NeuroGenesysWhich neural data laws apply to you?
Six US states now treat neural data as sensitive, with different definitions, consent rules and start dates. Tick the states where you have users, say what your device measures, and pick a date to see which laws apply and what each requires.
Built on our neural data privacy law tracker, with a primary source for every law.
Free · runs in your browser · updated
1 · Your situation
states where you have users or customers2 · Which laws apply
4 of 6 selected states have neural data provisions that apply or may apply.
Colorado
ConditionalOnly when the data is used, or intended to be used, to identify a person ("biological data" used for identification).
- Law
- HB24-1058, amending the Colorado Privacy Act (C.R.S. 6-1-1303)
- Status
- Signed Apr 17, 2024. In force since Aug 7, 2024.
- Consent
- Opt-in consent for sensitive data.
- Enforcement
- Attorney General and district attorneys. No private right of action.
Signed actSecondary source: Consent and enforcement come from the general Colorado Privacy Act, not re-checked against the statute.California
AppliesCovers central and peripheral nervous system data.
- Law
- SB 1223, amending the CCPA, Cal. Civ. Code §1798.140(ae)
- Status
- Signed Sep 28, 2024. In force since Jan 1, 2025.
- Consent
- Right to limit use (§1798.121), not opt-in consent.
- Enforcement
- California Privacy Protection Agency and Attorney General. The CCPA's private right of action covers data breaches only.
CCPA statute (CPPA)Secondary source: Signing date.Montana
AppliesCovers central and peripheral nervous system data.
- Law
- SB 163 (2025), Ch. 345, amending the Genetic Information Privacy Act (MCA 30-23-102)
- Status
- Enacted 2025. Effective Oct 1, 2025.
- Consent
- Express consent for collection and use, with separate express consent for certain disclosures.
- Enforcement
- Attorney General has sole authority; up to $2,500 per violation. No private right of action.
MCA 30-23-102Secondary source: Effective date.Connecticut
AppliesCovers central nervous system data.
- Law
- SB 1295, Public Act 25-113, amending the CTDPA (Conn. Gen. Stat. §42-515)
- Status
- Approved Jun 24, 2025. Neural data provisions in force since Jul 1, 2026.
- Consent
- Opt-in consent to process sensitive data.
- Enforcement
- Attorney General has exclusive authority. No private right of action.
Delaware
From Jan 1, 2027Enacted, not yet in force on the date you picked.
- Law
- HB 380 (153rd GA), 85 Del. Laws c. 463, amending the DPDPA (6 Del. C. ch. 12D)
- Status
- Signed Sep 2, 2026. Effective Jan 1, 2027.
- Consent
- Opt-in consent. Sale of sensitive data only when strictly necessary, with clear notice and consent.
- Enforcement
- Delaware Department of Justice. The statute provides no basis for a private right of action. Applies from 10,000 consumers, or 5,000 if over 20% of revenue comes from data sales.
Vermont
From Jan 1, 2028Enacted, not yet in force on the date you picked.
- Law
- S.71, Act 145 (2026), Vermont Data Privacy and Online Surveillance Act (9 V.S.A. §§2415a–2415k)
- Status
- Signed Jun 16, 2026. Effective Jan 1, 2028.
- Consent
- Opt-in: no processing or sale of sensitive data without consent. Applies from 35,000 consumers, or the sensitive data of 3,000.
- Enforcement
- Attorney General under the Vermont Consumer Protection Act. A private right of action is expressly prohibited.
Information, not legal advice. Coverage also depends on each act's general thresholds and exemptions (size of business, HIPAA-covered data, research), which this checker does not test. Laws checked Nov 09, 2026.
Questions
Which states have neural data privacy laws?
Colorado, California, Montana, Connecticut, Delaware and Vermont. Delaware's provisions take effect January 1, 2027 and Vermont's January 1, 2028.
Does an EMG wristband count as neural data?
In Colorado, California and Montana it can, because their definitions include the peripheral nervous system. Connecticut, Delaware and Vermont cover the central nervous system only.
Do consumer EEG headsets fall under these laws?
They can. The definitions turn on measuring nervous-system activity, not on whether the device is a medical implant. Medical data already covered by HIPAA and some research uses may be exempt under each act's general rules.
Is there a federal neural data law?
No. The MIND Act of 2025 would direct a study of neural data, not regulate it, and has not advanced.
Related
- Topic hubNeural data privacy law tracker
- Free toolNeural Data Rate Calculator (EEG & BCI)Raw data rate and storage from channels, sample rate and bit depth, for EEG headsets through intracortical arrays — and whether it fits a wireless link.
- Free toolBCI Information Transfer Rate CalculatorWolpaw ITR for any brain-computer interface: bits per selection and per minute from targets, accuracy and timing, typing-speed equivalents, a chance-level check and published benchmarks.
- Free toolBCI Company ComparisonFilter brain-computer interface companies by approach, sort by electrode count and compare any of them side by side on device, results and regulatory status.
