US state neural data laws · Grey Matter

The US state neural data laws are amendments to state consumer privacy laws, first in Colorado and California in 2024, that classify data measured from a person's nervous system as sensitive, and they are the first laws in the United States written specifically for consumer neurotechnology.

US state neural data laws. The US state neural data laws are amendments to state consumer privacy laws, first in Colorado and California in 2024, that classify data measured from a person's nervous system as sensitive, and they are the first laws in the United States written specifically for consumer neurotechnology.

Colorado went first. House Bill 24-1058, signed on 17 April 2024 and in force from 7 August 2024, added biological and neural data to the sensitive data of the Colorado Privacy Act, which means a company needs a person's consent before processing it and must honour their rights to access, correct and delete it. California followed with Senate Bill 1223, signed on 28 September 2024, which added neural data to the sensitive personal information of the California Consumer Privacy Act, giving consumers the right to limit its use to what is needed for the service they asked for.

The definitions differ in one clause. Both cover information generated by measuring the activity of the central or peripheral nervous system; California excludes data inferred from non-neural information, and Colorado protects neural data when it is used or intended for identification, through its definition of biological data.

They govern consumers and businesses. Data held by health care providers under medical privacy law, and data collected in research under ethics rules (clinical trials included), are mostly outside the California act, so the implants in clinical trials fall under other regimes.

They are a pattern other states are following. Minnesota was already considering a similar bill in 2024, and further states have introduced their own since.

Questions: Do the new neural data privacy laws cover the recordings from a Neuralink trial implant? Largely not. The California act, to which SB 1223 added neural data, does not apply to information collected in research conducted under applicable ethics rules, including clinical trials, nor to protected health information held under medical privacy law, and the Colorado act has similar exemptions. Recordings from implants in clinical studies are therefore governed by research ethics, trial protocols and health privacy rules, while the neural data laws target consumer devices, a gap that matters once implants move from trials to products. How do Colorado and California define neural data, and what changes for a company that collects it? Colorado's law, signed in April 2024, defines neural data as information generated by measuring the activity of a person's central or peripheral nervous system that can be processed by or with a device; California's, signed in September 2024, uses nearly the same words and excludes data inferred from non-neural information. In Colorado neural data became sensitive data under the Colorado Privacy Act, so a company needs the person's consent to process it; in California it became sensitive personal information, which consumers can require a business to use only as needed for the service they asked for. Both laws attach the protection to the measurement itself, before anything is decoded from it.