term in at least six U.S. state privacy statutes, a protected interest in Chile’s constitution and the subject of a global UNESCO recommendation. Consumer EEG headbands, sleep and focus trackers, earbuds with brain-sensing electrodes and implanted brain-computer interfaces all generate it, and AI models are getting better at turning it into inferences about attention, mood and intent.

The legal picture that results is not one law but a patchwork, and the patches do not match. What counts as neural data in California may not count in Connecticut, and Colorado’s protection may not apply at all unless the data is used to identify someone. This guide walks through what each law covers, where AI rules come in, and how a product or privacy team can work out which obligations actually apply.

The U.S. state laws, side by side

Every U.S. law so far takes the same basic route: rather than inventing a new regime, it adds neural data to an existing category of sensitive or specially protected data. The differences are in the definitions and the trigger conditions. The Future of Privacy Forum’s analysis of how states define neural data is a useful companion to the summary below.

Two details in that table change outcomes in practice. California’s CCPA gives sensitive personal information extra protection, including the right to limit its use, mainly when it is used to infer characteristics about a consumer. A company that collects EEG signals only to run a meditation feature may face lighter obligations than one that uses them to profile users. Colorado’s identification trigger is narrower still, because consumer neurotech rarely uses brain signals to identify anyone. Connecticut and Vermont, by contrast, cover central nervous system data without an identification or inference condition, which makes them the broadest in effect for brain-sensing products, even though they exclude peripheral signals such as muscle activity.

Delaware’s amendments, signed by Gov. Matt Meyer on September 2, 2026, also lower the coverage threshold to companies handling data of 10,000 consumers and treat inferences as sensitive when they are “used to reveal or identify” a sensitive category, according to the governor’s announcement. Vermont separately enacted H.814 in May 2026, a law on neurological rights and the use of AI in health and human services. Our earlier explainer on neural data compliance and neurorights in California and other states covers the first wave of these laws in more depth.

At the federal level there is still no neural data statute. The MIND Act of 2025 (S. 2925), introduced in September 2025 by Sens. Chuck Schumer, Maria Cantwell and Ed Markey, would direct the Federal Trade Commission to study neural data and report to Congress. It has not advanced beyond referral to the Senate Commerce Committee. The same senators had earlier pressed the FTC on brain data practices, as we reported in our coverage of the senators’ demand for action on brain data. Until Congress acts, the FTC’s general authority over unfair and deceptive practices, the Health Breach Notification Rule and, for products making medical claims, FDA device rules are the main federal hooks. HIPAA generally does not reach consumer device makers that are not covered entities or business associates.

Outside the United States

Chile moved first at the constitutional level. A 2021 amendment to Article 19 of its constitution requires that scientific and technological development protect brain activity and the information derived from it, and in 2023 the Chilean Supreme Court ordered the U.S. neurotech company Emotiv to delete a former senator’s brain data collected through one of its headsets. UNESCO’s member states adopted a Recommendation on the Ethics of Neurotechnology in November 2025, a non-binding instrument that calls for treating neural data as especially sensitive and for limits on its commercial use. We summarized it in our overview of UNESCO’s neurotechnology standards.

The EU has no neural-data-specific law. Under the GDPR, neural data is personal data whenever it relates to an identifiable person, and it will often fall into a special category under Article 9, as health data when it reveals a condition or as biometric data when processed to uniquely identify someone. Explicit consent or another Article 9 condition is then required, and a data protection impact assessment is very likely. The EU AI Act adds a separate layer. Since February 2, 2025, it has prohibited AI systems that infer emotions in workplaces and educational institutions, except for medical or safety reasons, and emotion recognition based on biometric data is listed among high-risk uses elsewhere.

Where AI law meets neural data

The practical point for developers is that neural data laws and AI laws stack rather than substitute. A brain-computer interface that uses a machine learning model to decode intended speech or movement is processing neural data under privacy law and running an AI system that may be regulated in its own right. A focus-tracking headset sold to employers could trigger a state neural data consent requirement, an employment-related automated decision rule and, in the EU, the AI Act’s ban on workplace emotion inference, all at once.

Training is a separate pressure point. Companies building “brain foundation models” want large neural datasets, and some neurotech firms now license data to them. Under Connecticut, Vermont and Delaware law the sale of sensitive data faces tight limits, while Colorado and Montana require consent for sale, and several states require data brokers to register. Whether neural recordings can be de-identified well enough to fall outside these laws is disputed, because published studies have matched individuals to their brain recordings with high accuracy within known groups.

Five questions to scope a neurotech product

1. Which nervous system does the sensor measure? Central nervous system signals such as EEG are covered in every state listed above. Peripheral signals such as muscle activity may be covered in California, Colorado and Montana but not in Connecticut or Vermont.
2. Is the data neural, or inferred from something else? California excludes data inferred from nonneural information and Montana excludes downstream physical effects. A stress score derived from heart rate may fall outside neural data rules and inside health data rules instead.
3. What is it used for? Identification triggers Colorado. Inferring characteristics triggers California’s heightened protections. Emotion inference in a workplace or school can be banned outright in the EU.
4. Where are the users? Neural data obligations attach by residency, and many neurotech companies do not track it. Build state-level logic into consent flows or default to the strictest standard.
5. Who receives it? Cloud processors, AI model vendors and research partners should be named in contracts with purpose limits, deletion terms and a ban on re-identification.

In data flow terms, document what is collected (raw signal, derived features, model outputs), where it is processed (on device or in the cloud), who receives it, for what purpose and for how long. Colorado’s rules on consent for sensitive data under the Colorado Privacy Act and the consent requirements in the Connecticut Data Privacy Act are good templates for the opt-in language. A consent screen alone does not prove compliance, though. Teams should verify that raw recordings are actually deleted on schedule and that downstream recipients are not keeping copies.

Frequently asked questions

Is heart rate or step count “neural data”?

Generally not under the current definitions, which focus on measuring nervous system activity. Montana expressly excludes downstream effects like breathing rate, and California excludes data inferred from nonneural information. That data may still be health data under other laws.

Do I need consent to process neural data in Connecticut?

Yes, if the Connecticut Data Privacy Act applies to your business. Since July 1, 2026, neural data has been sensitive data, which requires the consumer’s consent to process.

Does the GDPR treat neural data as special category data?

Not automatically. It becomes special category data when it is health data or biometric data processed for unique identification, which will be common for neurotech. European regulators, including the EDPS and Spain’s AEPD, have urged caution with neurodata, so applying special category safeguards regardless is the safer course.

Is there a federal neural data law in the U.S.?

No. The MIND Act would only commission an FTC study and has not passed. Federal oversight currently relies on the FTC Act and sector rules.

The definition will decide the market

Neural data laws have spread faster than neurotech products have gone mainstream, which is unusual for privacy law. That gives companies a rare chance to build to the rules before scale rather than retrofit after a scandal. It also leaves an open question that lawmakers have not resolved: if a watch can infer the same mood from heart rate that a headband reads from brain waves, protecting only one of them may guard the label rather than the person.