Consumers are used to the idea that their personal data is collected and shared by apps and digital services they use, but with the rise of consumer neurotechnologies, data collection is becoming even more intimate. These technologies can monitor brain activity, treat anxiety and depression, and interpret brain signals while browsing dating apps. Colorado recently passed a law aiming to protect neural data for the first time in the U.S., expanding the definition of sensitive data to include biological and neural data. The law gives consumers the right to access, delete, and correct their data, as well as opt out of targeted advertising.
The law targets consumer-level brain technologies, as the data surrounding these technologies is largely unregulated compared to sensitive patient data from medical devices. There are concerns about the potential misuse of neural data to decode thoughts, learn sensitive mental health information, and discriminate based on brain waves. The law in Colorado now protects neural data similar to biometric data, granting consumers control over their data and regulating how companies handle it.
Consumer neurotechnology is expected to grow rapidly with the involvement of major tech companies. While some brain technologies have led to breakthrough treatments, there are also concerns about the privacy implications. Most consumer neurotechnology companies analyzed were found to have weak privacy policies and could potentially share data with third parties. Colorado’s new law received bipartisan support but faced opposition from private universities and is seen as a stepping stone for potential federal legislation on neural data privacy.
California and Minnesota are also moving towards similar neural data protection laws, while other countries are already taking steps to protect brain-related data at the state or national level. Global standards for protecting neural data are seen as a long-term goal. The Colorado bill may apply only to companies using neural data for identification purposes, but advocates believe it offers crucial protections for personal data, setting a precedent for other states and potential federal laws.
The law has limitations in how it applies to companies that use neural data for purposes other than identification. Tech companies like Apple and Meta were involved in shaping the law and raised concerns about its broad scope. These companies successfully lobbied to focus on regulating brain data used for identification while failing to remove language governing data generated by bodily functions. Human rights organizations are pushing for more stringent policies regarding biometric data collection, storage, and use, including neural data.
