States pass privacy laws to protect brain data collected by devices
Hiroshi Watanabe via Getty Images
California, Colorado and Montana have passed neural data privacy laws meant to prevent the exploitation of brain information collected by consumer products.
This article first appeared on KFF Health News and is republished here under a Creative Commons license.
More states are passing laws to protect information generated by a person’s brain and nervous system as technology improves the ability to unlock the sensitive details of a person’s health, mental states, emotions, and cognitive functioning.
Colorado, California, and Montana are among the states that have recently required safeguarding brain data collected by devices outside of medical settings. That includes headphones, earbuds, and other wearable consumer products that aim to improve sleep, focus, and aging by measuring electrical activity and sending the data to an app on users’ phones.
A report by the Neurorights Foundation, an advocacy group that aims to protect people from the misuse of neurotechnology, found that 29 of 30 companies with neurotechnology products that can be purchased online have access to brain data and “provide no meaningful limitations to this access.” Almost all of them can share data with third parties.
In June, the American Medical Association called for greater regulation of neural data. In April, several Democratic members of the U.S. Senate Committee on Commerce, Science, and Transportation asked the Federal Trade Commission to investigate whether companies are exploiting consumers’ brain data. Juliana Gruenwald Henderson, a deputy director of the FTC’s Office of Public Affairs, said the agency had received the letter but had no additional comment.
Although current devices gather relatively basic information like sleep states, advocates for brain data protection caution that future technologies, including artificial intelligence, could extract more personal and sensitive information about people’s medical conditions or innermost thoughts.
“If you collect the data today, what can you read from it five years from now because the technology is advancing so quickly?” said Democratic state Sen. Cathy Kipp, who sponsored Colorado’s 2024 neural data protection bill when she was in the state House of Representatives.
As both excitement and trepidation about AI build, at least 28 states and the U.S. Virgin Islands have enacted some type of AI regulation separate from the privacy bills protecting neural data. President Donald Trump’s “One Big Beautiful Bill” included a 10-year halt on states passing laws to regulate AI, but the Senate stripped that provision out of the budget reconciliation bill before voting to approve it on July 1.
The spirit of laws in Colorado, California, and Montana is to protect the neural data itself, not to regulate any algorithm or AI that might use it, said Sean Pauzauskie, medical director for the Neurorights Foundation.
But neurotechnology and AI go hand in hand, Pauzauskie said. “A lot of what these devices promise is based on pattern recognition. AI is really driving the usability and significance of the patterns in the brain data.”
Cristin Welle, a professor of neurosurgery at the University of Colorado School of Medicine, said that AI’s ability to identify patterns is a game changer in her field. “But contribution of a person’s neural data on an AI training set should be voluntary. It should be an opt-in, not a given.”
Chile in 2021 became the first country to adopt a constitutional amendment for neurorights, which prioritize human rights in the development of neurotechnology and collection of neural data, and UNESCO has said that neurotechnology and artificial intelligence could together pose a threat to human identity and autonomy.
Neurotechnology can sound like science fiction. Researchers used a cap with 128 electrodes and an AI model to decode the brain’s electric signals from thoughts into speech. And two years ago, a study described how neuroscientists reconstructed the Pink Floyd song “Another Brick in the Wall” by analyzing the brain signals of 29 epilepsy patients who listened to the song with electrodes implanted in their brains.
The aim is to use neurotechnology to help those with paralysis or speech disabilities, as well as treat or diagnose traumatic brain injuries and brain disorders such as Alzheimer’s or Parkinson’s. Elon Musk’s Neuralink and Synchron, funded by Bill Gates and Jeff Bezos, are among the companies with clinical trials underway for devices implanted in the brain.
Pauzauskie, a hospital neurologist, started worrying four years ago about the blurring of the line between clinical and consumer use of neural data. He noted that the devices used by his epilepsy patients were also available for purchase online, but without protections afforded by the Health Insurance Portability and Accountability Act in medical settings.
Pauzauskie approached Kipp two years ago at a constituent meetup in his hometown of Fort Collins to propose a law to protect brain data in Colorado. “The first words out of her mouth that I’ll never forget were, ‘Who would be against people owning their own brain data?’” he said.
Brain data protection is one of the rare issues that unite lawmakers across the political aisle. The bills in California, Montana, and Colorado passed unanimously or nearly unanimously. Montana’s law will go into effect in October.
Neural data protection laws in Colorado and California amend each state’s general consumer privacy act, while Montana’s law adds to its existing genetic information privacy act. Colorado and Montana require initial express consent to collect or use neural data and separate consent or the ability to opt out before disclosing that data to a third party. A business must provide a way for consumers to delete their data when operating in all three states.
“I want a very hard line in the sand that says, you own this completely,” said Montana state Republican Sen. Daniel Zolnikov, who sponsored his state’s neural data bill and other privacy laws. “You have to give consent. You have the right to have it deleted. You have complete rights over this information.”
For Zolnikov, Montana’s bill is a blueprint for a national neural data protection law, and Pauzauskie said support of regulatory efforts by groups like the AMA pave the way for further federal and state efforts.
Welle agreed that federal regulations are needed in addition to these new state laws. “I absolutely hope that we can come up with something on a national level that can enshrine people’s neural rights into law, because I think this is going to be more important than we can even imagine at this time.”
KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF. Subscribe to KFF Health News' free Morning Briefing.
NEXT STORY: The key to improving SNAP delivery is data