NeuroGenesysNeural data privacy laws: state-by-state tracker
Last updated • By Will Schulz
As of November 9, 2026, six US states have enacted laws that protect neural data: Colorado, California, Montana and Connecticut, whose laws are in force, and Delaware (from January 1, 2027) and Vermont (Act 145, from January 1, 2028). There is no federal neural data law; the MIND Act is a study bill that has not moved past committee referral.
The states disagree on what counts as neural data, whether consent must be opt-in, and who enforces. The table below links every row to the statute or official record. Where a detail rests on a secondary source, it is labelled.
Which US states have neural data privacy laws?
| State | Law | Status | Definition of neural data | Consent | Enforcement | Source |
|---|---|---|---|---|---|---|
| Colorado | HB24-1058, amending the Colorado Privacy Act (C.R.S. 6-1-1303) | Signed Apr 17, 2024. In force since Aug 7, 2024. | Central or peripheral nervous system, processable by a device. Sensitive only as "biological data" used or intended for identification. | Opt-in consent for sensitive data. | Attorney General and district attorneys. No private right of action. | Signed actSecondaryConsent and enforcement come from the general Colorado Privacy Act, not re-checked against the statute. |
| California | SB 1223, amending the CCPA, Cal. Civ. Code §1798.140(ae) | Signed Sep 28, 2024. In force since Jan 1, 2025. | Central or peripheral nervous system, "not inferred from nonneural information". A category of sensitive personal information. | Right to limit use (§1798.121), not opt-in consent. | California Privacy Protection Agency and Attorney General. The CCPA's private right of action covers data breaches only. | CCPA statute (CPPA)SecondarySigning date. |
| Montana | SB 163 (2025), Ch. 345, amending the Genetic Information Privacy Act (MCA 30-23-102) | Enacted 2025. Effective Oct 1, 2025. | "Neurotechnology data": central or peripheral nervous system, excluding nonneural information and downstream physical effects such as pupil dilation, motor activity and breathing rate. | Express consent for collection and use, with separate express consent for certain disclosures. | Attorney General has sole authority; up to $2,500 per violation. No private right of action. | MCA 30-23-102SecondaryEffective date. |
| Connecticut | SB 1295, Public Act 25-113, amending the CTDPA (Conn. Gen. Stat. §42-515) | Approved Jun 24, 2025. Neural data provisions in force since Jul 1, 2026. | Central nervous system only. Added to sensitive data. | Opt-in consent to process sensitive data. | Attorney General has exclusive authority. No private right of action. | Public Act 25-113 |
| Delaware | HB 380 (153rd GA), 85 Del. Laws c. 463, amending the DPDPA (6 Del. C. ch. 12D) | Signed Sep 2, 2026. Effective Jan 1, 2027. | Central nervous system only. Inferences used to reveal or identify a sensitive category are also sensitive. | Opt-in consent. Sale of sensitive data only when strictly necessary, with clear notice and consent. | Delaware Department of Justice. The statute provides no basis for a private right of action. Applies from 10,000 consumers, or 5,000 if over 20% of revenue comes from data sales. | HB 380 |
| Vermont | S.71, Act 145 (2026), Vermont Data Privacy and Online Surveillance Act (9 V.S.A. §§2415a–2415k) | Signed Jun 16, 2026. Effective Jan 1, 2028. | Central nervous system only. Listed as sensitive data. | Opt-in: no processing or sale of sensitive data without consent. Applies from 35,000 consumers, or the sensitive data of 3,000. | Attorney General under the Vermont Consumer Protection Act. A private right of action is expressly prohibited. | Act 145 as enacted |
Two other 2026 measures touch neural data without making it sensitive consumer data. Vermont's Act 101 (H.814), signed May 18, 2026, recognizes rights to mental and neural data privacy and freedom of thought, and asks the state's AI Advisory Council to report on protections and definitions by January 15, 2027; it is declaratory. California AB 1883, reported signed on September 30, 2026 and effective January 1, 2027, bars employers from using certain AI workplace-surveillance tools to collect employees' neural data Secondary.
Not law: California SB 44 (2025), on BCI neural data, died in February 2026, and Illinois HB 5179, the Protection of Neural Data Act, was reported as failed in March 2026 Secondary.
How do state definitions of neural data differ?
They split on three questions.
- Which nervous system?Colorado, California, Montana and the federal MIND Act cover the central or peripheral nervous system. Connecticut, Delaware and Vermont's Act 145 cover the central nervous system only.
- Are inferences excluded?California excludes data "inferred from nonneural information", and Montana excludes downstream physical effects such as pupil dilation, motor activity and breathing rate. Delaware goes the other way, treating inferences used to reveal a sensitive category as sensitive.
- Is there a purpose gate?Colorado protects neural data through "biological data", which is sensitive only when used or intended for identification.
The practical effect: a wearable that infers attention from physiological signals can fall inside one state's definition and outside another's. See the glossary entry on neural data for the statutory wording.
Is there a federal neural data law?
