Your brain data has a legal status now: the neurorights wave.

For most of the history of privacy law, the data inside your skull was protected by a simple fact: nobody could read it. That protection is expiring on its own schedule, and legislatures have noticed. The result is the fastest-moving new category in privacy regulation — neural data — and a wave of lawmaking the neurotechnology industry should be reading closely.

Colorado moved first. In April 2024, House Bill 24-1058 amended the Colorado Privacy Act to classify neural data as sensitive data, making Colorado the first US state to give brain recordings explicit statutory protection — consent requirements included. California followed within months: SB 1223 amended the CCPA to add neural data to the definition of sensitive personal information, extending to it the same rights of access, deletion, and limited use that govern biometrics. California's model is a right to limit that use rather than opt-in consent. Montana followed in 2025, protecting "neurotechnology data" under its Genetic Information Privacy Act, and Connecticut's Public Act 25-113 made neural data sensitive data from July 1, 2026. Since then Vermont (Act 145, effective 2028) and Delaware (House Bill 380, effective 2027) have joined them, bringing the count of states whose enacted law protects neural data to six. Notably, these laws reach consumer neurotech — headbands, earbuds, sleep trackers — not just clinical implants under FDA oversight.

The international layer arrived in November 2025, when UNESCO's General Conference adopted its Recommendation on the Ethics of Neurotechnology — the first global normative framework for the field. It urges member states to protect mental privacy and cognitive liberty, and draws a line the industry should internalize early: inferring mental states from neural data requires a justification bar far higher than the analytics norms of the consumer internet.

Our position is that strong neural data law is good for serious neurotechnology, for the same reason aviation regulation was good for serious airlines: it prices out the careless and earns the public trust the field cannot advance without. The standard worth building to is the strictest emerging one globally — participant-controlled recording, on-device discard by default, no secondary use without separate consent — because the alternative future, where brain data is adtech, is one in which no rational person volunteers for the trials that medicine needs. Our state-by-state neural data law tracker follows each law as it changes.

Correction, November 9, 2026: this article originally said two US states protected neural data. Montana and Connecticut had also enacted laws by the time it was published, and Vermont and Delaware have since; we updated the count to six, added those laws with primary sources, and noted that California's model is a right to limit use rather than opt-in consent.