Neural data law keeps spreading state by state, and the definitions don't match.

On September 2, Delaware Governor Matt Meyer signed House Bills 380 and 381, amendments to the state's privacy law that the governor's office says set the lowest threshold in the nation: companies handling the data of just 10,000 consumers are covered, or 5,000 if more than 20% of their revenue comes from selling data. The neural data change is in House Bill 380, which takes effect on January 1, 2027. Neural data, defined as data generated by measuring the activity of an individual's central nervous system, joins the categories that require opt-in consent, alongside items such as immigration status and government ID numbers. Neural data was not the headline here. It was one line in a general privacy package, and that may be the more important sign. A category that needed its own campaign in Colorado two years ago can now travel as routine drafting.

The Delaware law also treats inferences drawn from other data as sensitive when they are used to reveal or identify a sensitive category. Neurotechnology companies should read that closely. Much of what is commercially interesting about brain data is what can be inferred from it, and much of what can be inferred about mental state does not need a brain recording at all.

Vermont did two things. Act 101, approved on May 18, is summarized by the state's Office of Legislative Counsel as recognizing individuals' neurological rights and extending the Artificial Intelligence Advisory Council to June 30, 2030. The Council must report by January 15, 2027, on topics including protections for neurological rights. On its own, Act 101 is a statement of rights paired with a study. The compliance regime came separately: Act 145 (S.71), the Vermont Data Privacy and Online Surveillance Act, signed on June 16, lists neural data, measured from the central nervous system, as sensitive data that controllers may not process or sell without the consumer's consent. It takes effect on January 1, 2028, and is enforced by the Attorney General; the Act expressly rules out a private right of action.

Delaware and Vermont follow four states with neural data provisions already in force: Colorado, California, Montana and Connecticut, whose law took effect on July 1. Their definitions diverge. Delaware and Vermont's Act 145, like Connecticut, cover the central nervous system only. According to a Davis Wright Tremaine analysis, Colorado reaches both the central and peripheral nervous systems but only when data is used or intended to identify someone. Connecticut covers the central nervous system only. Montana's term is "neurotechnology data" and excludes downstream physical effects such as pupil dilation. California excludes data inferred from nonneural information, which the firm reads as leaving out algorithmically derived data such as heart rate variability or sleep scores, which Colorado includes. So a wearable that infers focus from physiological signals could be regulated in one state and not in another. Bills proposed elsewhere, including in Alabama, Illinois, Massachusetts and Minnesota, could add more variants.

A federal fix is not close. The MIND Act, introduced in the Senate by Chuck Schumer, Maria Cantwell and Ed Markey in September 2025, would direct the FTC to study neural data governance and report within a year. As Davis Wright Tremaine notes, it would not create a new federal regulatory scheme. The official bill-status record lists one action on S.2925: referral to the Senate Committee on Commerce, Science, and Transportation on September 29, 2025.

For builders, the sensible course is to design to the strictest applicable definition now rather than track each one. Treat signals from the nervous system, and inferences about mental state, as sensitive by default, with opt-in consent. The law is heading there one state at a time. Our state-by-state neural data law tracker keeps the current list.

Correction, November 9, 2026: this article originally omitted Vermont's Act 145, which makes neural data opt-in sensitive data from 2028, and so described Vermont's approach as rights without a compliance regime. It also attributed the neural data change to both Delaware bills rather than House Bill 380, and said we could not confirm the MIND Act's status; the official record now confirms it. We added those details with primary sources and replaced a secondary Connecticut source with the enacted Public Act.