No. The MIND Act of 2025 (S.2925), introduced on September 29, 2025 by Senators Schumer, Cantwell and Markey, would direct the FTC to study whether new federal authority is needed. It defines neural data as "information obtained by measuring the activity of an individual's central or peripheral nervous system through the use of neurotechnology." The bill-status record shows referral to the Senate Committee on Commerce, Science, and Transportation and no further action. We found no House companion bill. One law firm's analysis describes Section 5 of the FTC Act as the only current federal hook Secondary.
How is neural data protected outside the US?
Chile amended Article 19 of its constitution in 2021 (Ley 21.383), requiring the law to protect "la actividad cerebral, así como la información proveniente de ella". In August 2023, Chile's Supreme Court ruled in Girardi v. Emotiv that the plaintiff's brain data be deleted, in the first Supreme Court ruling on neurodata Secondary; we could not retrieve the ruling text.
UNESCO's Member States adopted the Recommendation on the Ethics of Neurotechnology on November 5, 2025. It flags infringements on mental privacy, calls for explicit consent and transparency, and advises against non-therapeutic use for children and workplace productivity monitoring. A Recommendation is not binding.
Frequently asked questions
What is neural data?
Neural data is information generated by measuring the activity of a person's nervous system, for example with an EEG headband or an implanted brain-computer interface. US state laws define it differently: some cover the central and peripheral nervous systems, others only the central nervous system.
How many US states have neural data privacy laws?
Six as of November 9, 2026: Colorado, California, Montana and Connecticut, whose laws are in force, plus Delaware (effective January 1, 2027) and Vermont's Act 145 (effective January 1, 2028). Vermont's separate Act 101 recognizes neurological rights but creates no compliance duties.
Do neural data laws require opt-in consent?
Mostly. Colorado, Connecticut, Delaware and Vermont require consent before processing neural data as sensitive data, and Montana requires express consent. California is the exception: it gives consumers a right to limit the use of sensitive personal information rather than requiring opt-in consent.
Can individuals sue under state neural data laws?
Not under any of the six laws in this tracker. Enforcement sits with state attorneys general or, in California, the California Privacy Protection Agency. Vermont's Act 145 expressly prohibits a private right of action, and the California private right of action covers data breaches only.
Is there a federal neural data law in the US?
No. The MIND Act (S.2925), introduced in September 2025, would direct the FTC to study neural data governance. Its official bill-status record shows one action: referral to the Senate Committee on Commerce, Science, and Transportation on September 29, 2025.
Do these laws cover consumer devices like EEG headbands?
They can. The definitions turn on measuring nervous-system activity, not on whether the device is a medical implant. Whether a given wearable is covered depends on the state: California excludes data inferred from nonneural information, and Connecticut, Delaware and Vermont cover only the central nervous system.
Where can I read the analysis behind this tracker?
- Free tool • In-browserCheck which of these laws apply to your productPick your users' states, the kind of data you collect and a date.
- Research Desk • Nov 2026, updated Nov 9Neural data law keeps spreading state by state, and the definitions don't match.
- Research Desk • Jul 2026, updated Nov 9Your brain data has a legal status now: the neurorights wave.
- GlossaryNeural data: definition
- Topic hubBCI companies compared (2026)
Changelog: Nov 9, 2026 — tracker published, covering six enacted state laws, two related 2026 measures, federal status and the international layer. This page is a research summary, not legal advice.
Sources
- HB24-1058: Protect Privacy of Biological Data (signed act) — Colorado General Assembly
- California Consumer Privacy Act statute, effective Jan 1, 2026 — California Privacy Protection Agency
- MCA 30-23-102, definitions — Montana Legislature
- MCA 30-23-106, enforcement — Montana Legislature
- Public Act 25-113 (SB 1295) — Connecticut General Assembly
- Chapter 743jj, Connecticut Data Privacy Act — Connecticut General Assembly
- HB 380 (153rd General Assembly) — Delaware General Assembly
- Title 6, Chapter 12D, Delaware Personal Data Privacy Act — Delaware Code
- Governor Meyer signed historic data privacy legislation — State of Delaware, Sep 2, 2026
- S.71 (Act 145) as enacted — Vermont General Assembly
- Act 145 summary — Vermont General Assembly
- H.814 (Act 101) as enacted — Vermont General Assembly
- S.2925, MIND Act of 2025 (text) — U.S. Government Publishing Office
- S.2925 bill status — U.S. Government Publishing Office
- Ley 21.383 — Biblioteca del Congreso Nacional de Chile
- UNESCO adopts first global standard on the ethics of neurotechnology — UNESCO, Nov 2025
- California enacts new restrictions on AI-based employee monitoring (AB 1883) — Secondary: Hunton Andrews Kurth
- All the neural data and no common rule — Secondary: Davis Wright Tremaine, May 2026
- Commentary on Girardi v. Emotiv (Chilean Supreme Court, Rol 105.065-2023) — Secondary: Revista de Bioderecho (Rodríguez Astudillo, 2024)
- California SB 44 (2025) status — Secondary: LegiScan
- The neural data Goldilocks problem — Secondary: Future of Privacy Forum
