Neural data law moved from the sensor to the inference this autumn. The definitions didn't follow.

The most consequential neural data law of the autumn did not add brain data to another state's list of sensitive categories. On September 30, California Governor Gavin Newsom signed AB 1883, which bars employers from using AI-powered surveillance tools to collect a worker's neural data or to infer a worker's emotional state. In the same signing message, he asked the Legislature to fix it, writing that the bill "lacks key definitions, which may create confusion about which tools are covered." That pairing sums up the season. Lawmakers are starting to regulate what is done with nervous-system signals and the inferences drawn from them. They still have not agreed on what those signals are.

The details matter. According to a Fisher Phillips analysis, the law takes effect on January 1, 2027. It defines a workplace surveillance tool broadly, as any system, application, instrument or device that collects employee data, and it describes neural data as information from measuring the activity of the central or peripheral nervous system. Penalties run up to $500 per violation, enforced by the Labor Commissioner and public prosecutors. A private right of action was dropped from earlier drafts, but the firm expects representative claims under the state's Private Attorneys General Act. Employers may still use a tool "to ensure safety", and how far that exception reaches is untested. The emotion prong is the bigger shift. It does not depend on brain signals at all. A camera that scores a worker's mood is covered as much as an EEG headset. That mirrors the EU, where the AI Act has since February 2, 2025 banned AI systems that infer emotions in workplaces and schools, except for medical or safety reasons, with fines of up to €35 million or 7% of worldwide turnover.

What did not change in California is just as telling. On September 27, Newsom vetoed AB 1542, which would have barred businesses from selling or sharing sensitive personal information, a category that has included neural data under the CCPA since 2024. He called the categorical ban "a step too far" and cited costs. So for consumer neurotech, California remains a right-to-limit state, while its employers face an outright ban. The protection now depends on who is collecting the data, not only on what the data is.

The definitional split is unchanged, and it is easy to get wrong. Vermont's Act 145 defines neural data as information generated by measuring the activity of the central nervous system, matching Connecticut and Delaware. The CCPA covers the central or peripheral nervous system but excludes data "inferred from nonneural information." Colorado also reaches the peripheral system. Montana reaches both but excludes the "downstream physical effects of neural activity", naming pupil dilation, motor activity and breathing rate. In an October 6 essay, law professor Daniel Solove quotes these definitions accurately, then summarizes Vermont as covering both systems and Montana as covering only the central one. The statutes say the reverse. If a careful scholar's summary table can flip two states, a startup's compliance spreadsheet can too. Solove's larger point holds: much of what reveals mental state is not neural data at all.

A wrist-worn muscle sensor shows why this matters. Meta's Neural Band, on sale in the US since September 30, 2025, "translates the signals created by your muscles" into commands, and Meta says it rests on surface EMG research with nearly 200,000 participants. In Connecticut, Delaware and Vermont, those signals are not neural data. In Montana, "motor activity" is excluded by name. In California and Colorado, the answer turns on whether muscle signals count as measuring the peripheral nervous system, which Davis Wright Tremaine calls unresolved. Put the same band in a California workplace with an AI decoder, and AB 1883 raises the question again under a different statute.

Federal law is not coming to settle this. The MIND Act, which would only direct the FTC to study neural data, still has one recorded action in its official bill-status record: referral to the Senate Commerce Committee on September 29, 2025. The 119th Congress ends in early January 2027, and bills not enacted by then lapse and must be reintroduced. We found no FTC enforcement action this year aimed at neural data. Davis Wright Tremaine describes Section 5 of the FTC Act, the general ban on unfair or deceptive practices, as the only federal rule that applies.

The international signals point at inferences and context, not just sensors. On October 15, the UN Assistant Secretary-General for Human Rights presented a Secretary-General's report (A/81/351) to the General Assembly. It calls neural data "uniquely sensitive personal data", urges "prohibitions on coercive and abusive uses", and warns that data from consumer headsets and wellness devices could reach courtrooms. An OECD paper on neurodata governance, based on interviews with 16 firms in six countries, found that companies sort neurodata into four classes, including inferred data. The firms had engaged with medical device regulators, but almost none had talked to data protection authorities. In Brussels, the Council agreed its Digital Omnibus position in late October. It keeps the GDPR's definition of personal data and adds safeguards for using sensitive data in biometric verification and AI training. Talks cannot start until Parliament agrees its own stance, so nothing about neural data under the GDPR has changed yet.

For a neurotech company, Q1 2027 looks like this. From January 1, Delaware requires opt-in consent for central nervous system data and California's workplace ban applies; Vermont's opt-in rule follows in 2028 (our state-by-state tracker keeps the dates). Map every signal by origin: brain recordings such as EEG, peripheral signals such as EMG, and downstream measures such as heart rate variability or pupil size. Then apply opt-in consent to all three wherever they feed an inference about mental state, because that is where California's employment law and the EU now draw the line. If you sell to California employers, audit any feature that scores stress, focus or mood, and do not lean on the safety exception until someone tests it. Talk to privacy regulators, not only the FDA. And expect California to revisit AB 1883 in 2027, as its governor asked.

The pattern is now clear. Statutes keep being written around the sensor, while the harm sits in the inference and in who holds the power to draw it. The laws that will matter in 2027 are the ones that regulate what is inferred, and by whom, not just which nerve the signal came from.