NeuroGenesysWhat is neural data?
Last updated • By Will Schulz
Neural data is information generated by measuring the activity of a person's nervous system, for example from EEG headbands, implanted brain-computer interfaces or other neurotechnology. Several US states now treat it as sensitive personal data, but they disagree on whether it covers the peripheral nervous system and data inferred from other signals.
How do US laws define neural data?
Colorado defines it as "information that is generated by the measurement of the activity of an individual's central or peripheral nervous systems and that can be processed by or with the assistance of a device", protected as part of biological data used for identification. California's CCPA, §1798.140(ae), covers the central or peripheral nervous system but excludes data "inferred from nonneural information". Montana protects "neurotechnology data" and excludes downstream physical effects such as pupil dilation, motor activity and breathing rate. Connecticut, Vermont's Act 145 and Delaware's HB 380 cover the central nervous system only.
The federal MIND Act (S.2925), a study bill referred to committee, defines neural data as "information obtained by measuring the activity of an individual's central or peripheral nervous system through the use of neurotechnology."
Where do the definitions differ?
On three axes: whether the peripheral nervous system is included; whether data inferred from non-neural signals such as heart rate, pupil size or typing is excluded; and whether an identification-purpose gate applies, as in Colorado. A wearable that infers focus from physiological signals can therefore fall inside one state's definition and outside another's. Our state-by-state tracker compares them in one table.
Is neural data protected outside the US?
Chile amended its constitution in 2021 (Ley 21.383) to protect "la actividad cerebral, así como la información proveniente de ella". UNESCO's Member States adopted a Recommendation on the Ethics of Neurotechnology on November 5, 2025; a Recommendation is not binding.
Why does the definition matter for machine learning?
Decoders keep getting better at reading what people intend. A 2025 Cell paper from Stanford (Kunz et al.) showed inner speech can be decoded in real time from motor cortex, and demonstrated strategies that prevent unintended decoding of private inner speech. What counts as neural data decides which of those signals the law protects.
Where can I read more on NeuroGenesys?
Sources
- California Consumer Privacy Act, Cal. Civ. Code §1798.140 — California Privacy Protection Agency (CCPA statute, eff. 2026-01-01)
- HB24-1058 as signed — Colorado General Assembly, 2024
- Act 145 (S.71) as enacted — Vermont General Assembly, 2026
- S.2925, MIND Act of 2025 (introduced) — U.S. Government Publishing Office
- Ley 21.383 — Biblioteca del Congreso Nacional de Chile
- UNESCO adopts first global standard on the ethics of neurotechnology — UNESCO, November 2025
- Inner speech in motor cortex and implications for speech neuroprostheses — Cell (Kunz et al.), 2025
